Googled anyone today? What does everyone find?

The right to be forgotten became a household concept when GDPR entered into force (already being a right following art. 8 of the ECHR, the right to a private life). Simplified (as I am sure you already know) it entails a right to have personal data, whether it is discrediting/sensitive, or just general information, removed from e.g. search engines (and other information carrying entities as well for that matter).

So what of the actual reach of this right to erase information about yourself on the internet today? The right to be forgotten is not absolute. Two key limits to the right is the whereabouts of the person (IP address of the person searching) & the interpretation of “legitimate interest”.

What is a legitamate interest?

Importantly, there is no obligation to erase data if there is “legitimate interest” for continued processing. (Also, data can be kept with consent of the subject, but since we are talking about the right to be forgotten, this is not particularly relevant…) This includes that the right to be forgotten does not apply when a nation disapplies GDPR to uphold freedom of speech, including for ensuring a free press. But what does this mean in practice - when do we, as subjects, not have a right to have information about us erased? Where that boundary goes will be determined on a principle-by-principle and case-by-case basis, to be better defined with time and experience.

For more information and a real-world example of this issue, visit our article here.