Conditions of the Right to Erasure

This chapter zooms in on Article 17 GDPR, on the right to erasure (‘right to be forgotten’). It meticulously dissects the three paragraphs of this provision. The first paragraph lists six rights-to-erasure triggers which can be summarized as: (a) purpose expiration; (b) withdrawal of consent; (c) right to object; (d) unlawful processing; (e) legal obligation; and (f) withdrawal of consent by minors in the online environment. The second paragraph comprises an odd extension of the right to erasure, enabling data subjects to request that controllers who have made the personal data public, communicate potential erasure to anyone else processing that same personal data. The third paragraph lists five exemptions to the right to erasure, summarized as: (a) freedom of expression and information; (b) legal obligation or task carried out in the public interest or official authority; (c) public interest in the area of public health; (d) public interest archiving, scientific and historical research, or statistical purposes; and (e) legal claims. What becomes clear right away is how both the right-to-erasure’s triggers and exemptions all refer to other legal provisions in and outside the GDPR. As such, the right to erasure can be seen as a central hub in the GDPR, bringing together key data protection principles from the perspective of data subject empowerment.

The Right to Erasure in Practice

This final chapter takes a practical approach, looking at challenges to accommodating the right to erasure and how to resolve them. Indeed, assuming the right to erasure applies (see Part I), and that a fair balance can be drawn (see Part II), the right still needs to be operationalized on the ground. This chapter roughly has two main parts. The first one identifies and evaluates the key hurdles to operationalizing data subject empowerment in the information society services context. This is done by pinpointing complexities, describing the results of empirical research testing data subject rights, and a critical appraisal of potential abuses of the right to erasure. It is concluded that in practice, the right to object will often be much more realistic and effective in empowering data subjects. Secondly, the chapter lists the key requirements for effective data subject empowerment. It does so by building on all the previous chapters and the practical evaluation in the previous section. Effectuating data empowerment—and the fundamental right to data protection (Art 8 Charter)—does not solely hinge on the GDPR, but requires a holistic approach considering other legal frameworks as well. Technical tools and reshuffled incentive structures for dominant market players will also prove fundamental in rendering data empowerment effective.

Balancing in the GDPR

This chapter takes a step back and looks at fair balancing acts induced by invoking the right to erasure. It starts with comparing balancing of fundamental rights and freedoms in the Charter with balancing in the GDPR. Indeed, it re-emphasizes how the GDPR as a whole, essentially constitutes a framework for fair balancing of rights, freedoms, and interests in the context of personal data processing. The chapter then lays out the actual blueprint for such fair balancing in the GDPR. It becomes clear how fair balancing in the GDPR is an iterative process, with ex ante and ex post balancing acts. The former need to be performed before processing initiates, and the latter refer to subsequent balances as triggered by data subject rights for example. Overall, the very nature of fair balancing does not allow for clear-cut, categorical answers to conflicts of rights, freedoms, and/or interests. Instead the GDPR should be looked at as defining the basic infrastructure for ensuring fair balancing, further to be refined by relevant stakeholders. This can notably happen through standards or certification mechanisms, guidance by authorities, and by controllers themselves.

Open Questions on Balancing in the GDPR

This chapter discusses some of the loose ends that remain after the previous two chapters in Part II on Fair Balancing and Data Protection. In particular, it tries to frame answers to—or at the very least nuances—key questions arising from right-to-erasure-induced-balancing-acts in the information society service (ISS) context. After a critical appraisal of open-ended fair balancing in the data protection context, the chapter tackles questions such as how far ISS controllers’ responsibility to balance goes; whether the GDPR defines a balance that is biased towards data subjects; and whether the framework is not essentially ‘privatizing’ fair balancing. The last half of the chapter is dedicated to some important elements that nuance the aforementioned questions, and the debate on GDPR balancing by ISS controllers more broadly. It emphasizes the importance of taking into account the size and broader context in which large ISS providers operate; makes a critical appraisal of the merits and pitfalls of a granular and functional approach; shows how the GDPR essentially defers fair balancing; and explains the right to erasure should not be looked at as a binary (ie full erasure v unrestrained processing).

