Do South Africans have a right to be forgotten? European court says not yet 

• The right to be forgotten (RTBF) – also known as the right to erasure or to de-list – refers to an entitlement to demand that search engines, such as Google, not show results containing old information about a person where the privacy rights outweigh the public interest in continued access to the information.
• The Court of Justice of the European Union has recently ruled that where a search engine operator has granted a de-listing request of a data subject in a European Union (EU) member state, there is no obligation under EU law for the search engine operator to carry out the de-listing on all versions of its search engine globally – although EU law would not prohibit such a practice.
• There is scope for the RTBF to be recognised under South Africa – once the substantive provisions of the Protection of Personal Information Act 4 of 2013 have been brought into force – but it remains to be seen how this will be enforced or applied.
• In applying the RTBF, it is imperative that every effort is made to ensure that an appropriate balance is struck between all competing rights and interests, including the importance of the right to freedom of expression when balanced against the right to privacy.

What is the right to be forgotten?

The right to be forgotten (RTBF) – also known as the right to erasure or to de-list – refers to an entitlement to demand that search engines, such as Google, not show results containing old information about a person where the privacy rights outweigh the public interest in having continued access to the information.

The development of the RTBF galvanised in 2014, in a case before the Court of Justice of the European Union (CJEU) regarding Mr Gonzalez, a Spanish national. Mr Gonzalez complained that when internet users searched his name on Google, the search results included links to a news story from 1998 about his outstanding debts. Mr Gonzalez argued that the matter had since been resolved and was therefore now irrelevant.

The CJEU held that Mr Gonzalez was entitled to request that information about him no longer be made available to the general public through the list of search results where having regard to all the circumstances, the information appeared to be inadequate, irrelevant or no longer relevant, or excessive in relation to purposes of the processing.

However, the CJEU did note that the removal of links from search engine results could affect internet users who may a legitimate interest in the information.  In this regard, the CJEU explained that a fair balance would have to be struck between that interest and the data subject’s fundamental rights, taking into account the nature of the information, its sensitivity for the data subject’s private life, and the interest of the public in having that information.

According to the Google Transparency Report, there have since been over 850 000 requests to de-list under European privacy law, with these requests relating to 3 372 636 URLs requested to be de-listed.

The case of Google v CNIL

Following the case of Mr Gonzalez, various litigation has arisen globally regarding the RTBF: some courts have followed a similar approach to the CJEU, while others have declined to recognise such a right under their domestic law.  Most recently, on September 2019, the CJEU handed down its ruling in the matter of Google LLC v Commission Nationale de l’Information et des Liberties (CNIL), in which the court was asked to decide whether a de-listing order in a member state of the European Union (EU) meant that the search results had to be removed from all the search engine’s domain name extensions globally.

The CJEU noted that the internet is a global network without borders and that obliging a search engine operator to remove links from all versions of its search engine would give more comprehensive effect to the RTBF.  However, the CJEU emphasised that numerous states outside the EU either do not recognise the RTBF or have taken a different approach to this.  As noted by the CJEU, “the balance between the right o privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world”.

The CJEU therefore concluded that where a search engine operator has granted a de-listing request of a data subject in an EU member state, there is no obligation under EU law for the search engine operator to carry out the de-listing on all versions of its search engine – although the CJEU also noted that EU law would not prohibit such a practice.

It is therefore apparent from the judgment that orders giving effect to the RTBF in the EU are not necessarily required to have a global reach.  This approach recognises the importance for different jurisdictions defining their own approaches to the RTBF, including in striking the right balance between the rights to privacy and to freedom of expression online.

Codification of the RTBF under EU law

Following the various litigation, the EU has now codified the RTBF in article 17 of the General Data Protection Regulation (GDPR).  This provision requires that personal information be erased without delay where, for instance, the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the personal information is no longer necessary for the purpose for which it was collected.

In the event that such erasure is required, the GDPR further provides that all reasonable steps must be followed – taking into account the available technology and the cost of implementation – to inform all controllers processing the personal information that any links or copies of the personal information should also be erased.

Importantly, there are certain key exceptions that apply. For instance, the RTBF does not apply to the extent that the processing is necessary for exercising the right to freedom of expression and information; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research, or statistical purposes; or for the establishment, exercise or defence of legal claims.

The South African position

Although South Africa a comprehensive data protection law – the Protection of Personal Information Act 4 of 2013 (POPIA) – the substantive provisions are not yet in force. POPIA is based on the 1995 EU Data Protection Directive but has not been updated in line with the GDPR. As such, POPIA does not contain any express provision regarding the RTBF.

POPIA does, however, require that personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.  Further to this, a data subject is entitled to request that their personal information be corrected or deleted where it appears that the personal information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.

There is, therefore, the scope for the RTBF to be recognised in South Africa once POPIA is fully in force, although it remains to be seen whether, and if so how, the Information Regulator or the courts will approach this.  In doing so, it is imperative that every effort is made to ensure that an appropriate balance is struck between all competing rights and interests.

Opportunities and risks

The RTBF brings with it both opportunities and risks.  On the one hand, it can have positive effects: for instance, where a child has consented to the processing of personal information while not being fully aware of the risks involved, particularly on the internet, that person should arguably be entitled to have such personal information erased at a later stage once they become more aware.

However, there are concerns about the misuse of RTBF.  Google, for instance, argued before the CJEU that the obligation could be used by authoritarian governments to cover up human rights abuses. Other freedom of expression organisations, such as the Electronic Frontier Foundation, have expressed concern that any global de-listing order would conflict with the rights of users in other jurisdictions, particularly the rights to expression, petition and assembly.

Ultimately, any application of the RTBF should be carefully construed in line with the public interest override. It is easy to imagine in South Africa – particularly with the legacy of apartheid, state capture and various controversies – that there are many people who would want historic references to them erased.  In determining any application of the RTBF, careful regard would need to be had to all relevant factors, including the public interest in the information; the role played by the affected person in public affairs; the journalistic, artistic or historical relevance of the information; and the importance of the right to freedom of expression when weighed against the right to privacy.

Avani Singh is a Director and Co-founder of ALT Advisory. Avani writes in her personal capacity and her views do not necessarily constitute the views of ALT Advisory.

Please note: The information contained in this note is for general guidance on matters of interest, and does not constitute legal advice. For any enquiries, please contact us at [email protected].