Children’s right to be forgotten on the Internet

Children’s right to be forgotten on the Internet

The right to be forgotten, understood as the power to request the deletion of personal information that harms a person’s privacy or reputation, has become particularly relevant in the context of the Internet. This right, included in the General Data Protection Regulation (GDPR) of the European Union and in the Organic Law 3/2018, on Data Protection and guarantee of digital rights (LOPDGDD) in Spain, has a particular impact when it comes to minors. 

Minors, due to their vulnerability, require reinforced protection in the digital environment, especially with regard to the information that they or third parties have shared about them. This article examines the legal implications of minors’ right to be forgotten on the Internet, with specific reference to the regulations in force in the European Union and Spain.

The regulatory framework of the right to be forgotten

The General Data Protection Regulation (GDPR), applicable throughout the European Union, establishes in article 17.1 the right to erasure of personal data, also known as the right to be forgotten. This right can be exercised when:

1. a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
2. b) the data subject withdraws the consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) and the consent is not based on another legal ground;
3. c) the data subject objects to the processing pursuant to Article 21(1) and no other legitimate grounds for the processing prevail, or the data subject objects to the processing pursuant to Article 21(2);
4. d) the personal data have been unlawfully processed;
5. e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the controller;
6. f) the personal data have been obtained in connection with the provision of information society services referred to in Article 8(1).

For its part, Organic Law 3/2018 reinforces this protection in Spain. In its article 15, the law grants any person the right to request the deletion of their personal data in accordance with Article 17 of the GDPR. Furthermore, in its article 84, it introduces specific protection for minors on the Internet, establishing that parents, guardians, curators or legal representatives shall ensure that minors make a balanced and responsible use of digital devices and information society services in order to guarantee the appropriate development of their personality and preserve their dignity and fundamental rights.

Consent in the processing of children’s data

A central aspect of the right to be forgotten is the management of consent in the processing of minors’ data. Organic Law 3/2018 establishes, in its article 7, that the processing of data of minors requires the consent of the parents or guardians if the minor is under 14 years of age. This requirement has a dual purpose: to protect minors from unnecessary online exposure and to ensure that decisions about their personal data are taken with due responsibility.

In addition, if a child, over time, wishes to withdraw the consent that was given, or wishes to remove information that he or she considers harmful to his or her privacy or reputation, he or she can invoke his or her right to be forgotten to request the deletion of that information. This right becomes particularly relevant when minors reach the age of majority, at which point they can demand the deletion of data that were processed when they did not yet have the capacity to give fully informed consent.

The right to be forgotten on social networks and search engines

Minors are often very present on social networks and other digital platforms. Article 94 LOPDGDD specifically addresses the right to be forgotten in social networking services and equivalent services, establishing that minors can request the removal of content in which they appear, even if it was published by third parties. This provision is essential to avoid the perpetuation of minors’ personal data which, over time, may harm their public image or privacy.

As regards search engines, article 93 regulates the right to be forgotten in Internet searches, allowing Everyone has the right to have Internet search engines remove from lists of results obtained from a search based on his or her name any published links containing information relating to him or her that are inappropriate, inaccurate, irrelevant, out of date or excessive or have become so over time, taking into account the purposes for which they were collected or processed, the time that has elapsed and the nature and public interest of the information. 

This measure seeks to ensure that obsolete or irrelevant personal data are no longer accessible to the public, especially when they may affect the welfare of the child.

Enhanced protection in cases of minors

Existing rules recognize that minors require special protection as regards their right to be forgotten. This is based on the idea that minors may not be fully aware of the consequences of sharing their personal data on the internet. For example, recital 38 of the GDPR states that children deserve specific protection, especially with regard to the processing of data for marketing or profiling purposes. This particular sensitivity towards children has prompted digital platforms and data protection authorities to strengthen their measures to ensure that this right is respected.

For all these reasons, the right to be forgotten by minors on the Internet is an essential tool to protect their privacy and reputation in an increasingly omnipresent digital environment. Both the GDPR and the LOPDGDD offer specific and reinforced protection for minors, recognising their vulnerability to the processing of personal data. This right allows minors, or their representatives, to request the deletion of harmful or unnecessary information, thus ensuring their well-being and dignity in the digital environment. It is essential that platforms and search engines respect this right, especially in a context where data can have long-term repercussions.