According to article 17 of General Data Protection Regulation (“GDPR”), “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her”. Such provision establishes the so-called right to erasure or right to be forgotten, which is then one of the possible rights data subject may decide to exercise. However, the right to be forgotten is freely exercisable only where one of the following grounds applies:
– – The personal data are no longer necessary;
– – Withdrawal of data subject’s consent;
– – The data subject objects to the processing of personal data;
– – The personal data have been unlawfully processed;
– – The personal data shall be erased for compliance with a legal obligation in Union or Member State law;
– – Where personal data have been collected in relation to the offer of information society services.
In such context, Italian data protection authority (“Garante della Privacy”) released a decision about data subject’s request to the cancellation of news URLs with regard to legal proceedings occurred during the nineties. In these cases, the Garante tended to balance data subject’s rights expectations with community’s expectations. In fact, to process personal information with a journalistic purpose is legitimate even though it takes place without data subject’s consent provided that such processing complies with the respect of fundamental rights and freedoms. Therefore, the Garante has considered data subject’s request as unfounded because the data processing involves information that are in the public domain.
The right to be forgotten represents one of the most powerful tool data subject may exercise. Should you need assistance or consultancy in matters connected with your data subject rights, please fill the online form and We will get back to you within the next 24 hours.