Is it possible for a natural person to exercise the right to be forgotten in Sweden and under the Swedish legal system? The answer is yes, but the right to be forgotten is not an absolute right and it is subject to many variables. In short terms the natural person’s interests of privacy and integrity must be balanced against the public’s interests of access to information.
As a part of the European Union, the processing of personal data in Sweden is regulated by the General Data Protection Regulation1 , the GDPR, and by supplementary national legislation, mainly found in the Swedish Act on Supplementary Provisions to the GDPR2.
Right to be forgotten and GDPR
The right to be forgotten is laid down in Article 17 of the GDPR and in recitals 65 and 66, stating the right for any natural person to have his or her personal data erased, without undue delay, by the entity controlling the processing of the data (“controller”) provided certain circumstances are at hand.
You may for example invoke the right to be forgotten in Sweden when the relevant data is no longer necessary for the purpose the controller originally collected or processed it, when you no longer consent to the processing and the processing was based on your consent, when there are no overriding interests for the controller to continue with the processing after you have objected to the processing and the processing was based on the controller’s legitimate interests to process the data, or when the data is processed unlawfully.
Balancing of Interests
It should also be kept in mind that there are circumstances when the controller’s right to process a natural person’s data overrides the right to be forgotten. Such circumstances are for example when the data is being used by the controller to exercise the right of freedom of expression and information, if the data is being used to comply with a legal ruling or obligation, or if the data is being used to perform a task that is being carried out in the public interest. When assessing the right to be forgotten a balancing of interest must be made.
Google Spain Case
Article 17 of the GDPR incorporates a long-standing principle of the right to erasure under European data protection laws and codifies the landmark ruling by the Court of Justice of the European Union (CJEU) in 2014, the ”Google Spain case3”. In the Google Spain case, the CJEU ruled that “individuals have a right to request search engines to delist certain links from their search index, if the result contains personal information that is ‘inadequate, irrelevant, or no longer relevant, or excessive”.
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Lag (2018:2018) med kompletterande bestämmelser till EU:s dataskyddsförordning.
- Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos and Mario Costeja González (C-131/12, EU:C2014:317).
Right to Request Delisting
The CJEU also found that the right to request delisting applied to links that lead to search results that were protected under the freedom of speech and right of expression, and irrespectively if the name of the natural persons had been deleted from the results or not. It also stated that the search engine’s links were not protected by freedom of speech and right of expression even if the results that the links led to were. However, the CJEU found that the balancing of interests could lead to another result if the natural person for example was an official person.
The Swedish Authority for Privacy Protection
In Sweden a great number of complaints against search engines, such as Google Sweden AB and Google Inc., made by natural persons related to the right to be forgotten have been assessed by the Swedish Authority for Privacy Protection (“IMY”). IMY has also issued its legal position on the right for natural persons to request search engines to delist certain links from their search index, when searches on the natural person’s name leads to results publishing personal data in news media and for journalistic purposes4.
IMY’s Legal Position on Right to be Forgotten
From IMY’s position, that takes its stand in the case law from the CJEU and the guidelines issued by the European Data Protection Board and the Article 29 Working Party, the balancing of interests, shall take into consideration if the results, that the links lead to, have purposes of journalism. In particular delisting may be refused if the publishing is covered by the freedom of speech under the Swedish constitutional laws, The Freedom of the Press Act5 and the Fundamental Law on Freedom of Expression6. Also, it shall be taken into consideration if the natural person requesting delisting is a public person or holds a public position. Also, when a person used to hold a public position but no long does, there may be reasons to refuse delisting, at least for a limited period after the position was left by the person in question.
Even if there are now guidelines and case law on how to assess a request to be forgotten, and how to balance the different interests at stake, this is one of the most debated parts of the GDPR. The right to be forgotten in Sweden is exercised by natural persons but is still difficult to apply for controllers, if you consider the large number of complaints that are made each year to IMY.
Related Articles
- Right to be forgotten in The Indian scenario
- Right to be forgotten in Turkey
- Right to be forgotten in Canada