The right to be forgotten in data protection law: a search for the concept of protection

Article 17 of the final draft of the General Data Protection Regulation (GDPR) establishes the so-called 'right to be forgotten'. The provision reacts and relates to the decision by the European Court of Justice in the case of Google Spain v Mr. González on the 'right to be de-listed' from an internet search engine. The decision in this case, and the final draft of the GDPR, both raise fundamental questions regarding the concept of protection of the corresponding fundamental rights and how the GDPR should be interpreted pursuant to these rights. This paper proposes a method of interpreting fundamental rights by referring not only to ontological categories such as 'personal data' per se but also - more normatively - to their substantial guarantees. It is our belief that this approach helps to differentiate precisely between several fundamental rights that are applicable in the case, such as the right to privacy of Article 7 CFR and data protection under Article 8 CFR, and balance them against opposing fundamental rights.