News

The Right to Be Forgotten in Spain

Do we have any control over the information that appears about us on Facebook, Twitter, LinkedIn, Google or Flickr? Do search engines have the right to gather and show information about me? Can we ask for this information to be removed at any time? Can we be sure that all our personal details, photos, records or comments will be removed immediately?

The Right to be forgotten is undoubtedly the challenge that will very soon need to be tackled in the face of the incessant activity of Internet users and the configuration of social networks and search engines as the means chosen by internauts to make their contents available.

The Right to be forgotten simply entitles Internet users to request that data that appear about them on the Internet be removed or cancelled and to oppose their data being processed. It is therefore just a further extrapolation of the Right to privacy and personal data protection, in this case applied to the virtual world.

Although the Spanish legislation recognises the right of all citizens to protection of their image and personal data and to decide about the uses that are made of them without their consent, the complexity involved in controlling this on the Internet is the reason behind the increasing importance of exercising this Right to be forgotten, specially in cases where to remove data that have been shared with third parties whose profile remain active, is limited.

In order to apply this principle of law to the Right to be forgotten, it is first necessary to identify who is responsible for processing this information.

As established by Law 43/2002 “those responsible for processing personal data on the Internet are information society service providers”, although they are exempt from responsibility for the information they process when certain conditions are met and certain exceptions fulfilled.

Moreover, as regards the users of Social Media the aforementioned Law establishes their civil and criminal liability for including information about other people in their user accounts.

This Right to be forgotten is implemented through the application of the Right to cancellation of personal data and the Right to oppose the processing of said data, i.e. all citizens provided that they do not hold public office or a have famous profession, are entitled to oppose the unlawful traffic of their data on the Internet and exercise the Right to cancellation by requesting that the owner of the Website removes the personal information in question.

In regard to the Right to oppose the processing of personal data on search engines such as Google, said right has been recognised by the Spanish Data Protection Agency, which urged the aforementioned search engine to adopt the necessary measures to ensure that data could be removed and to prevent said data from continuing to appear in the future.

The exercise of this right with regard to search engines has become an arduous task due to the enormous amount of information that is distributed through them, which has led the Spanish High Court to raise a preliminary issue about the data protection of individuals on Google and about the fact that these data are on the Internet permanently. The responses of the Court in Luxembourg will be binding for all member states.

Meanwhile, there are specialised companies that offer their services for online reputation protection and defence of the right to be forgotten, using the tools provided by the current legislation, either to ensure that negative content is removed or by positioning the positive content above the negative content in order to neutralise the effects.

Carmen Sánchez-Puelles