Data Protection Commissioner Saviour Cachia has said that it is up to data controllers to determine whether to uphold right to be forgotten requests or not.

The Malta Independent sent a number of questions to the Commissioner after the controversial revelation by Justice Minister Owen Bonnici, that some judgements were removed from the online database. Bonnici said that he had authorised the Court's Director General to remove online judgements when requested by individuals when he deems fit. The situation caused controversy, with many questioning such a decision, and further scrutinising the fact that it was at the discretion of the Director General of the courts. The Maltese IT Law Association (MITLA) had hit out at the way the situation was handled.

The Data Protection Commissioner said that making available personal data on-line constitutes processing of personal data. “Every data subject has a right to request the data controller to exercise his right to be forgotten. It is up to the data controller to determine whether to uphold the request made by the data subject or not. This could be determined on a case by case basis after evaluating the harm being caused to the data subject as a result of having his data online.”

Asked whether the right to be forgotten extends to court judgments and their availability online, He said “the right to be forgotten may also extend to making available the judgements on-line, but this shall not mean that court judgements will be deleted from the official records of the court.”

Following the original set of responses received, this newsroom sent further questions to the Data Protection Commissioner. This newsroom asked whether allowing the removal of online judgements would remove the idea of easy public access, would go against the public’s right to know, and go against court transparency. He was also asked about the interests of the other affected parties, whether he was asked to give an official opinion by government on this topic, and, among other questions, whether there is any differentiation depending on the kind of judgement or crime committed and how one would decide what can and cannot be removed.

 “I re-iterate what I said in my previous reply particularly that, for the purposes of a right to be forgotten request, it shall be within the discretion of the data controller to decide whether or not to satisfy the request made by a data subject. It has to be clear that the data subject has the right to request such removal from publication on-line to the data controller.  This is similar to any other right which the data subject may decide to exercise with a data controller, such as, a request to have the personal data rectified or to gain access to the data processed.”

He said that the right to be forgotten was the subject of general discussions which were held with the Director General of the Law Courts.  “The discussions centred on the right to be forgotten to be requested by individuals subject to online judgements.”

“In those instances where a data subject feels that a request has been partially satisfied or completely ignored, the law grants the individual with an effective remedy to lodge a complaint with my office. When a complaint is lodged, an official investigation is initiated and depending on, inter alia, the nature of the case, the findings established during the investigation and the necessary legal analysis, a decision is issued by this Office.  In all decisions issued by this Office, the principles of necessity and proportionality are applied. Should any party (i.e. the data controller or data subject) feel aggrieved by the decision, the said party may file an appeal to the Appeals Tribunal, following which the injured party may then appeal to the Court on a point of law.”

“It is in this context that I strongly believe that each case, in particular complaints which this Office receives from data subjects alleging an infringement of their rights, must be investigated on their own merits, taking into consideration all circumstances of the case, and the necessary action is taken accordingly.  This is a normal procedure which this Office has been following since the coming into force of the Data Protection Act (DPA).” 

“In the case of online judgements, this Office will order such measures as necessary to safeguard the rights and freedoms of the individual, taking also into consideration the public interest in relation to the specific publication of the judgement being contended,” he said.

“It is perhaps useful to note at this juncture that although data subjects have contacted this Office regarding the subject matter, no formal complaint has been lodged, presumably, that the data subjects were satisfied with the outcome of the action taken by the Director General of the Law Courts.”

“As a last point, the right to data protection is a fundamental human right and I fully recognise that, similar to other such rights, it is not absolute but must be put into the balance with other fundamental rights and freedoms.  Again, necessity and proportionality are applied in all decisions, and the judicial process provides for redress.”