Document Type : Research Paper

Authors

• Ahmad Reza Tohidi ¹
• Mohammad Ali Sharifi Kia ²

¹ Associate professor of faculty of law of Qom university. Qom, Iran.

² Ph.D. student in iPhD. Student of International Law, faculty of law of Qom university. Qom, Iran.

Abstract

The right to be forgotten, which is the ability of the data subject to request the deletion of personal data related to him/her from the servers of cyberspace processors, has been respected as one of the most fundamental rights of cyberspace users in the European legal system. However, there are differences in legal documents and judicial procedures regarding the manner and scope of application of this right by this system. Therefore, after examining the European General Data Protection Regulation document, the judicial procedure of the European Court of Justice in two of the most important cases related to the scope of application of this right, the following results are obtained:
- The right to be forgotten applies only to personal data and processors are not required to delete other data that do not have this feature.
- If personal data have been anonymized using technical methods and means, in such a way that the identity of the data subject can no longer be established using common and conventional methods and means, the right to be forgotten will not be possible.
- Despite the apparent similarity in the processing operations, the right to be forgotten should not be confused with the right to restrict access and processing, because the result of the first right is the complete deletion of the user's personal data from the processor's servers and all related third-party contractors and service providers, while the result of the second right is only the imposition of restrictions on the transfer and disclosure of personal data to processors and third-party contractors, and in this case, the personal data of individuals will still be in the possession of the primary processor.
- The case law of the European Court of Justice indicates that, despite the supremacy of European law over the national laws of the member states and the elimination of economic borders in this Union, the application of the General Data Protection Regulation in two important cases related to Google concerns the exercise of this right only in the cyberspace of the applicant's country of residence. In other words, despite the possibility of exercising cross-border jurisdiction by the European Court of Justice, which was previously mentioned, according to this judicial institution, it is possible for European users to enjoy this right only within the territory of their country of residence, and the Court has not extended the removal of links related to the data subjects to the entire geographical area of Europe or to the entire cyberspace of the world.
- It should be noted that while the Court in the two judgments of Gonzalez and the French Observer defines the geographical scope of the right to be forgotten as the territory of the Member State of the Union, as was pointed out in the Pizczek case, it does not bind the Member States to issue a non-referral order on a global scale and, if the Member State observes the relevant considerations in order to protect the fundamental rights of the data subject, it has the right to take a decision on such a scale.
- From the Court's perspective, criteria such as the role of the data subject in social life, the nature of the data in question, and the balance of the data subject's fundamental rights to private life and the public right to access information should be taken into account when authorizing the issuance of a non-referral order, and these criteria also have a direct impact on the determination of the scope of the right to be forgotten by the courts of the Member States and the Union.
Finally, it seems that the European Court of Justice, regarding the scope of application of this right, first examines the mentioned criteria by considering the unique circumstances of each case and finally balances the individual's right to data protection and privacy against the public's right to freedom of access to information; then, if the fundamental right of the data subject to have a private life takes precedence over the public right to freedom of information and expression, it orders their deletion on various scales, whether regional or global, depending on the individual's social personality and the nature of the data. However, if all the conditions for deleting links related to the individual are not met, a non-referral order may not even be issued. Finally, given the importance of the General Regulation document in today's cyberspace, as well as the practice of the Union's supervisory institutions, including national supervisors, the European Data Protection Board, and the courts of the member states and the Union, in preventing access to user data and communication with official Union platforms, in addition to imposing heavy financial fines, as a result of non-compliance with the provisions of the said document and lack of coordination with Union laws, and also considering the cross-border applicability of the provisions of the said document and the procedure that the Union has taken to maximally support this unique feature, it seems that all non-member countries (such as Iran) that intend to exchange information with Union member states, access the data of European citizens, or provide services within the Union should take the necessary measures to synchronize themselves with Union regulations and update their national data protection organizations and laws in this regard, so as to both benefit from the benefits of cooperation with global platforms and limit the application of foreign Union laws in their territory by formulating national laws

Keywords

• The right to be forgotten
• Data subject
• General Data Protection Regulations
• Court of Justice of the European Union

Main Subjects

• Public and International Law