Right to be forgotten under European Union Law

These grounds include the following:

• the personal data is no longer necessary in relation to the purpose for which it was collected or processed;
• the data subject withdraws consent and there is no other legal ground for processing;
• the data subject has objected and there are no overriding legitimate grounds for the processing;
• the personal data have been unlawfully processed;
• erasure is required to fulfill a statutory obligation under European Union law or the right of the Member States.

The Court of Justice of the European Union was, on numerous instances, required to interpret this right and in 2014 it developed jurisprudence wherein it established that individuals in the European Union may and can request online search engines to remove any link containing their personal information from web results appearing under searches for their names. However, the court also held that this right is not without its limitations and indeed such request may only be acceded to in those cases where data protection rights outweigh the public’s interest.

Despite this development, confusion arose as regards to the territorial applicability of this right. Indeed, this confusion led to the parties making an application to the Court of Justice of the European Union in Case 507/17. The issue that arose was related to the fact that the Commission nationale de l’informatique et des libertes requested Google to delete all links from its search engine worldwide. However, Google insisted that the right to be forgotten only applied within the European Union.

This matter was brought before the Court of Justice of the European Union. The court decided that in accordance with European Union Law, there was no obligation on the part of Google to apply this right worldwide and thus concluded that the territorial scope of the right to be forgotten is limited to European Union states.