The passage of time may reverse the balance of interests involved in the processing of personal data. This provides a rationale for the so-called ‘right to be forgotten’ – namely, data subjects’ right to exclude or limit the further processing of their personal information. This right has been endorsed in a number of judicial decisions in various EU Member States and has been affirmed in the recent Google-Spain decision by the European Court of Justice. To analyse the rationale of the right to be forgotten, I consider the evolving balance between legally relevant advantages and disadvantages resulting from the processing of personal data. For modelling this evolving balance, I propose a method based on the identification of trends over time and on their graphical representation. On the basis of this analysis, I consider how remedies and sanctions meant to implement the right to be forgotten may affect expectation and motivations of content and host providers, and consequently influence their behaviour. I argue that in the EU legal framework data subjects should be granted the right to request from competent authorities an injunction to have their personal data removed or their distribution limited when unrestricted online distribution is no longer justified by the balance of the interests at stake. However, sanctions against online distribution may induce premature forgetting. In particular, they may have a chilling effect on the distribution of information for journalistic purposes, negatively affecting freedom of expression and information.Sartor concludes
When information is distributed online, the importance of impacts on the affected legal interests may change through time. In particular, the interference on the data subjects’ privacy interests may subsequently outweigh the originally prevailing publicity interests of publishers and readers. This pattern provides a rationale for a right to have personal information delisted, de-indexed or removed from the Internet, even when its online distribution was originally legitimate.
The existence of such a right justifies granting data subjects a power to request the competent authorities to issue injunctions restricting access to personal data. However, it does not justify subjecting publishers and the providers to sanctions in all cases in which, according to the subsequent judgment of the competent authority, the data has continued to be distributed after the balance of interests has changed in favour of privacy. In fact, data protection sanctions include both pecuniary and moral damages and severe fines, which may have a chilling effect.
Two circumstances motivate this concern. First, the parties (publishers and the host providers) usually have a small motivation to continue the online distribution of a particular piece of information, since they only partially internalize the social benefits resulting the availability of the information. Secondly, they are uncertain on the adjudicator’s assessment concerning the reversal time, namely, the time at which privacy interests start to outweigh publicity interests. Under such circumstances it seems likely that expected sanctions will outweigh the parties’ motivation to continue the distribution, even when the information could be legally published. This may lead to self-censorship by the publisher or to collateral censorship by the provider. I have consequently argued that publishers should not be sanctioned for failing to comply with requests by data subjects, unless the illegality of the continued distribution can be easily established. Host providers—including search engines—acting in good faith should enjoy an even broader immunity for failures to comply with private requests, on the bases of the immunities provided by eCommerce directive.
I should remark that my arguments here are only meant to address a restricted set of cases, ie cases such that (i) they concern the online distribution of information to the public, (ii) this distribution was originally legitimate, on grounds of freedom of expression and information, though negatively affecting data subjects and (iii) the passage of time has determined a reversal in the balance of the interests at stake. Different considerations may apply to cases where the online processing was illegitimate from the start, or has become illegitimate since the data subject has withdrawn her consent, this being the only legal basis for the processing.