The French Data Protection Authority (hereinafter CNIL) has issued an article regarding the Frequent Asked Questions, regarding the right to be forgotten. This comes at a very precise moment in time, following the resolution of the French State Council regarding the litigation between the CNIL and Google. It was far from clear how was supposed to interpret this ambiguous right enshrined in the GDPR.
The CNIL has approach the issue with an question-answer sample. .
It covers the following areas:
What is de-listing? The right to be forgotten means that an individual, under certain circumstances is entitled, to request to a search engine the removal of ones´ personal data.
The CNIL stresses the fact that the removal of that information does not remove the information from the source website, which could be accessible through other searching engines.
Where did the right to de-listing originate?
According to the publication of the CNIL this right was first recognized in Europe by the Court of Justice of the European Union in 2014. Afterwards, on May 25 2018 it was enshrined in the General Data Protection Regulation.
The scope and limitation of this right has been drafted by the CJEU mainly in two decisions.
How do you exercise the right?
You can directly request the searching engine to remove the results that come into confrontation with you privacy rights. You can find complete forms available on broswers sites You must include the URL and the reason why its violating your privacy.
Do search engines always have to agree to a de-listing request?
Search engines must assess on a case-by-case basis whether to act on a de-listing request or, given the circumstances, refuse to comply with it.
What criteria enable search engines to assess requests on a case-by-case basis?
- The prominence and function of the individual concerned;
- the age;
- the nature of the content in question;
- the conditions and date of the content’s uploading;
- any repercussions that its listing is likely to have for the person concerned.
Is the right to de-listing systematic if “sensitive data” is concerned?
The presence of sensitive data in indexed content should in principle lead to its de-listing, except if it appears “strictly necessary” to public information. However, the Court specifies that the special protection provided to sensitive data cannot be the same when it is clear that the data in question was made public by the concerned person him/herself.
Is the right to de-listing systematic if data includes offences and criminal convictions?
Regarding offences and criminal convictions the Court is of the opinion that in this case this data has an especial weight when assessing the balance between party´s privacy and freedom of information. Having said so, the Court recommends a case by case approach. It sets some criteria to be taken into account when dealing with a request of de-index such data (seriousness of the offence; if the proceedings are ongoing, public interest, among others).
What geographical reach does de-listing have?
In principle, the right to be forgotten has an European scope. Nevertheless, the Court underlined that European law does not forbid a Member State to provide for a de-referencing with a global scope and make impossible for internet users to access to a delisted link from the identity of the data subject, whatever their research location in the world.
What can you do if the search engine refuses your request?
The data subject can turn to the DPA or to the Courts.
What role does the CNIL play?
The CNIL has adopted a a reference grid made available to search engines; and a list of common criteria enabling them to examine the complaints they receive following a search engine’s refusal to de-list.
Furthermore, if the case reaches its concern it has the power to carry out a firsthand investigation, strike a fair balance between both interests at stake at and enforce its resolution.
Further information, CNIL link