The Right to Be Forgotten

INTRODUCTION

The rapid penetration of the internet into every aspect of our lives and the availability of all kinds of data to users within seconds have made it necessary to re-examine certain fundamental rights and freedoms. The boundaries of many rights, including privacy, the right to protect and develop one's physical and spiritual integrity, freedom of expression and communication, and freedom of the press, have been redrawn with the advent of the internet. In drawing these boundaries, the concept of personal data emerged, and issues such as the right to personal data protection and the right to be forgotten came to the fore. The right to be forgotten has been defined as the removal of content concerning a person from digital environments at that person's request; its scope has been examined by the Court of Justice of the European Union and regulated by the European Union General Data Protection Regulation (Avrupa Birliği Genel Veri Koruma Yönetmeliği).

I-. THE CONCEPT OF PERSONAL DATA

Information relating to an individual's personality arising from their existence, and information assigned to them or used by them to access various services as a consequence of their participation in modern society with the development of technology, are regarded as personal data. There is no agreed definition of the concept of personal data in our national law or in international law. In international law, Article 2 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Kişisel Nitelikteki Verilerin Otomatik İşleme Tabi Tutulması Karşısında Şahısların Korunmasına Dair Uluslararası Sözleşme), dated 28 January 1981 and numbered 108, defines it as follows: "Personal data means any information relating to an identified or identifiable natural person." Although the laws in force contain no direct definition of what is to be understood as personal data under Turkish law, the explanatory memorandum to Article 135 of the Turkish Criminal Code No. 5237 (Türk Ceza Kanunu, TCK) provides the following definition: "Any information relating to a natural person should be regarded as personal data. The definition of the offence in question makes no distinction between recording personal data on a computer and recording it on paper." Article 3 of the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu), enacted pursuant to paragraph 3 added to Article 20 of the Constitution (Anayasa, AY) by the 2010 constitutional amendment, characterises personal data, in a manner consistent with international instruments on this subject, as "any information relating to an identified or identifiable natural person." Although this definition resembles those in international legal instruments, the 2008 Draft Law on the Protection of Personal Data (Kişisel Verilerin Korunması Hakkındaki Kanun Tasarısı) contained a broader definition, drawing on the others: "All information relating to specified or identifiable natural and legal persons."

The concept of personal data has also been addressed in numerous judicial decisions in Turkish law. In a recent decision, the Criminal General Assembly of the Court of Cassation (CGK) sought to explain personal data through examples: "…a person's Republic of Türkiye identity number, first name, surname, date of birth, place of birth, place of civil registration (province, district, neighbourhood or village), mother's and father's names, marital status (married, single, divorced), civil register volume and family sequence number, blood group, marriage date, divorce date and court decision details, corrections to their first name and surname or other records, information on deprivation of citizenship, adoptive relationships, address, religion, schools completed (primary, secondary, higher education), illnesses, test results relating to those illnesses (DNA information), financial circumstances (wealth, remuneration received), moral inclinations, weaknesses, relationships with others, information in notebooks containing recollections, memories and diary entries, political views (parties voted for, associations of which they are members), habits, favourite books or newspapers, shopping preferences, tax number, email address and password, banking information, computer IP address, pension and institutional registration numbers, awards received, fingerprints, palm prints, letters, writings, books, telephone numbers, messages, physical identity (height, weight, disability status, skin colour, eye colour, hair colour and style, voice, general appearance, shoe and clothing size, and much more information may be regarded as personal data…" (CGK, 17 June 2014, Case No. 2012/12-1510, Decision No. 2014/331). Despite the numerous examples of personal data given in the decision, developments in information technology and technology generally make it impossible to limit personal data to those examples. Accordingly, it is not possible for the legislature to anticipate and exhaustively enumerate all data that may qualify as personal data. It may be said that this situation could produce certain adverse consequences, such as practices that violate the "principle of legality of offences and penalties" as a result of an excessively broad interpretation of the concept of personal data constituting the subject matter of the offence. A general definition of personal data will, by its nature, encompass certain characteristics. Accordingly, any information belonging to natural and/or legal persons that identifies or makes it possible to identify a person, distinguishes them from others in society, is not shared by them with unauthorised third parties, and may be accessed by third parties only with the data subject's consent may be regarded as personal data.

