united-kingdom internet
What effect does Brexit have on Britons&#39; Right to be Forgotten?
<p>As I understand it, the Right to be Forgotten was promulgated solely as an EU regulation<a href="https://en.wikipedia.org/wiki/Right_to_be_forgotten#European_Union" rel="nofollow">1</a>.</p>

<p>Assuming that the UK follows through and leaves the EU, would search engines no longer have to remove results related to British subjects?</p>

<p>The 'right to be forgotten', as currently being applied throughout the European Union (EU), does not come from the General Data Protection Regulation (GDPR), which will come into force 25 May 2018. Rather, the current basis exists in the Data Protection Directive, 95/46/EC, article 12(b):</p>

<blockquote>
  <p><strong>Right of access</strong></p>
  
  <p>Member States shall guarantee every data subject the right to obtain
  from the controller:</p>
  
  <p>[...] </p>
  
  <p>(b) as appropriate the rectification, <strong><em>erasure</em></strong> or blocking of data the
  processing of which does not comply with the provisions of this
  Directive, in particular because of the incomplete or inaccurate
  nature of the data;</p>
</blockquote>

<p>This was one of the main points upon which the Court of Justice of the European Union (CJEU) decided <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=982675" rel="nofollow noreferrer">Google Spain v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González</a></em>, the judgement which allowed for individuals to ask for search engines to remove results containing personal data. The CJEU explained that the 'right to be forgotten' was not absolute and should take into account economic considerations as well as other rights (paragraphs 85 - 88).  </p>

<p>The GDPR, article 17, for purposes of contrast, has a more robust and explicit right of erasure than currently in force:</p>

<blockquote>
  <p><strong>Article 17</strong> </p>
  
  <p><strong>Right to erasure (‘right to be forgotten’)</strong></p>
  
  <ol>
  <li>The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase
  personal data without undue delay where one of the following grounds
  applies:</li>
  </ol>
  
  <p>[...]
  <em>Shortened for clarity</em></p>
</blockquote>

<p>GDPR, article 17 fleshes out much of the lack of specifics that the Directive's article 12(b). </p>

<p>It should be noted that the UK's Data Protection Act 1998 is a transposition of the Data Protection Directive. This means that the full effect of the rights and obligations in the Directive are contained within the Data Protection Act 1998. Furthermore, the interpretation of the rights and obligations of the Data Protection Directive by the CJEU are highly influential on interpretation of the Data Protection Act 1998. This is due to the European Communities Act 1972, s 3(2) which states:</p>

<blockquote>
  <p>Judicial notice shall be taken of the Treaties, of the Official
  Journal of the Communities and of any decision of, or expression of
  opinion by, the European Court on any such question as aforesaid; and
  the Official Journal shall be admissible as evidence of any instrument
  or other act thereby communicated of any of the Communities or of any
  Community institution</p>
</blockquote>

<p>Even without the above provision, it would be extremely likely that British courts would take into account <em>Google Spain</em>, given that the foundation of the Data Protection Act 1998 is the Data Protection Directive. The most likely outcome is for British courts to uphold the interpretation in <em>Google Spain</em> and allow for data subjects to request removal from search engines. </p>

<p>Of course, it is not entirely possible to know without a test case, but it is doubtful any major search engine would attempt to deviate from the current situation as there is currently legal certainty. The Data Protection Act 1998 will still be in force after the future Brexit agreement and is certainly not contingent on continued EU membership.</p>

<h1>Update</h1>

<p>The current DPA will be repealed when Brexit comes in to play and will be replaced by a new one. Read more about the new <a href="https://ico.org.uk/for-organisations/data-protection-bill/" rel="nofollow noreferrer">data protection bill on the ICOs web site</a>, which is based on the GDPR with certain derogations and additions.</p>

<p>Something like "right to be forgotten" is based on British law, not on the UK's EU membership. Sure, the EU asked the UK (and all its other members) politely to create such a law, and the British government followed that polite suggestion by the EU, but the law is British law. It stays in place until it is changed or revoked by the British government. It doesn't just disappear if or when Britain leaves the EU. </p>

<p>Britain's exit from the EU is a minimum of 2 and a maximum of 7 years away. During this time there will need to be a whole swathe of domestic legislation that will deal with, among other things, this. </p>

<p>So, right now Britons are still covered.</p>
