The Unexpected Consequences of the EU Right to Be Forgotten: Internet Search Engines as Fundamental Rights Adjudicators

Introduction

In its landmark judgment in Google Spain, the Court of Justice of the European Union (the Court or CJEU) held that data subjects have a ‘right to be forgotten’¹ under EU data protection law, which requires the de-listing of links to web pages containing information relating to them from the list of results displayed following a search made on the basis of the person’s name. The right to be forgotten is an important online right of the data subject recognized at the EU legal order. It is enforced against internet search engines who are considered data ‘controllers’ for the purposes of EU data protection law (Google Spain, para 38).

The right to be forgotten was not expressly spelled out in the Data Protection Directive (DPD), but the CJEU found that this could be derived from a combination of Arts 12 and 14 thereof that grant the data subject the rights of rectification, erasure or blocking of their personal data and the right to object to the processing of this respectively. The right to be forgotten is, nevertheless explicitly recognized in the General Data Protection Regulation (GDPR) that repeals and replaces the Data Protection Directive. More specifically, Art. 17 GDPR entitled ‘Right to erasure (“right to be forgotten”)’ contains a much broader right than the one established in Google Spain allowing the data subject to obtain the erasure of personal data concerning him or her and creating the concomitant obligation of the controller to erase personal data without undue delay.

Much ink has been spilled in the academic literature on the right to be forgotten both regarding its recognition by the CJEU in Google Spain (Frantziou, 2014; Kulk &Frederik Zuiderveen Borgesius, 2014; Rees & Heywood 2014; Lynskey, 2015; Spiecker genannt Döhmann, 2015; Kranenborg, 2015; Post, 2017) and its legal entrenchment in Article 17 GDPR (Leta Ambrose, 2012; Leta Ambrose & Ausloos, 2013; McGoldrick, 2013; Sartor, 2013; Sartor, 2015; Keller, 2017). The academic debate has examined different aspects of this right, such as its content, its territorial application and its implications on freedom of information and internet governance. Taking into account the existing debate, this specific chapter focuses on the narrower online right to be forgotten that arose from Google Spain and explores two aspects of this, currently underdeveloped in the literature: its unexpected consequences on search engines and the difficulties of its implementation in practice by the latter.

More particularly, it addresses two crucial elements regarding the fundamental question of the implementation of the right to be forgotten by private parties that were left to a large extent unanswered after Google Spain: First, the horizontal application of the fundamental rights to privacy (Article 7 EUCFR) and data protection (Article 8 EUCFR) on private parties –as undertaken by the CJEU- is fraught with conceptual gaps, dilemmas and uncertainties that create confusions about the enforceability of the right to be forgotten. Secondly –and closely linked to this- the horizontality of EU privacy rights involves balancing between competing rights that has to be carried out in practice by search engines. Essentially, search engines are made adjudicators of fundamental rights online. This raises serious concerns about the role and responsibilities of internet search engines and ultimately –and more importantly- it questions the purpose of fundamental rights themselves.