Foundations of Data Protection Law

Chapter 2 lays the groundwork for the rest of the book, clearly delineating the fundamental right to data protection, its relation to the GDPR, and the right to erasure in it. The historical overview demonstrates that the emergence of data protection is inherently tied to technological developments and how these may amplify power asymmetries. It is also made clear that informational self-determination or control over personal data lies at the heart of the fundamental right to data protection as proclaimed in Article 8 Charter. This is a clear difference with the GDPR that has a much wider prerogative, ie protecting all fundamental rights and freedoms whenever personal data is being processed. Put differently, whereas Article 8 Charter safeguards a minimum level of control over one’s personal data, the GDPR installs a fair balancing framework that safeguards any and all fundamental rights and freedoms as they are affected by the processing of personal data. The substantive provisions of the GDPR can be divided into four categories along the lines of ex ante v ex post and protective v empowerment measures (see data protection matrix). This chapter ends with positioning the right to erasure within the GDPR’s arsenal of ex post empowerment measures, describing its legislative history as well as its main benefits and drawbacks.

Summary and Conclusion

The last chapter of this book summarises the main points of all individual chapters. As such, it tries to frame a more comprehensive answer to the central question throughout the book: i.e. does the right to erasure meaningfully contribute to safeguarding the fundamental right to data protection in the face of online power asymmetries? In traditional lawyer-fashion, the answer is 'yes... but', with the 'but' referring to several potential hurdles that might obstruct an effective exercise of the right to erasure. Importantly, data subject rights can be powerful tools not just to safeguard the fundamental right to data protection, but many other Charter provisions as well. The chapter concludes that the right to data protection not only implies the freedom to proactively control one's personal data, but also safeguards that freedom from being effectively usurped (e.g. by commercial, technological or bureaucratic forces). The GDPR contributes to this aim both by concrete empowerment tools, as well as by turning the processing of personal data into a liability.

Balancing Scenarios

Having defined the mechanics of (GDPR) balancing in Chapter 5, this chapter explores three concrete balancing scenarios. The three scenarios are selected based on their prevalence in the information society services (ISS) context, and on the different types of entities they generally represent: (a) commercial interests, mainly relating to the ISS provider; (b) information freedoms, mainly relating to third parties such as users of the ISS provider; and (c) research and security interests, mainly representing a shared or common interest. It appears from a combined reading of the GDPR, policy documents, and CJEU case law that as a general rule, commercial interests cannot trump data subjects’ interests when exercising their right to erasure or to object. When these rights affect the information freedoms of third parties, the GDPR requires powerful ISS providers to take up their responsibility, but only insofar as they actually control the respective information processing operations. In order for research interests to be able to override data subject rights, it will generally have to be carried out in the public interest and severely hampered by anonymization. With regard to security interests, finally, the processing will have to be strictly necessary, effective, and proportionate. Overall, this chapter clearly demonstrates how fair balancing is an inherently open-ended legal exercise. The GDPR tries to provide some structure, inter alia by setting clear defaults in favour of different rights, freedoms or interests that might be particularly at risk in certain situations.

Scope of the Right to Erasure

Having laid the foundation of data protection empowerment in Chapter 2, this chapter zooms in on the GDPR’s scope of application in particular. It examines the territorial, material, and personal scope respectively, with a focus on the latter two because of their particular relevance in light of the book’s overall focus. What becomes very clear is how malleable and dynamic the nature of (personal) data is, something which will prove to be important with regard to making the right to erasure work in practice. This chapter also fleshes out the concept of controller, particularly in the context of information society services (ISS) with many different actors involved in processing the same personal data. It appears that from data subjects’ perspective, ISS providers will practically always be approachable with a right to erasure/object, even if not ultimately responsible or liable. Chapter 3 ends with describing four key derogations and exemptions in the GDPR, which may effectively lead to the inapplicability of the right to erasure. What appears from this chapter overall, is the importance of a granular and functional approach when determining the GDPR’s scope of application. This is all the more important in light of the growing complexity of the ecosystem, with many moving elements.

Introduction

Chapter 1 sets the scene for this book. It does so by charting some of the main technological and economic trends underlying today's information-driven power asymmetries and individuals' loss of control over (personal) data. This is made concrete in four real-word vignettes (on Uber, Facebook, Google and Apple), each highlighting different problematic facets and featuring throughout the rest of the book. The Chapter ends with providing a roadmap for the book as a whole, explaining the central themes and questions and how they relate to one another.