The Right to Be Forgotten

The right to be forgotten, also known as the right to erasure, is a legal principle established by the European Union (EU) as part of data protection law.

According to the General Data Protection Regulation (GDPR), anyone in the EU and European Economic Area (EEA) has the right to request that a data custodian, controller, owner, or processor delete information that pertains to them when it no longer serves its intended purpose or has become obsolete or inaccurate.

One legitimate concern is that this principle may conflict with other established legal processes for ensuring privacy and protecting against defamation, libel, or slander. It may also conflict with a legitimate need to protect freedom of expression, as well as other legal requirements for data retention designed to reduce fraudulent activities.

Some countries outside the EU and EEA, such as Argentina, Brazil, South Korea, and India, have implemented their versions of the right to be forgotten to protect individual privacy. In contrast, in a 2016 court ruling, the People's Republic of China (PRC) held that its citizens did not have such a right. In 2017, the PRC enacted the Cybersecurity Law to enhance data protection and privacy requirements within China. More nations will likely follow suit.

The right to be forgotten continues to evolve in international law and privacy regulations.

Organizations interacting with people or entities from countries with data protection laws should seek legal advice before complying with "forget me" or data deletion requests.

In 2019, the Court of Justice of the European Union (CJEU) limited the application of the GDPR generally, and the right to be forgotten specifically, to the jurisdiction of the EU, clarifying the territorial scope while leaving open the possibility of global application. The actual span and reach of the right to be forgotten, in the EU and elsewhere, remains unsettled at this point.