By Dr. Edric Micallef Figallo – Associate
The following is the ninth article in a series of articles delving into the GDPR, intended to give an overview of the main aspects of the provisions it introduced, retained and updated in the data privacy law regime of the European Union, and its legislative implementation in Malta.
____________________________________
We were considering the right to object in this article on the right to erasure as we are tackling the grounds for the successful exercise of the latter right. We had ended the previous part of this article, with the statement that “It is the data controller which has to demonstrate the applicability of the same limitations to the right to erasure…”
The “limitations” refer to the requirement under Article 21(1) GDPR for the controller to stop the processing of personal data unless he “demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.”
As we have previously pointed out, the right to erasure under Article 17(1)(c) is grounded in the right to object exercisable as herein referred.
Considering the above and our previous discussion, the situation is one in which the data controller has to stop the processing upon receiving a request by the data subject for the exercise of the right to object, if only to assess the same request. Therefore, the stop is basically immediate yet temporary at first. The previously referred European Data Protection Guidelines have this to say (N.B. They refer to the exercise of the right to erasure, based on the right to object, which in practice could be made concomittantly by the data subject):
“30. The GDPR therefore changes the burden of proof, providing a presumption in favour of the data subject by obliging on the contrary the controller to demonstrate “compelling legitimate grounds for the processing” (Article 21.1). As a result, when a search engine provider receives a request to delist based on the data subject’s particular situation, it must now erase the personal data, pursuant to Article 17.1.c GDPR, unless it can demonstrate “overriding legitimate grounds” for the listing of the specific search result, which read in conjunction with Article 21.1 are “compelling legitimate grounds (…) which override the interests, rights and freedoms of the data subject”. The search engine provider can establish any “overriding legitimate grounds”, including any exemption provided for under Article 17.3 GDPR. Nonetheless, if the search engine provider fails to demonstrate the existence of overriding legitimate grounds, the data subject is entitled to obtain the delisting pursuant to Article 17.1.c GDPR.
As a matter of fact, delisting requests now imply to make the balance between the reasons related to the particular situation of the data subject and the compelling legitimate grounds of the search engine provider. The balance between the protection of privacy and the interests of Internet users in accessing to the information as ruled by the CJEU in the Costeja judgement can be relevant to conduct such assessment, as well as the balance operated by the European Court of Human Rights (ECHR) in press matters.”
It is essential to remember that Article 21(1), and therefore Article 17(1)(c), are dependant on the fact that the data processing must have as its legal basis Article 6(1)(e) or 6(1)(f) GDPR, as we have referred in a previous part. This is important to stress, as the right to object does not apply to all data processing, in fact it refers to the limited scenarios involving Articles 6(1)(e) and 6(1)(f).
On the other hand data processing can happen on the basis of numerous legal bases found under Articles 6 and 9 GDPR, without prejudice to other data processing falling outside of the scope of the GDPR itself. Consequentially, the right to erasure as grounded on the right to object, for data processing falling within the scope of the GDPR, is likewise limited. With that said, we attempted to provide a limited theoretical overview, but the exercise of rights require particular professional attention to the case, its facts and the law in specific detail.
Moving away from the right to object and Article 17(1)(c) GDPR, in the next part we shall consider other grounds for the exercise of the right to erasure.