The regulations add for a right to erasure [Art. 17]. This provision expands what had become known as the “right to be forgotten” that the EU Court of Justice had in 2014 in a case adjacent Google Spain. Under the GDPR, individuals can ask club to erase personal dossier in specific circumstances: for example, if the dossier is no longer necessary for the purposes for which it was collected; if the individual withdraws consent or objects and there is no overriding justification for keeping it; or if the dossier was otherwise unlawfully processed in breach of the GDPR. This right also applies if the personal dossier has been made public, raising considerable implementation difficulties given the calmness with which online information can be copied and shared athwart multiple websites in various jurisdictions.
The rules provide exceptions, including if the dossier processing is necessary for the exercise of freedom of explanation and information or for archival or research purposes. However, these are not well defined in the GDPR, and are left for national bill to elaborate. Because private platforms risk cost for non-compliance, the provision may tend to encourage unnecessary or excessive take-downs of content, infringing freedom of expression. In addition, leaving determinations about when alter is necessary for freedom of expression (and other public interest grounds) to the discretion of companies, rather than impartial tribunals, means there is little procedural recourse for those who wish to continue to have entry to information that is removed.
The “right to be forgotten” developed in EU Court of Justice central has been for permissive people to suppress truthful, non-defamatory clue that simply may be unflattering. For example, people in positions of public trust (such as elected officials, priests, and financial professionals) have to use the right to be forgotten to remove news articles discussing their previous criminal confidence from Google search results.