FERENIKI PANAGOPOULOU-KOUTNATZI
315
. The proposal to regulate the protection of personal data
The recognition of the right to be forgotten in the form of an express confirma-
tion appears to be an imminent need in this era of absolute digital memory. Con-
sequently, a key consideration is the adjustment of legislation in view of new
technology that supplies vast stores of data, which is precisely the aim that the
Proposal for a Regulation and a Directive Regarding Personal Data seek to serve.
Article 17 grants the data subject’s right to be forgotten and the correlating right
to erasure of personal data. It further elaborates and specifies the right of eras-
ure provided for in Article 12(b) of Directive 95/46/EC and outlines the condi-
tions of the right to be forgotten, including the obligation of the controller who
has made the personal data public to inform third parties on the data subject’s
request to erase any links, or copy or replication of that personal data. It also in-
tegrates the right to have the processing restricted in certain cases, avoiding the
ambiguous terminology “blocking”.
Article 17 states:
1. The data subject shall have the right to obtain from the controller the erasure
of personal data relating to them and the abstention from further dissemination
of such data, especially in relation to personal data made available by the data
subject while he or she was a child, where one of the following grounds applies:
(a) the data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based accord-
ing to point (a) of Article 6(1), or when the storage period consented to has ex-
pired, and where there is no other legal ground for the processing of the data;
(c) the data subject objects to the processing of personal data pursuant to Article 19;
(d) the processing of the data does not comply with this Regulation for other reasons.
2. Where the controller referred to in paragraph 1 has made the personal data
public, it shall take all reasonable steps, including technical measures, in relation
to data for the publication of which the controller is responsible, to inform third
parties that are processing such data, that a data subject requests them to erase
any links to, or copy or replication of that personal data. Where the controller has
authorised third party publication of personal data, the controller shall be consid-
ered responsible for that publication.
The controller shall carry out the erasure without delay, except to the extent that
the retention of the personal data is necessary:
