The Unexpected Consequences of the EU Right to Be Forgotten

Abstract

The right to be forgotten as established in the CJEU's decision in Google Spain is the first online data privacy right recognized in the EU legal order. This contribution explores two currently underdeveloped in the literature aspects of the right to be forgotten: its unexpected consequences on search engines and the difficulties of its implementation in practice by the latter. It argues that the horizontal application of EU privacy rights on private parties, such as internet search engines—as undertaken by the CJEU—is fraught with conceptual gaps, dilemmas, and uncertainties that create confusions about the enforceability of the right to be forgotten and the role of search engines. In this respect, it puts forward a comprehensive legal framework for the implementation of this right, which aims to ensure a legally certain and proportionate balance of the competing interests online in the light of the EU's General Data Protection Regulation (GDPR).

A Decision-Making Process to Implement the ‘Right to Be Forgotten’ in Machine Learning

“…However, the majority of this literature lacks consideration of the technical development and application of ML which could significantly impact practical interpretation of the RTBF. The second type of legal literature focuses solely on the implementation of the RTBF in the search engine field, as well as analysing critical cases that mainly addressed its implementation in relation to Google, notably the CJEU decision on Google Spain [29] or Google vs CNIL and GC and Others [30], since this is the most common practice of the right [31][32][33][34][35]. The CJEU's flexible and subjective interpretation of the right in its jurisprudence leads the authors to construct an adaptive holistic approach to implementing the RTBF.…”

“…The way the GDPR articulates the exemptions creates three main considerations when applying the RTBF in ML. First, the GDPR shifts the responsibility of balancing the right to privacy and data protection and other rights from the government to the controller [31]. In other words, controllers are required to determine whether the data subject's rights outweigh, for example, other rights, interests or the legal requirements.…”