About Forgetting and Being Forgotten

For the first time, the General Data Protection Regulation (GDPR) will explicitly codify a right to be forgotten. This right will be laid down in Article 17. Yet, it more likely resembles a right to erasure. Furthermore, the member states are free to impose restrictions. A right to erasure already exists in the current German data protection law. To decide whether a claim for deletion must be admitted or not, various rights have to be weighed. On one hand, there must be considered the protection of personal data, the respect for the private life, and human dignity; on the other hand, the entrepreneurial freedom, the right to freedom of expression, the freedom of information, and the freedom of press have to be taken in consideration. Various criteria that are partly determined by the European Court of Justice help to weigh the different interests.


Introduction
Admittedly, in Europe there is no party as in George Orwell's "1984" that is capable of reshaping the past. However, it must be examined to what extent "forgetting" and "being forgotten" are able to influence the legal system and society.
Already in 2010, the former European Commissioner for Justice Viviane Reding demanded that every EU-citizen should have a right to be forgotten. 1 Six years later it is still questionable whether a codified right to be forgotten exists (2. and 3.) or will exist (4.), how one can reconcile the different interests of all parties (5.) and how such a right can be enforced (6.).

The Current Legal Situation in Germany
The purpose of the right to be forgotten is the protection of privacy. The aspects regarding data protection law are regulated in the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The more the lives of individuals can be monitored online, the more relevant becomes the questions of deleting lawfully saved data from the internet. 2 Regarding the claims of the data subject against non-public bodies, section 35 BDSG provides a right to correction, deletion and blocking and the contradiction against the elicitation, processing and use of their data. This way it is possible to prohibit and restrict the unlawful (and under certain circumstances even lawful) processing of personal data. 3 As far as social networks are concerned, one can refer to section 35 para. 2 sentence 2 no. 4 BDSG, which regulates that data shall be erased if an examination shows that further storage is unnecessary. This is the case when the data subject demands erasure from the respective service provider. 4 As far as the data subject contradicts at the responsible body and his or her interest outweighs, it is prohibited to use personal data and to gather it for an automatic processing. That might at least be the case if the data subject wants to erase his or her personal data that was uploaded in a social network by a third party. 5

Standards of the ECJ
A judgment of the ECJ from 2014 made a man famous who actually had the intense desire to achieve the exact opposite.
The Spaniard Mario Costeja Gonzalez had not paid his social insurance contributions. Therefore his house was about to be put up for compulsory sale. Eleven years later, he discovered that, whenever he googled his name, the reporting about this incident was one of the first search results. His attempts to make Google Spain delete the corresponding links remained unsuccessful.
The ECJ held that the practice of searching engines was a use of personal data and that these companies are obligated to delete the links to websites of third parties under certain circumstances. Furthermore, it is not important, whether the publication of the personal data on the website of the third party was lawful or not. However according to the German jurisdiction, in case of a lawful publication the right to information outweighs the right to be forgotten. 6 As a reason to give priority to the right to be forgotten, the ECJ named the risk of a detailed profile building. This danger would be increased by the importance of searching engines in the modern society. 7 On the one hand, the jurisdiction of the ECJ was strongly criticized, 8 on the other hand it was called one of the most important jurisdictions of the ECJ of all time. 9 The main opinion of the daily press that this jurisdiction of the ECJ constitutes the first proper right to be forgotten, is not convincing. The ECJ does not demand to delete the information itself from the internet. The operators of searching engines are only forced to delete the link to the information. The terms "the right to be hidden" 10 and "the right not to be indexed" 11 are more precise.
Further, it can be criticized that without any explanatory statement the ECJ refused to applicate the privilege of the media regarding data protection, which is based on the freedom of press, to the operators of searching engines. 12 So far, according to Google's interpretation of the judgment the links only had to be deleted from the European Google-domains. The relevant information was still available via google.com. After heavy criticism by privacy protection stakeholders, Google now uses geo location signals to establish a global access restriction. However, this tool only prevents the access to the URL by computers located in the country of the person, who requested the blocking. 13