II.- THE RIGHT TO PERSONAL DATA PROTECTION

The right to personal data protection and the right to be forgotten are interconnected concepts. At the core of both rights lies the idea that individuals should live with dignity, freely develop their personality, freely exercise control over their personal data, and be protected against the use against them of personal data relating to the past whose resurfacing could cause distress. It is therefore not possible to explain the right to be forgotten independently of the right to personal data protection. The right to personal data protection is among the fundamental rights and freedoms and, as a particular form of protection of a person's dignity and personality and of the right to freely develop their personality, aims to protect individuals' rights and freedoms during the processing of personal data. The right to personal data protection, which has become increasingly important owing to technological developments, arises as a consequence of individuals' desire to control their own lives through their free will. The free development and protection of an individual's personality, the establishment of a social order composed of free individuals, and the provision of an autonomous sphere in which a person cannot be disturbed by the state or others are possible only through the individual's right to personal data protection.

The increase in national regulations on personal data protection has caused difficulties in data sharing and cross-border data transfers, particularly with countries lacking adequate regulation in this field. The problems arising from differences between national personal data protection rules have therefore made it necessary for countries to harmonise their data protection systems to ensure the functioning of the international system. At the international level, various international organisations, particularly the Council of Europe (CoE), the European Union (EU), the Organisation for Economic Co-operation and Development (OECD), and the United Nations (UN), have begun to develop binding regional and/or international conventions and similar instruments concerning personal data.

In Turkish law, the provisions on private life in Article 8 of the European Convention on Human Rights (Avrupa İnsan Hakları Sözleşmesi, ECHR) are reflected in Articles 20, 21 and 22 of the Constitution (Anayasa). Paragraph 3 of Article 20 of the Constitution (Anayasa) states: "Everyone has the right to request the protection of personal data concerning them. This right also includes being informed about personal data concerning oneself, accessing such data, requesting its rectification or erasure, and learning whether it is being used in accordance with its purposes. Personal data may be processed only in cases provided for by law or with the person's explicit consent. The principles and procedures concerning the protection of personal data shall be regulated by law." Personal data protection is thus guaranteed within the protection of privacy. One of the legal interests protected by the right to privacy is a person's interest in ensuring that any information concerning them is not disclosed or disseminated without their consent, is not accessible to others, and is not used contrary to their consent; in short, that such information remains confidential. It was therefore appropriate to address the right to personal data protection within the scope of this article. Nevertheless, it is also argued that attempts to protect personal data through the traditional approach to the right to privacy and the principles adopted in that field have proved insufficient in the face of technological developments, and that personal data protection should be treated as a separate field because of certain requirements specific to it.

III.- THE RIGHT TO BE FORGOTTEN

A.- The Concept and Emergence of the Right to Be Forgotten

In essence, the right to be forgotten is the right to request that content available on the internet not be listed by search engines. Although it emerged as an exceptional right to restrict access to certain personal data in all digital environments, particularly on the internet, it has developed over time towards becoming a general right. The "right to be forgotten" has been defined as the irreversible removal/erasure, at individuals' request, of all kinds of distressing personal content concerning them held in digital memory. The right to be forgotten may be described as a natural consequence of individuals' desire to freely shape their past and future and, consequently, to freely use or refuse the use of their personal data in the digital world. The first point that stands out in these definitions is that individuals may invoke the right to be forgotten as an extension of their right to control their personal data in the digital world; the other is that individuals may request the irreversible removal of personal data they find distressing so that it does not adversely affect their future. The right to be forgotten ensures the protection of all personal data concerning an individual within the framework established by national and international instruments. The dissemination of personal data without a person's consent directly affects all of that person's fundamental rights and freedoms. In today's technological environment, where all kinds of personal data are recorded without limit and are very difficult to remove once recorded because of rapid and extensive sharing, the right to have one's personal data erased is not always sufficient to enable one to live freely. The right to be forgotten therefore emerged to protect individuals' personal data in digital environments.

