Technological advancements and the emergence of the Internet have made our data more accessible than ever. Easy access to past events, news, photos, etc., via search engines, puts people at risk of having low self-esteem due to being continuously reminded of the past. In such a case, a person may exercise the right to be forgotten and request for their information and other personal data to be removed from search results. This article will address the relationship between personal data deletion, erasure, destruction, and the right to be forgotten.
In the legislation issued by the United Nations and the Council of Europe on the protection of personal data, there is no globally accepted definition of the right to be forgotten; however, there are decisions or reports that refer to the right about other rights, such as the right to respect for your family and private life, the right to privacy, and protection of personal data.
The Court of Justice of the European Union resolved the first case involving the right to be forgotten. In the case, Costeja Gonzales requested that reports about him claiming that he was forced to sell his property due to unpaid social security bills, which were published on La Vanguardia on two different dates and were accessible when his name was searched online, be removed and anonymized from the newspaper reports, Google search results, and Google Spain results. Gonzales justified his request by claiming that the case against him was settled years ago and that these claims were now entirely unfounded and irrelevant.[1] At the end of the case, the Court ruled that if a search engine result was invalid, incomplete, and wholly or subsequently irrelevant, the material should be erased.
Personal Data Protection Law no. 6698 (“Law”) does not explicitly refer to the right to be forgotten. Still, it gives a basis for exercising it by including sections on the deletion, destruction, or anonymization of personal data and the power to request such measures. Accordingly, data subjects are entitled to request their data’s deletion, destruction, or anonymization.
In its decision no. 2020/481 of 23.06.2020, the Personal Data Protection Authority set out some criteria for removing personal data from online search results. Accordingly, the requirements to be considered while reviewing claims for the right to be forgotten are whether the information in question: “(i) involves a data subject who is a key public figure; (ii) concerns a child; (iii) is invalid; (iv) interferes with the data subject’s professional life; (v) has the nature of the insult, defamation, and slander; (vi) relates to special categories of personal data; (vii) is defunct; (viii) causes prejudice against the data subject; (ix) poses risks for the data subject; (x) was released by the data subject; (xi) covers personal data processed for journalism purposes; (xii) creates a legal obligation to be published, and (xiii) concerns a criminal offense.”
Under article 13 of the Law, the data subject must apply to the data controller to exercise the right to be forgotten. If the data controller does not perform the data subject’s request, the latter has the right to complain to the Board under article 14 of the Law. Since the Board publicly announced the procedures to follow for such complaints, it is recommended that applications be submitted based on those guidelines.
[1]See the guidelines titled “Unutulma Hakkının Arama Motorları Özelinde Değerlendirilmesi”: https://kvkk.gov.tr/SharedFolderServer/CMSFiles/11b6fd99-d42a-45b1-a009-21f2d36ded21.pdf
