Das ,Recht auf Vergessen« im Internet – eine Herausforderung für den demokratischen Rechtsstaat

ifice their personal data on Facebook, twitter etc. It becomes obvious that the freedom of expression as well as legitimate information needs collide with personal rights, especially with the right of informational self-determination. The question to be answered is: How can the conflict between these interests be resolved by means of data protection? The state must interfere to a certain extent. But how far? This is a crucial challenge for the democratic state. Recently, attempts have been made by the European Parliament to anchor a »right to be forgotten« in the new Data Protection Regulation. But this legislative project has failed due to several modification attempts. Nevertheless, the so called »right to be forgotten« is not entirely unknown to (German) law. This right has its constitutional foundations in the general right of personality which is enshrined in Article 1(1) and Article 2(1) of the German Basic law. Even the Federal Constitutional Court's jurisprudence has given hints that a »right to be forgotten« might exist as part of the general right of personality. On the European level, recently, the European Court of Justice has established some kind of a »right to be forgotten« by ruling in its »Google decision« that Google must amend results on request under certain circumstances. But so far, all existing regulatory models – especially the German Federal Data Protection Act (BDSG) – do not adequately respond to the challenges of the Internet age. It is therefore of primary importance that the existing protection concept for the general right of personality is readjusted. A new protection concept shall contain a graded protection that takes into account both legitimate information needs of the »Internet Agora« as well as the right of self-determination. In order to guarantee legitimate information interests of the public, the prevailing maxim has to be that the recording, processing, storage, communication and use of personal data are generally permitted. On a second level the state (legislator) has to determine when to comply with its normative »Responsibility to Protect« to guarantee the exercise of the right of self-determination. In order to do so, it is essential to develop substantive protection positions that outweigh legitimate information needs in a given case (e.g. private sphere and social sphere, of which the latter is less worthy of protection). Moreover, deregulation is necessary in order to establish an effective data protection. A general clause has to replace the complex conglomerate of norms in order to deal adequately with the rapidly changing technical conditions of the Internet.