RIGHT TO BE FORGOTTEN
Regulatory basis
-
GDPR Art. 17 - Right to deletion ("right to be forgotten")
-
GDPR Art. 5.1.e - Principle of storage limitation
-
GDPR Art. 6 - Lawfulness of processing
-
CJEU Judgment C-131/12 "Google Spain" (13/05/2014) - First recognition of right to be forgotten
-
Judgment
What it is
The right to be forgotten is the right to obtain the erasure of your personal data without undue delay when one of the conditions set out in Art. 17.1 GDPR applies.
Bottom line: You have the right to be digitally “forgotten” by having information about you removed from websites, databases, social media platforms, and digital archives.
Characteristics:
It is not an absolute right (balanced with other fundamental rights)
It has 6 specific application cases
It applies retroactively (even to old data)
It applies to all data controllers (big tech, SMEs, PA within the limits)
The 6 Cases of Application (Art. 17.1 GDPR)
You can request deletion when:
a) Data no longer necessary (Art. 17.1.a)
The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
b) Revocation of consent (Art. 17.1.b)
You withdraw the consent on which the processing is based and there is no other legal basis for the processing.
c) Objection to processing (Art. 17.1.c)
You object to the processing (Art. 21) and there are no overriding legitimate grounds for the processing.
d) Unlawful processing (Art. 17.1.d)
The personal data has been unlawfully processed (GDPR violation).
e) Legal obligation to erase (Art. 17.1.e)
The data must be deleted to comply with a legal obligation under EU or national law.
f) Data collected from minors for online services (Art. 17.1.f)
The data was collected in relation to an offer of information society services to minors (under 18 in Italy, art. 8 GDPR).
The 3 Exceptions
The owner may refuse cancellation if the processing is necessary for:
1. Exercise of the right to freedom of expression and information (Art. 17.3.a)
Right to report and freedom of the press
Typical conflict: You want to delete → Newspaper invokes right to report
Balancing (Italian Supreme Court):
The right to report prevails IF 3 cumulative conditions are met:
Truth of the facts (or correct attribution to the source)
Public interest in information (social relevance)
Expository restraint (measured language, no gratuitous harm)
Examples:
✅ Oblivion WINS:
15-year-old article on a minor crime (shoplifting) with a conviction now expired
Ordinary (non-public) person involved in an event that is no longer current
News already decontextualized (it is no longer clear what happened next)
❌ Chronicle VINCE:
Politician convicted of corruption: permanent public interest
Relevant historical event (e.g. Tangentopoli scandal)
Recent article on ongoing proceedings
Temporal criterion: The more time passes, the more oblivion tends to prevail (right "to be forgotten" after atonement/rehabilitation).
2. Legal obligation or public interest (Art. 17.3.bc)
Fulfillment of legal obligations (e.g., retention of tax data, anti-money laundering)
Reasons of public interest (e.g. public health, historical archives)
Example: Bank must keep documents for 10 years due to anti-money laundering law → Cannot delete even if requested.
3. Ascertainment/exercise/defense of rights in court (Art. 17.3.e)
If the owner (or you yourself) needs the data as evidence in legal proceedings.
Example: You have a pending lawsuit against a company. The company can't delete the contract data because it's required as evidence.
DIRITTI DIGITALI UTENTI ONLINE