The General Data Protection Regulation
The GDPR 14 will take effect in 2018 and explicitly codifies the right to be forgotten for the first time.
Despite all media-effective announcements, article 17 turns out to be nothing more than a right of the affected person to request erasure of personal data concerning him or her from the respective responsible person. The legal norm lacks an automatic deletion of information after a certain time, which is suggested by the passive formulation "to be forgotten". Article 17 para. 2 GDPR determines that a person, who published the data and is obliged to delete it, has to take all reasonable actions to inform third parties that also processed data like copies and hyperlinks must be deleted. These claims are rather a "right to erasure". It must be used actively. Nevertheless, the aim is similar and it is based on the same idea of protection.
The key question in this context is the relationship between the entitlement to deletion and the public interest in information.
For this purpose, Article 17 para. 3 lit. a GDPR states that the claim shall not apply to the extent that the processing is necessary for exercising the right of freedom of expression and information. Additionally, Article 85 para 1, 2 GDPR gives the member states the extensive permission to harmonize the right to protection of personal data and the protection of the freedom of expression and information by establishing national regulations. They can define exemptions, in particular for journalistic purposes.
By handing such an important decision to the member states, the unique opportunity to form similar regulations throughout the Union and to determine an order of priority between the different legal interests, was missed.

The Complex Tangle of Interests
Depending on the individual case, the vital interest of the affected person to protect his or her personal rights conflicts with the business interest of internet companies, the authors' freedom of expression and the public's freedom of information. 15 To bring these different rights in accordance, various criteria can be gathered from the judgment of the ECJ. These criteria are not isolated, but interact with each other. Four general categories can be built: Firstly, the role of the affected person in public life must be considered. 16 The smaller this role, the bigger is the entitlement for privacy. 17 To classify persons with either permanent or no importance for public life, e.g. politicians or "normal" citizens is not a problematic subject. It is more challenging though to categorize people with a contextual public presence, such as participants of casting shows.
The type of the information serves as a second criterion. It has to be taken in consideration that information can be both sensible for the affected person and of relevance for the public. 18 For this purpose, the "theory of spheres" can be used. 19 After this theory, there are three different spheres, the social-sphere, the private-sphere and the intimate-sphere. In general, interference in the intimate-sphere indicates a right for deletion. An interference in the social-sphere indicates the opposite. The validity of the information is also relevant. 20 Thirdly, the source of the information should be analyzed. The more dubious the source is, the more reasons to speak in favor of a deletion. 21 The fourth criterion is time. Up-to-date information has a higher need for protection than older information. 22

Enforcement of the Claim
Not only the tangle of interests, but also the enforcement of the claim poses various difficulties. In order to prevent negative side effects, like the Streisand effect, 23 requests for deletion must be dealt with confidentially.
To create legal certainty the underlying procedure has to be formalized. The legislator should establish a harmonized format for applications based on the model of the cancellation policy.
In case of failure to reach an agreement, there is still the opportunity to go to ordinary courts. In Germany alone, there have been nearly 100.000 requests so far to Google for deletion since the ECJ judgment. Since more than half of the requests were refused 24 this could mean a significant additional burden to the courts.
One way to prevent an overload is to establish an intermediary body in the form of German or European arbitration bodies. 25 Only in case of failure to reach an agreement at this intermediary instance the track to the ordinary courts would be open.
However, the question remains under which conditions third parties that have processed information can be obliged to erase the information in internet related cases. 26  The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet. en.wikipedia.org/wiki/Streisand_effect. 24 Google, Transparenzbericht, https://www.google.com/transparencyreport/removals/europeprivacy/ ?hl=de. 25 German Institute for Trust and Security on the Internet (DIVSI), Das Recht auf Vergessenwerden, p 85. 26 Buchholtz, ZD 2015, p 571. 27 Kieselmann et al. 2015, p 33 et seqq.

Conclusion
It is the mutual task of politics, justice and society to reconcile the conflicting interests of personality and information. To prevent the individual from being forced to make use of his or her right to be forgotten, information and sensitization relating the infringement of fundamental rights through carefree handling of personal data should be promoted. 28 To avoid the cumbersome procedure of a deletion, one should only make as much personal data available in the internet as necessary.