Article 17 now specifically provides for the 'right to erasure', previously termed the 'right to be forgotten', which would require the data controller to take all reasonable steps to have individuals' data erased, including by third parties 'without delay', for the personal data that the controller has made public 'without legal justification'.
Under Article 17, data subjects are granted the right to 'obtain from the controller the erasure of personal data relating to them [
] and from third parties the erasure of any links to, or copy or replication of that data', where the data are no longer necessary in relation to the purposes for which they were collected, that individual withdraws consent or objects to the processing of his/her personal data, or where the processing of such data contravenes other parts of the Regulation.
Previously, a large part of the debate on the 'right to be forgotten' has focused on the feasibility of implementing and enforcing the right given the surrounding issues of cloud computing and Big Data. Prior to the amendments, a data controller who made any personal data public was obliged to inform third parties which were processing such data that an individual had requested them to erase any links to, or copies of that data, and to take all reasonable steps, including technical measures, to have the data erased. The controller was also considered responsible for any third party publication of personal data authorised by the data controller.
Peter Fleischer, Google's Global Privacy Counsel, declined to comment on the changes and adoption of Article 17. However, Fleischer referred to his statement posted in Google's 'Thoughts on the Right to be Forgotten', on 16 February 2012, which stated: "Ultimately, responsibility for deleting content published online should lie with the person or entity who published it. Host providers store this information on behalf of the content provider and so have no original right to delete the data. Similarly, search engines index any publicly available information to make it searchable. They too have no direct relationship with the original content. We're supportive of the principles behind the right to be forgotten - and believe that it's possible to implement this concept in a way that not only enhances privacy online, but also fosters free expression for all."
The National Court of Spain also previously referred the question of the right to be forgotten to the Court of Justice of the European Union (CJEU) as reported by DataGuidance. Rafael García del Poyo, Partner at Osborne Clarke, said: "'Full' right to be forgotten must recognise that the real power of the use of personal data comes essentially from the metadata created by the companies by generating huge databases indexable, searchable and very valuable of the data produced by users.''
ENISA experts have expressed concerns about the technical hurdles to enforcement of the right, as it is remains difficult in an open system to restrict the re-publication of data where sharing is primary. ENISA has also noted that cases may arise where there are conflicting wishes on whether a piece of information should be deleted, for instance when two people appear in a photograph and one wants it deleted.