‘Right to be forgotten’ in the General Data Protection Regulation (GDPR)

The following note about DGPR provisions refers to the right to erasure, well-known as ‘right to be forgotten’.

The General Data Protection Regulation will amend and specify partial regulation, which was contained in the provisions of Directive 95/46/WE, later confirmed in the crucial judgment of European Union Court of Justice from May 13, 2014 (case C-131/12 Google Spain SL and Google Inc. vs. AEPD and Mario Costeja Gonzáles.

According to the Article 17 of GDPR, the data subject have the right to obtain from the controller the erasure of personal data concerning him or her, and the controller is required to erase personal data without undue delay where the grounds mentioned in this provision apply. Among those grounds, the following should be mentioned: 

•    personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
•    data subject withdraws consent on which the processing
•    data subject objects to the processing

It should be pointed out that ‘the right to be forgotten’ is not absolute and in some circumstances the provision may be limited by the protection of overriding legitimate interests as, inter alia:

•    the right of freedom of expression and information
•    legal obligation which requires processing of data by controller 
•    reasons of public interest in the area of public health
•    archiving purposes in the public interest
•    scientific or historical research purposes or statistical purposes
•    establishment, exercise or defence of legal claims

This is to remind, that the GDPR provisions will be applicable from 25 May 2018.

Full content of the regulation is available under the link: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=PL