Lawyer Vincenzo Colarocco
In accordance with the provisions of Article 70(1)(e) of Regulation (EU) No 679/2016 (“GDPR”), on 2 December 2019 the European Data Protection Board (“EDPB” or the “Committee”) adopted guidelines on the relationship between the right to be forgotten and search engines (hereinafter the “Guidelines”, available at the following link: https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2019/guidelines-52019-criteria-right-be-forgotten-search_it). The purpose of the Guidelines is to provide a correct interpretation of the right to be forgotten (pursuant to Art. 17 GDPR) and of the right to object to the processing (pursuant to Art. 21 GDPR) in the light of what has been established by the European Court of Justice following the outcome of the well-known case C-131/12 (Google Spain SL and Google Inc. c.). Agencia Española de Protección de Datos “AEPD” and Mario Costeja González, judgment of 13 May 2014). In the introduction, the EDPB points out that each request for cancellation must trace its legitimacy in the wide range of cases provided for by Art. 17 GDPR, specifying how, in practice, some legal bases will be more frequent – and more relevant – than others. For example, the Committee points out that, in the event that a data subject considers that a specific news pertaining to him or her is now obsolete, he or she can justify his or her request to be forgotten by search engines by virtue of the provision set forth in Article 17, paragraph 1, letter a) of the GDPR concerning the cases in which “personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed”. On the other hand, it seems unlikely that a request for deletion will be made on the basis of a revocation of consent previously given (pursuant to Article 17(1)(b) of the GDPR) because, if there is actually consent to the legitimacy of the processing, such consent will have been given to the web editor and not to the search engine which indexes the data. The Guidelines therefore focus on cases where, in line with the provisions of Article 17(3) GDPR, data controllers may not comply with a request for deletion. Among the above circumstances – which can be derived overall from the aforementioned article – the EDPB focuses on the most complex cases: the balance between the right to be forgotten and the right to freedom of expression and information, pointing out that, inevitably, in the context of this assessment, will detect a variety of factors such as: the nature of the data and the relative degree of “sensitivity”; the real interest of Internet users in accessing the information for which deletion is requested; the possible public role played by the data subject requesting it.