An examination of work on the right to be forgotten shows that the first legislative initiative on this subject was undertaken in France in 2010 with a view to establishing a right to be forgotten on the internet. The legislative proposal envisaged imposing an obligation on internet and telephone companies to completely destroy emails and telephone messages at the request of the person concerned or after a reasonable period. Discussion of the right to be forgotten appears to have intensified following the European Commission's proposal of 25 January 2012 to review the Data Protection Directive No. 95/46/EC (Kişisel Verilerin Korunması Direktifi) and replace it with rules directly applicable in the domestic legal systems of Member States. The proposed amendment focused on protecting individuals' privacy in relation to the use of personal data, in line with technological developments, to replace Directive 95/46/EC. This proposal (reform package) also included a proposal for a directive on data protection concerning personal data used for the prevention, detection, investigation and prosecution of criminal offences and related judicial activities.

At the initial stage of this work, the right to be forgotten appeared in the first draft prepared by the European Commission in 2012. Article 17 of that draft, entitled ‘The Right to Be Forgotten and to Erasure’, granted individuals the right to request the erasure of their personal data and to prevent its further dissemination where the data had not been used for its collection purposes for a very long time and the data subject did not consent to its retention. This article is important as the first provision to express the right to be forgotten clearly and explicitly. However, before the proposed amendment entered into force, a judgment of the Court of Justice of the European Union (CJEU) placed the right to be forgotten on a legal footing for the first time and established the first case law on the subject. Since the provisions mentioned were still at the proposal stage and there were no examples of their application, that judgment is of considerable importance in defining the boundaries of the right to be forgotten.

B.- The Court of Justice of the European Union's Judgment on the Right to Be Forgotten

The Court of Justice of the European Union (CJEU), the highest court within the European Union, is the judicial body with the final say on the application of EU law. Its principal purpose is to ensure that EU law is interpreted and applied uniformly throughout the European Union. The Court performs the functions of ensuring respect for the law in the interpretation and application of EU law, regulating relations between national legal systems and the EU legal order, conducting legal review and interpretation, resolving disputes, developing law and filling gaps in the law

