The right to be forgotten in the draft data protection regulation

Abstract

The right to erasure and to be forgotten, introduced by Article 17 of the Draft Data Protection Regulation, was meant to provide the data subject with an expanded capacity to control personal data, in particular, with regard to the privacy threats resulting from the publication, persistence, and accessibility of personal data on the web. A detailed analysis is provided of the provisions regulating this right in the Draft Regulation, focusing on the scope of the right, the normative entitlements it includes, and the sanctions for its violations. On the basis of this analysis, it is concluded that the Draft Regulation provides some useful but modest changes with regard to the existing discipline of the right to erasure, as established by the 1995 Data Protection Directive. On the other hand, some provisions appear to be redundant or confusing. The Draft Regulation only partially addresses the main issue, which has originated the debate on the right to be forgotten, namely, the on-line publication of personal data. In particular, it remains uncertain whether and under what kind of circumstances host providers can be subject to the exercise of right to be forgotten and to sanctions for its violation.