In its ruling of 13th May 2014 the Court of Justice of the European Union (CJEU) decided that individuals can ask Google and other search engines to stop referring to certain information about them (the so called “right to be forgotten”), when this information is inaccurate, inadequate, irrelevant or excessive for the purposes of the data processing. The Court explicitly clarified that the right to be forgotten is not absolute but will always need to be balanced against other fundamental rights, such as the freedom of expression and of the media. The CJEU also ruled on the territoriality of EU rules and the applicability of EU data protection rules to a search engine.
With regard to the above ruling, a new Data Protection Regulation has been proposed under which a fundamental modernisation of Europe’s data protection rules is aimed establishing a new number of rights for citizens and creating a single market for data in the EU, as well as streamlining cooperation between the Member States’ regulators. The Regulation creates an obligation for a controller, who has made the personal data public, to take “reasonable steps” to inform third parties of the fact that the individual wants the data to be deleted, as well as an obligation for the controller to ensure erasure of these data.
In addition, in order to make the right to be forgotten more effective, the Commission has proposed reversing the burden of proof: it is for the company, not the individual, to prove that the data cannot be deleted because it is still needed or is still relevant.