The case underlying the CJEU's judgment on the right to be forgotten arose from the fact that, when an internet user entered the name of the lawyer "Mr Costeja González" into the Google search engine, links appeared to two pages of the daily newspaper "La Vanguardia", dated 19 January and 9 March 1998. Those linked pages expressly named Costeja Gonzalez and contained information concerning attachment proceedings against him for social security debts. Costeja Gonzalez first requested that La Vanguardia be required to remove those pages, amend them so that his personal data would no longer be visible, or use certain tools to protect his personal data by making use of the facilities recognised by search engines. Secondly, stating that the attachment proceedings against him had been resolved years earlier and that references to them were now entirely irrelevant, he lodged a complaint with the "Spanish Data Protection Agency" under Directive 95/46/EC, requesting that Google Spain and Google Inc. remove or conceal the personal data concerning him so that it would not appear in search engines or subsequently be displayed among links to La Vanguardia. By its decision of 30 July 2010, the Spanish Data Protection Agency rejected the complaint against La Vanguardia on the basis of Spanish law but upheld the complaint against Google Spain and Google Inc. The Agency stated that search engines were subject to data protection legislation because they engaged in data processing and processed personal data contained in the search results they listed. Accordingly, where individuals submitted requests, they were responsible for withdrawing data, prohibiting access to certain data and erasing personal data so that the data concerned would not become known to third parties. Google Spain and Google Inc. brought proceedings against that decision before the "Spanish National Court". The Spanish High National Court joined the proceedings and referred the case to the CJEU for its opinion. The CJEU based its judgment on the right to be forgotten on the relevant provisions of Directive 95/46/EC. Setting out the legal framework before examining the reference, the Court stated that the request concerned the interpretation of Article 8 of the Charter of Fundamental Rights of the European Union (Avrupa Birliği Temel Haklar Şartı; the Charter) and the relevant provisions of Directive 95/46/EC. In outlining the legal framework, the Court referred to recitals 2, 10, 18, 20 and 25 of Directive 95/46/EC, which aims to protect the fundamental rights and freedoms of natural persons, particularly the right to privacy, when personal data is processed, and to remove obstacles to the free movement of such data. It then explained the concepts of "personal data", "processing of personal data" and "controller" set out in Article 2 of the Directive. Referring to Article 6 of the Directive, entitled "Principles Relating to Data Quality", the Court noted that Member States were obliged to take measures to ensure that personal data was collected and processed, was not processed incompatibly with the purpose of collection, was accurate and, where necessary, kept up to date, and was not inaccurate or incomplete, having regard to the purposes of erasure or rectification. It also took into account Article 12(b) of the Directive, entitled ‘Right of Access’, which provides: "Member States shall guarantee every data subject the right to obtain from the controller, as appropriate, the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data." The Court indicated that requests concerning personal data under Articles 12(b) and 14(1)(a) of Directive 95/46/EC could be addressed directly by the data subject to the controller; the controller must duly examine the merits of those requests and, where appropriate, cease processing the data concerned. If the controller did not grant the request, the data subject could bring the matter before the supervisory authority or a judicial authority so that the necessary checks could be carried out and the controller could be required to take specific measures. The Court stated that, when assessing requests for removal from search engines, account must be taken not only of the search engine operator's economic interest but also of the legitimate interests of internet users who wished, or might wish in the future, to access the information whose removal was sought. The Court stated that, in the case at issue and in similar requests, a fair balance must be struck between the legitimate interests of other internet users and the data subject's rights under Articles 7 and 8 of the Charter. Given that the data subject's rights could override those of other internet users, the Court noted that striking this balance required an assessment in each individual case of the nature of the information in dispute, its significance for the data subject, and the interests of other internet users in accessing it. It noted that the data subject's role in society could increase the degree of other persons' interest in obtaining the information. The Court emphasised that, provided the processing of personal data met the conditions under Articles 12(b) and 14(1)(a) of the Directive, the search engine operator was obliged to remove the data concerned regardless of whether displaying that personal data in the search engine had a valid legal basis. The Court stated that a data subject's request could arise not only from inaccuracies in the data but also, in particular, from "the data being inadequate, irrelevant or excessive in relation to the purposes of processing, not being kept up to date, or being retained in the system for longer than necessary unless their retention is required for historical, statistical or scientific purposes". As a result of all these assessments, the Court held that individuals could, under the conditions listed above, request search engines to remove links containing their personal data from search results. Taking into account that the information at issue in Costeja Gonzalez's case concerned his private life and that the initial publication of the data had taken place in 1998, it concluded that he had a right to request the removal/erasure of the links concerned. The Court's judgment clearly shows that the right to be forgotten is not absolute and that matters such as the individual's right to personal data protection, the public's right to receive information, the individual's role in society, freedom of expression and the right to privacy must be assessed separately in each case. The Court also held, in light of Articles 12(b) and 14(1)(a) of the Directive and the fundamental rights under Articles 7 and 8 of the Charter, that where there were no particular reasons demonstrating an overriding public interest in accessing information containing an individual's personal data through its display in the search engine's list of results, the data subject could request that such a link not be provided or that the links be removed. The Court accordingly concluded that Costeja Gonzalez's request was well-founded and justified. Another important point is that the CJEU's judgment is binding not only on Google but on all companies providing search engine services, since the Court used the term "search engines" when referring to responsibility in the judgment.

C.- The Scope of the Right to Be Forgotten

Provided that Member States of the Union take appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use, the controller has a duty to "ensure that personal data is processed fairly and lawfully, collected for specified, explicit and legitimate purposes and not processed incompatibly with those purposes; that it is adequate, relevant and not excessive in relation to the purposes for which it is collected and/or processed; that it is accurate and, where necessary, kept up to date; and, finally, that data subjects are also allowed access to it for a period considered sufficient for the collection and processing of the data". Upon request, the controller must subject personal data that does not meet the conditions in this article to one of the measures of "blocking, erasure or rectification as appropriate" provided for in Article 12(b) of the Directive. Although the Directive contains no express reference to the right to be forgotten, the action to be taken by the controller upon request will produce results similar to those of that right. The CJEU also reached its conclusion on the basis of these provisions, using the concept of the "right to be forgotten" to correspond to the reference to erasure or blocking of data in Article 12(b) of the Directive.

Where any of the following circumstances arises in relation to an individual's personal data and the data subject does not consent to its retention, the individual has a legal interest in invoking the right to be forgotten:

• a) Although the personal data was shared on the basis of consent or out of necessity, it has not been processed lawfully and fairly;
• b) The personal data has not been collected for specified, explicit, proportionate and legitimate purposes;
• c) Although the personal data was collected for legitimate purposes, it has been processed and used in a manner incompatible with those purposes;
• d) The processing activity is not adequate, relevant and appropriate to its purpose;
• e) The personal data is not kept accurate and up to date;
• f) The period necessary for the purpose of collecting or processing the personal data has been exceeded.

