In the digital environment, media content is no longer fleeting. A news item published today may remain available for years, easily searchable and permanently linked to the name of a particular individual. For that very reason, in practice, the question is increasingly being raised as to where the public’s interest in being informed ends, and where the individual’s right begins to ensure that certain events from the past do not remain forever tied to their identity.

This issue becomes particularly prominent when the right to erasure, also known as the “right to be forgotten”, comes into conflict with freedom of expression and the public’s right to information. A recently adopted decision of the Estonian Data Protection Authority (“DPA”) provides a good example of how that balance may be assessed in the case of media archives and content that was undoubtedly of public interest at the time of publication, but has, over time, lost part of its justification.

The Right to Erasure and Its Limits in the Media Context 

The General Data Protection Regulation (“GDPR”) provides for the right of the data subject to request the erasure of their personal data in certain situations. However, that right is not absolute, nor can it be viewed separately from other protected rights and interests.

The issue of its application in the media context is particularly sensitive. Information that was of interest to the public at the time of publication may, after the passage of time, continue to produce serious consequences for an individual’s private and professional life, even though it has lost its relevance for the public. At the same time, the fact that certain content was published as part of journalistic reporting does not automatically mean that data capable of making a particular individual identifiable must remain permanently available in its original form.

It is precisely digital media archives that make this issue more complex than before. Unlike a printed edition that “fades into oblivion” over time, online articles remain easily accessible, indexed and connected to search engines, which can significantly prolong and intensify the consequences of publication.

The Case Before the Estonian DPA 

The Estonian DPA was faced with a case in which an individual filed a complaint after a media publisher failed to respond to his request for erasure under the GDPR.

The data subject requested that his name and photograph be removed from newspaper articles, stating that the continued availability of those data affected the livelihood and well-being of him and his family. The essence of the request, therefore, was not to dispute the very fact that reporting on a particular event had once been permissible, but rather that the permanent and easily accessible identification of that individual had, over time, begun to produce consequences exceeding the purpose of the original publication.

The Estonian DPA forwarded the same request to the controller, but the controller proposed a different solution, namely de-indexing the articles, that is, removing their visibility through internet search engines. The data subject did not accept such a solution. Thereafter, the DPA again requested erasure of the data, but the controller rejected that request as well, maintaining its position on de-indexing the articles.

The Position of the Estonian DPA: The Passage of Time May Change the Relationship Between the Public Interest and the Rights of the Individual

In its decision, the Estonian DPA found that the articles in question had caused excessive harm to the data subject and that the public interest in the information contained in those articles had weakened over time. This indicates that the fact that certain information was, at one point, of public interest does not necessarily mean that the same degree of public interest continues to exist years later.

Proceeding from that, the DPA did not order the complete removal of the disputed articles, but instead adopted a more moderate approach. The controller was ordered to remove the photograph of the data subject and replace his name with initials, thereby limiting the possibility of his further identification, but without completely removing the content from the public domain.

Such an approach shows that the right to be forgotten does not necessarily have to lead to the complete removal of media content, but may also lead to solutions that simultaneously protect the individual’s privacy and preserve the basic informational value of the published article.

The Significance of the Estonian DPA’s Decision for Future Practice

The decision of the Estonian DPA goes beyond the significance of an individual case, as it indicates the direction in which European practice may further develop when it comes to the relationship between the right to be forgotten, media archives and freedom of expression. It remains to be seen whether other European regulators will follow this approach, particularly in cases where the passage of time changes the relationship between the public interest and the individual’s right to privacy. For the media and other controllers, this decision is also a reminder that the lawfulness of the original publication does not necessarily mean the continued justification for the unrestricted availability of all identifying data.

As regards Serbia, domestic personal data protection practice generally follows European trends, and it therefore remains an open question whether the Serbian Commissioner, in similar circumstances, could adopt an approach similar to the one accepted by the Estonian regulator.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.