“Right To Be Forgotten”

The General Data Protection Regulation (“GDPR”) is coming into force in the UK and the EU in May 2018. Under Article 17 of the GDPR, the “right to be forgotten” means “the right to obtain from the data controller the erasure of personal data concerning him… without undue delay” There are 3 main grounds for this right to be exercised:

• the data are no longer necessary for the purpose collected or processed
• the data subject withdraws consent and no legal grounds for processing remains
• the data subject objects to the processing

What exactly is a right to be forgotten?

Following the ruling by the European Court of Justice in the Google Spain v Mario Costeja González case (2014), Google was asked to remove links to search results linking the name of a Spanish man to some old information regarding the forced sale of his property, as this information was no longer relevant and it might tarnish the man’s present reputation. The court upheld that the right to be forgotten and allowed individuals to request their personal data to be deleted entirely from the data controller’s systems subject to certain conditions and public interest considerations.

While the “right to be forgotten’ is not yet a common feature of the privacy laws in Asia, we are starting to see the first signs of this European trend heading East. In a landmark decision in Japan, a court in Tokyo ordered Google Japan to remove a number of search results that suggested the person have connections with criminal activity. Similarly, a Saitama court cited the “right to be forgotten’ when ordering Google to delist links to a news reports regarding an individual’s criminal conviction. The right to be forgotten had been also considered in numerous cases in Hong Kong. For instance, in an online defamation case involving Albert Yeung (a well-known entertainment tycoon) and Google Inc, and in a data privacy case involving David Webb (a well-known shareholder rights campaigner).

Is there a Right to be Forgotten in Malaysia?

In Malaysia, there is no right to be forgotten in the Personal Data Protection Act 2010 or the Communication & Multimedia Act 1998. No individual in Malaysia has yet raised the right to be forgotten in the court. However, the Malaysian Communications and Multimedia Commission (MCMC) as an Internet regulator had made several requests to Google Inc to block content of videos posted individuals which contained provocative contents on social media. According to MCMC, about half of its requests have been obliged, with YouTube taking action on 33 per cent of the requests, and Facebook 42 per cent. Perhaps, Malaysia shall consider adopting a statutory right to be forgotten in order to enable citizens to request the deletion of outdated/irrelevant information online.