These circumstances need not occur cumulatively; the occurrence of any one of them is sufficient.

IV- THE POSITION ON THE RIGHT TO BE FORGOTTEN IN TÜRKİYE

The Constitution of 1982 (1982 Anayasası) contains constitutional provisions that may be regarded as forming the basis of the right to be forgotten in Turkish law, such as "the principle of the rule of law (AY, Art. 2), the individual's right to freely develop their physical and spiritual integrity (AY, Art. 17), the right to privacy (AY, Art. 20), inviolability of the home (AY, Art. 21), confidentiality of communications (AY, Art. 22), freedom from being compelled to disclose religious beliefs and convictions (AY, Art. 24), and freedom from being compelled to disclose thoughts and opinions (AY, Art. 25)". However, quite apart from the absence of an express provision on the right to be forgotten, until recently we did not even have a separate law on the protection of personal data, which is regarded as the foundation of that right. Legal work on personal data protection in Türkiye is based on the Convention on the Protection of Personal Data (Kişisel Verilerin Korunması Sözleşmesi), dated 28 January 1981 and numbered 108.

Although there is no express provision on the right to be forgotten or any work in that direction, provisions have been included in laws such as the "Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications (İnternet Ortamında Yapılan Yayınların Düzenlenmesi ve Bu Yayınlar Yoluyla İşlenen Suçlarla Mücadele Edilmesi Hakkında Kanun)", the "Turkish Criminal Code No. 5237 (Türk Ceza Kanunu, TCK)", the "Turkish Commercial Code No. 6102 (Türk Ticaret Kanunu, TTK)", the "Law No. 5846 on Intellectual and Artistic Works (Fikir ve Sanat Eserleri Kanunu, FSEK)", the "Turkish Civil Code No. 4721 (Türk Medeni Kanunu, TMK)", and the "Turkish Code of Obligations No. 6098 (Türk Borçlar Kanunu, TBK)" to prevent attacks on individuals' private lives, freedom of communication and personality rights, and the unlawful recording and use of their personal data. In this respect, personal data available on the internet whose removal individuals request because they find it distressing can be protected through different provisions in our legislation. In private law, personality rights are protected on the basis of the provisions on the protection of personality in Articles 23–25 of the TMK and the provisions governing liability arising from torts in Article 49 et seq. of the TBK. Although the provisions of the TMK and the TBK offer individuals some protection of their personal data, it is very difficult for them to provide the desired protection directly and effectively because of the particular nature of the right to personal data protection.

The "Notice-and-Takedown System", which may be regarded as a manifestation of the right to be forgotten, first appeared in Turkish law in paragraph 3 of Additional Article 4 of FSEK No. 5846 and was subsequently regulated more broadly and expressly in Article 9 of Law No. 5651. Article 9 of Law No. 5651, under the heading "removal of content from publication and blocking of access", provides, under the "Notice-and-Takedown" system, that persons complaining about unlawful content should request its removal from the hosting and platform provider and, if the provider nevertheless fails to take the necessary measures, seek judicial remedies. The notice-and-takedown system creates an opportunity for dialogue between the person or organisation affected by the content and the service provider so that unlawful content on the internet may be brought into compliance with the law or removed. If the parties act in good faith, the problem can be resolved without being referred to other authorities.

