In the digital era, our personal data are constantly being collected, stored, and used by various entities. While this may have benefits such as convenience and improved services, it also raises concerns about privacy and security. This helps necessitate the “right to be forgotten.”
The right was first recognized by the Court of Justice of the European Union in the 2014 case Google Inc v. Costeja González and eventually incorporated under Art. 17(2) of the General Data Protection Regulation of the European Union.
The “right to be forgotten” allows data subjects to request a search engine operator (such as Google), as a data controller, to have information about a person that appears when his/her name is searched via the search engine to “no longer be linked to his/her name by a list of results displayed following a search made based on his name because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information, and links concerned in the list of results must be erased.” (Google Inc v. Costeja, 2014)
In the Philippines, it is recognized in the form of the “right of erasure or blocking” under the Data Privacy Act. In Sec. 16(e) of the DPA, individuals have the right to suspend, withdraw or order the blocking, removal, or destruction of his or her personal information from the personal information controller’s filing system upon discovery and upon substantial proof that the personal data is:
(a) incomplete, outdated, false, or unlawfully obtained;
(b) being used for purposes not authorized by the data subject;
(c) no longer necessary for the purposes for which they were collected;
(d) the data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing;
(e) The personal data concerns private information that is prejudicial to the data subject, unless justified by freedom of speech, of expression, of the press, or otherwise authorized;
(f) The processing is unlawful; and
(g) The personal information controller or personal information processor violated the rights of the data subject.
The relief under this right has become more relevant in the Philippines, where there is a high prevalence of online harassment, cyberbullying, and other online abuses. These involve the sharing of personal information without the consent of the individual concerned. By empowering ordinary people to assert the removal of their data, the right to be forgotten can help mitigate the harmful effects of online abuse and protect people’s privacy and dignity.
However, implementing this right in the Philippines faces challenges, including public awareness and organizational policies for handling requests. Balancing the right to be forgotten with the freedom of expression and access to information is crucial, as erasing data may limit these rights.
For instance, a public figure requests the erasure of information about their past actions — this could be seen as an attempt to suppress information that is in the public interest. Clear criteria and transparent processes for erasure requests can help strike a balance, as an alternative method like data anonymization or pseudonymization. This can help protect privacy while still allowing reasonable access to information.
Indeed, the “right to be forgotten” is an essential legal concept for the protection of privacy and dignity in today’s digital age, especially where online abuse is rampant. Implementing this right requires careful balancing of rights and clear policy development. Addressing these challenges enables the right to be forgotten to promote privacy and security in the Philippines.
Perhaps, Filipinos would feel the protections under this right if we become more assertive of the same and be mindful that anything we do not use, we tend to forget and we eventually lose. Thus, remember the “Right to be Forgotten.”