Privacy & identity 27 January 2021

Right to be forgotten and search engines

The European Data Protection Board Guidelines 5/2019, in their version 2.0 updated as of July 7, 2020, focus on the issue of the right to be forgotten in cases concerning search engines and therefore, of the so-called “right to delist“.

The EDPB states that the delisting involves the deletion only of the specific content concerning the data subject from the list of results returned by the research for that person’s name. Therefore, the delisting of a content does not follow the deletion of the other personal data of the data subject that will remain on the origin website, on the index and on the cache of the search engine provider.

The guidelines deal, on one hand, with the grounds relied on by the data subject who submits a request for delisting, and, on the other hand, with the exceptions to that right.

The art.17(1) of the GDPR identifies the criteria for the exercise of the right to be forgotten in the case of search engines. According to this provision, the personal data available in the search results related to the data subject may be deleted where:

  1. they are no longer necessary with respect to the purposes for which they were processed, in the event that the information has been made accessible for a longer period than due, such that personal data has become obsolete or out-of-date;
  2. the data subject withdraws their consent if the legal basis of the processing made by the search engine provider is to be ascribed to the consent given by the data subject;
  3. the data subject objects to the processing pursuant to Art. 21(1) of the GDPR in the absence of “compelling legitimate grounds to proceed with the processing”, the existence of which it is up to the holder to prove;
  4. the processing is unlawful in the light of Article 6 of the GDPR to be interpreted extensively as a violation of any legal provision other than the GDPR;
  5. the deletion fulfils a legal obligation arising from an injunction, a provision of national or European law or the violation of the data deletion period by the search engine provider;
  6. the collection of data is related to the direct offer of services from the information society to minors within the terms referred to in Article 8(1) of the GDPR.

If the above conditions are met, the data controller “has an obligation to delete personal data without justified delay”. However, the right to delist is not an absolute right and therefore there are exceptions for its exercise.

Article 17 (3) of the GDPR identifies the cases in which this cancellation obligation on the search engine provider does not apply. In particular, the search results relating the data subject cannot be erased where the processing of his/her personal data is necessary:

  1. for the exercise of the right to freedom of information of internet users, to be assessed on the reason of the general interest in access the information, taking into account the nature of the information as its sensitive nature;
  2. for the fulfilment of a legal obligation to which the data controller is subjected (although it is unlikely that national laws provide for an obligation to publish certain information on search engine providers and not on the publishers of web pages then linked to the search engine) or for the fulfilment of a task carried out in the public interest or in the exercise of public authority (although it is unlikely that Member States will give search engines providers public authority in this regard);
  3. for reasons of public interest in the field of public health after recognition of the lawfulness of the processing by national or European law;
  4. for storage purposes in the public interest, scientific or historical research or for statistical purposes, in which cases the provider has to demonstrate that the delisting of the content represents an obstacle to the pursuit of those purposes.

With these guidelines, thus, the EDPB wanted to guide the National Supervisory Authorities in resolving the cases concerning the right to be forgotten in the context of search engines. It is therefore highlighted that the right to delisting must be declined in a non-absolute sense, so that its protection follows a necessary and delicate balance of interests between the rights of the data subject and the right of the public to access information.