What effect does Brexit have on Britons' Right to be Forgotten?

Question

As I understand it, the Right to be Forgotten was promulgated solely as an EU regulation1.

Assuming that the UK follows through and leaves the EU, would search engines no longer have to remove results related to British subjects?

Answer 1

The 'right to be forgotten', as currently being applied throughout the European Union (EU), does not come from the General Data Protection Regulation (GDPR), which will come into force 25 May 2018. Rather, the current basis exists in the Data Protection Directive, 95/46/EC, article 12(b):

Right of access

Member States shall guarantee every data subject the right to obtain from the controller:

[...]

(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;

This was one of the main points upon which the Court of Justice of the European Union (CJEU) decided Google Spain v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, the judgement which allowed for individuals to ask for search engines to remove results containing personal data. The CJEU explained that the 'right to be forgotten' was not absolute and should take into account economic considerations as well as other rights (paragraphs 85 - 88).

The GDPR, article 17, for purposes of contrast, has a more robust and explicit right of erasure than currently in force:

Article 17

Right to erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

[...] Shortened for clarity

GDPR, article 17 fleshes out much of the lack of specifics that the Directive's article 12(b).

It should be noted that the UK's Data Protection Act 1998 is a transposition of the Data Protection Directive. This means that the full effect of the rights and obligations in the Directive are contained within the Data Protection Act 1998. Furthermore, the interpretation of the rights and obligations of the Data Protection Directive by the CJEU are highly influential on interpretation of the Data Protection Act 1998. This is due to the European Communities Act 1972, s 3(2) which states:

Judicial notice shall be taken of the Treaties, of the Official Journal of the Communities and of any decision of, or expression of opinion by, the European Court on any such question as aforesaid; and the Official Journal shall be admissible as evidence of any instrument or other act thereby communicated of any of the Communities or of any Community institution

Even without the above provision, it would be extremely likely that British courts would take into account Google Spain, given that the foundation of the Data Protection Act 1998 is the Data Protection Directive. The most likely outcome is for British courts to uphold the interpretation in Google Spain and allow for data subjects to request removal from search engines.

Of course, it is not entirely possible to know without a test case, but it is doubtful any major search engine would attempt to deviate from the current situation as there is currently legal certainty. The Data Protection Act 1998 will still be in force after the future Brexit agreement and is certainly not contingent on continued EU membership.

Update

The current DPA will be repealed when Brexit comes in to play and will be replaced by a new one. Read more about the new data protection bill on the ICOs web site, which is based on the GDPR with certain derogations and additions.

Answer 2

Something like "right to be forgotten" is based on British law, not on the UK's EU membership. Sure, the EU asked the UK (and all its other members) politely to create such a law, and the British government followed that polite suggestion by the EU, but the law is British law. It stays in place until it is changed or revoked by the British government. It doesn't just disappear if or when Britain leaves the EU.

Answer 3

Britain's exit from the EU is a minimum of 2 and a maximum of 7 years away. During this time there will need to be a whole swathe of domestic legislation that will deal with, among other things, this.

So, right now Britons are still covered.