V- THE JUDGMENT OF THE CIVIL GENERAL ASSEMBLY OF THE COURT OF CASSATION ON THE RIGHT TO BE FORGOTTEN

In the case reviewed by the Court of Cassation, the claimant had filed a complaint concerning a sexual assault of which they were the victim in 2006, and the judgment delivered by the trial court following the proceedings was upheld by the Court of Cassation in 2009. The claimant, as the victim, had clearly described how the sexual assault occurred both during the investigation and at trial, and those accounts were naturally incorporated into the text of the judgment. The judgment appeared in a book published in 2010 without the names of the victim and the accused being anonymised. Following the use of their name in full, without anonymisation, in a criminal law book, the claimant brought an action for damages, alleging that their personality rights had been violated and that they had consequently suffered non-pecuniary harm. The trial court partially granted the claim for non-pecuniary damages on the grounds that including a person's name in a book without anonymisation infringed their personality rights. On appeal, the 4th Civil Chamber of the Court of Cassation stated that the book in which the claimant's name was published without anonymisation was a scholarly work, that reproducing the publicly available Court of Cassation judgment as it stood in a scholarly book would not constitute an infringement of personality rights, and that the defendants therefore could not be held liable and the action should be dismissed; the ensuing emphasis that the trial court's judgment should also be accepted in respect of all kinds of personal data represents an important development for personal data protection and the right to be forgotten. As the claimant repeatedly stressed in the petitions submitted during the proceedings, they wished an adverse event from their past private life to remain unknown and to be erased from society's memory. In this context, despite four years having passed since the sexual assault, the person was victimised once again by having their name expressly included in the book; their right to be forgotten, right to personal data protection and right to privacy were violated. In the case before it, the Civil General Assembly (HGK) considered the use of personal data (the person's name) in a scholarly work without anonymisation inappropriate because there were no particular reasons, such as an important role played by the personal data in public life, intense public interest in the data concerned, or an overriding public interest, as also discussed in the CJEU's judgment on the right to be forgotten. The HGK therefore decided by a majority to grant the claim for non-pecuniary damages on the grounds that the event of 2006 had been included in the Court of Cassation judgment through the claimant's detailed account and that the inclusion of the claimant's name, which constituted personal data, in the 2010 book violated the right to be forgotten and the right to privacy. Through this judgment, the HGK established a precedent capable of forming the basis for subsequent disputes concerning the right to be forgotten and privacy. In addition to giving the right to be forgotten a new dimension, the HGK's judgment is important because it is the first text to place that right expressly on a legal footing in Turkish law. Its extensive explanations of the right to be forgotten may provide guidance for future legislative provisions on that right and for resolving practical problems that may arise in this field.

CONCLUSION

The right to privacy is a fundamental right protected in both national and international law. It is guaranteed in the European Convention on Human Rights (Avrupa İnsan Hakları Sözleşmesi) (Art. 8), the United Nations International Covenant on Civil and Political Rights (Birleşmiş Milletler Medeni ve Siyasi Haklar Sözleşmesi) (Art. 17), the Universal Declaration of Human Rights (İnsan Hakları Evrensel Beyannamesi) (Art. 12), and Article 20 of the Constitution of 1982 (1982 Anayasası). Just as these instruments contain no definitive definition of private life, judicial decisions have not established a fixed definition or set of boundaries applicable to every case; rather, different judgments have sought to identify what falls within private life. In many judgments, the European Court of Human Rights has emphasised that the storage of personal information is highly significant for the right to respect for private and family life under Article 8 of the ECHR, and that respect for its confidentiality is a fundamental principle of the legal systems of all Contracting States to the ECHR.

Looking at the position in Turkish law regarding the right to be forgotten, although it is possible to achieve outcomes similar to those of that right by relying on the provisions of the TCK, TTK, TMK, TBK, FSEK and Law No. 5651, it is clear that the protection afforded by these laws will not be as adequate as that afforded by the right to be forgotten. The Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu) contains no express provision on the right to be forgotten, but requests made under Article 7, concerning the erasure, destruction or anonymisation of personal data, may produce outcomes similar to those of that right. Furthermore, since the final paragraph of Article 7 states that matters concerning the erasure, destruction or anonymisation of personal data will be regulated by a regulation, there is a legitimate expectation that the regulation will include a provision on the right to be forgotten. In view of advances in information technology and the global dimension of this field, the fact that the position under Turkish law remains uncertain, despite the European Union having included an express provision on the right to be forgotten in the regulation adopted to replace Directive 95/46/EC, is a significant shortcoming in our law. Despite the absence of a provision on the right to be forgotten, the HGK's judgment is highly important as the first text in which that right found expression in our country's law. Unlike its use in the EU, the HGK's recognition of the right to be forgotten in its judgment not only for personal data on digital platforms but also for personal data in physical media accessible to the public considerably expanded the scope of the right compared with earlier legal texts. There have been substantial developments concerning the right to be forgotten from its initial emergence to the present, including the matters discussed in relation to the HGK judgment.