If we were to ask people from our generation if they own a smartphone, use the internet on a daily basis or have social media accounts, their answer would be yes without any hesitation. But what they and I haven't realised when using those technologies, is that we share our personal information either intentionally or unintentionally with private or public entities worldwide, that tend to violate our right to privacy by selling information without our consent to companies we haven't even heard about.

Any information related to us, in our private or professional life, that we share online, constitutes our personal data. Those data are precious for companies because they reveal our preferences, our likes that can be sold to other companies to increase their sell. Following this discovery, we can feel frustrated because it is something we were unaware of when we started using the internet or social media since no one explained it or talked to us about it.

One could argue it is easy to blame those companies and that it is our responsibility as individuals to react and do something. But by the time we heard about it, it was too late. We were already connected and dependent on social media, the internet. Our personal data were already used and sold everywhere in the world. Our discouragement gets bigger when we think about what to do to correct that, to make things change. One idea that emerged was to make the personal information that was gathered unlawfully disappear, be erased. One way to answer that problem was that states had to step in and protect our data.

The right to be forgotten entered the European Union privacy sphere with the 2014 judgement of the ECJ involving Google. It enabled people to demand the removal of links to information that are inaccurate, inadequate, irrelevant or excessive. This is called right to be forgotten. Then, it was implemented under article 17 of the General Data Protection Regulation (GDPR). The right to erasure grants data subjects a possibility to have their personal data deleted if they don't want them used anymore and when there is no legitimate reason for a data controller to keep it. It seemed a good way to act posteriorly and find a way to correct our past mistakes. But can we really rely on it? It did not take long before we could see the limit of this regulation.

As said before, one good aspect of GDPR is that it creates a fast process to erase the data that Internet companies collect and store for use in profiling and targeted advertising. But on other side it can be used to erase online content, whether or not that content actually violates anyone else's rights. Such a use could constitute a violation of freedom of information with is part of the fundamental right of freedom of expression. Those rights are recognised in international law, as in the article 19 of the Universal Declaration of Human rights. It is true that there are some very important concerns about data protection and privacy in face of mass collection of our data by companies, but the way "right to be forgotten" is built is not appropriate.