ENFORCING YOUR RIGHT TO BE FORGOTTEN

data protection Lawyers London


 MPs have just begun to scrutinise new legislation intended to make the UK’s data protection legislation fit for the digital age. One key principle enshrined in the Data Protection Bill, 2017 (which implements the much-publicised General Data Protection Regulation (GDPR) is the ‘right to be forgotten’. This enables people to ask data controllers to move or delete personal data.
The new data protection regime is likely to have far-reaching implications for our clients. We expect our commercial clients to experience a greater volume of requests to delete information as individuals, more than ever aware of their rights, take the opportunity to enforce them.
But how easy will it be for individuals to enforce these rights in practice?

WHAT IS THE RIGHT TO BE FORGOTTEN?
The right to be forgotten (sometimes more appropriately referred to as the right to erasure) makes it easier for an individual to ask for his or her personal data to be removed when there is no compelling reason for it to be retained and used.
One of the legal cases that led to the right being recognised is a good illustration of why it matters. It involved Hugo Guidotti Russo, a plastic surgeon based in Madrid. When he carried out internet searches of his name he was confronted with prominent links to historical stories about a legal claim against him for an allegedly negligent breast operation. According to the 20-year-old articles, he faced a lengthy prison sentence and a multi-million euro fine. There was no mention of his acquittal. Russo argued that – so many years after the complaint – when the matter had been settled, there was no justification for the details to continue to appear.
As well as introducing the right to be forgotten, the UK government has also indicated that individuals will be able to ask social media companies like Facebook to delete information that they posted in their childhood. This power has been labelled the ‘right to innocence’.

CAN I GET ALL INFORMATION ABOUT ME DELETED?
No. The right must be balanced with the right to freedom of expression so the right only exists in certain circumstances. There are also some exemptions that will safeguard for example the processing of data by journalists for freedom of expression reasons and when uncovering wrongdoing.

DOES THE RIGHT TO BE FORGOTTEN JUST APPLY TO GOOGLE?
Most of the discussion around the right to be forgotten has, rightly, centred on how Google and other search engines will respond to their new obligations to delete information. But it is important to remember that GDPR applies to all data controllers, of which Google is just one.
It may therefore be invoked in a whole range of situations – not just to remove embarrassing Facebook posts or unflattering Google search results. Any company that holds personal information may be requested to remove it. There may be consequences for human resource departments and others. What if they retain details of disciplinary warnings that have lapsed? Or marketing companies that hold historical information about customers or potential customers. It’s forseeable that they too would be obliged to comply with a legitimate right to be forgotten request.

DO I NEED LEGAL ADVICE?
Traditionally internet search engines companies have been slow to remove material under the right to be forgotten. For this reason Big Data Law has regularly been instructed by individuals to apply to Google UK and others for data removal. Under GDPR there is a new, much stricter sanctions regime (including very large financial penalties for non compliance). What the impact of this on the way data controllers like Google treat requests for information removal remains to be seen.
Google and others have introduced processes aimed at making it easier to request the removal of data. But right now enforcement of the law is to a degree in a state of flux. Google says it refuses half of the removal requests it receives.
The reason?
The requests don’t show how the relevant data meets the legal criteria for removal. So this shows that it’s crucial to make the strongest possible case to Google and other data controllers when seeking to have information removed. At Big Data Law we can ensure your request is framed correctly and pursue your case with the Information Commissioners Office if necessary.

If you have concerns about how data about you is being used online or elsewhere, get in touch with data protection Lawyers London.
Call us on +44 (0) 7545 813 894.



Location: 4 Bloomsbury Square, London WC1A 2RP, UK

Comments

Post a Comment

Popular posts from this blog

GDPR – IT’S NOT ALL ABOUT CONSENT

Image
The General Data Protection Regulation comes into force tomorrow. Despite what you may have heard, GDPR is not only about getting consent to process the personal information of those people your company interacts with. In the last few days, as the implementation date approaches, you may have been forgiven for believing this to be the case. A degree of panic among businesses appears to have set in regarding the consent issue. Stories of unnecessary GDPR consent emails clogging up inboxes have been widely reported. And the Information Commissioner’s website that contains detailed  GDPR compliance guidance  has crashed . Whether this is due to the sheer volume of traffic following relentless media pressure is unclear. At Big Data Law we have been advising on and  writing about GDPR implementation  for some time. Granted, it represents a big change for businesses that handle personal data with heavy fines a possibility. But it’s important not to overreac...
Read more

HOW WILL GDPR AFFECT EMBASSIES AND CONSULATES

Image
With the GDPR coming into force in the UK on 25 May 2018 it is worth highlighting that the regulations have a broad territorial scope. For embassies and consulates in particular, non-compliance with GDPR could have  serious repercussions  not just for the organisation itself but also for the citizens and commercial enterprises that rely on embassy or consular services. WHERE DOES GDPR APPLY? EU EMBASSIES WITHIN THE EU AND ABROAD Article 3 of the GDPR deals with territorial scope. Where will the new rules apply? For a start the GDPR broadens the international reach of EU data protection rules. They will apply to: ·       The processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. ·       The processing of personal data of data subjects who are in the Union by a control...
Read more

FACEBOOK, CAMBRIDGE ANALYTICA AND THE IMPACT ON GDPR ENFORCEMENT

Image
Facebook’s Mark Zuckerberg  has broken his silence to comment on the unfolding Cambridge Analytica data scandal. He has announced steps his organisation will take to deal with the fallout that has resulted from Cambridge Analytica’s acquisition of the personal data of up to 50 million Facebook users. As the hashtag #deleteFacebook gains momentum it remains to be seen whether Facebook’s actions will be enough to stem the slide in the company’s share price or to restore the credibility of the social media platform. But as we ready ourselves for GDPR, the Facebook/Cambridge Analytica debacle is sure to have repercussions for any company that holds personal data belonging to EU consumers. 3 REASONS WHY GDPR COMPLIANCE MORE IMPORTANT THAN EVER We believe the Cambridge Analytica story makes GDPR compliance more critical than ever for three reasons: ·       The furore has propelled the subject of data protection to the forefront of the politic...
Read more