When data subjects object to the processing of their personal data, they can claim the right to erasure, also known as the right to be forgotten. This blog discusses two practical cases of how such claims may be handled in a court of law.
One of the main things the GDPR intends to accomplish is to provide organisations with guidelines for privacy-friendly processing of personal data. Apart from this, it also explicitly identifies a number of rights for the persons whose data are being processed. One of these is the so-called ‘right to be forgotten’, also known as the right to erasure.
Article 17 of the GDPR lists several grounds data subjects can claim as the basis for a request to have their data deleted. It is, for instance, possible for data to have to be erased because they are no longer necessary for the purpose for which they were collected or being processed. Data subjects may also revoke previously given consent or object to the use of their personal data. Other grounds specified in Article 17 of the GDPR include the expiration of a legally prescribed retention period, collection of personal data related to persons under the age of 16 and unlawful processing of personal data.
This does not mean that a request for data erasure will always be successful. The GDPR also mentions several conditions that do not require the erasure of data, generally with regard to situations in which data are being processed for the purpose of compliance with a legal obligation or for the performance of a task carried out in the public interest. It is also possible for the requirement of data erasure not to apply because, in a given situation, the fundamental right to freedom of expression outweighs other considerations.
In this blog, we will look at two recent lawsuits to find out how courts may handle requests for the erasure of data.
Removal from a youth care file
Recently, a Dutch court ruled in favour of a request for data erasure in a lawsuit filed by the mother of a juvenile boy whose data were being maintained in a youth care file by the City of Almelo.
In this case, the mother demanded removal of this file on the ground that her son’s data were being kept on record without explicit consent of a parent, which under the Dutch Youth Act is a legal requirement. So, the mother claimed that the continued existence of this file represented a case of unlawful processing of personal data. To which the City argued the applicability of a legal exemption, in the sense that the processing was necessary for compliance with a legal obligation imposed by the very same Youth Act, which the City claimed requires retention of youth care files for a period of 20 years. In view of which, the City would be under specific obligation of law to keep processing the data, overruling the general requirement of granting the right to erasure.
In the end, the court judged the City’s argument to be invalid, ruling that there was insufficient substantiation for the City’s claim of the existence, under the Youth Act, of an obligation for processing the data under dispute.
Removal from a website
In a recent case in Austria, the court ruled that the importance of processing personal data for the purpose of scientific or historical research outweighs the privacy interest of an individual data subject.
Here, the personal data of the claimant had been published on a website documenting the history of fascism. According to the administrators, their site serves scientific purposes. The claimant was identified, on the website, as a member of an extreme right-wing faction. The data subject, on the other hand, claimed the right to erasure, arguing that the website lacked historical relevance and, as such, was engaging in unlawful processing of personal data.
Here, the court ruled that the claimant had presented insufficient substantiation for his claim of the website’s scientific irrelevance, while at the same time, his political views had been public knowledge all along. As a result, the request for removal was dismissed.
In spite of the fact that these two cases represent opposite ends of a spectrum in which there are many situations with far-reaching differences in multiple areas, we can still draw two distinct conclusions from them. First, these lawsuits and their outcomes show the decisive importance of arguments being properly substantiated in order to successfully claim the right to erasure or, reversely, the applicability of one of the grounds for exemption. Arguments put forward without strong evidence supporting them, will not be easily accepted by any judge.
The second, more implicit point to be made on the basis of these cases, is that in a court of law, the privacy interests of minors will carry significantly more weight than those of an adult whose political preferences, moreover, were public knowledge to begin with.
It is perfectly possible for data subjects to feel that the processing of specific personal data relating to them clearly qualifies as completely unlawful, but this does not mean that the GDPR will necessarily agree with their claim of unlawfulness. If they bring their claims to court, the judge will always have to balance the conflicting interests in order to reach a verdict that, under the circumstances, is most appropriate and reasonable.