of specific provisions, the consent given by children is regulated by common law or
general statutory rules on whether and to what extent minors may personally
exercise their rights and conclude contracts.
82
In this regard, it is important to highlight the fact that France is the only European
Union country included in the scope of this report which, previously to the GDPR,
had specific provisions on the protection of personal data of minors processed by
electronic means.
83 According to the French legal framework applicable before the
GDPR, minors had a specific right to obtain the erasure of personal data collected
online concerning him or her. This right, which may also be denominated as a right
to be forgotten, or a right to the erasure of personal data, according to the terminology of the GDPR, is now extended to all data subjects comprised in the scope of
application of the GDPR.
3.1.3 The Right to the Erasure of Personal Data Processed by Electronic
Means
This leads us to another relevant provision of the GDPR related to the protection of
personal data processed by electronic means: the “right to be forgotten”, enshrined in
the GDPR and recognized, long before it came into force, in the CJUE’s judgment
on the Costeja case.
84
Under the GDPR, the data subject, besides having the right to obtain the erasure
of its personal data directly by the data controller, whenever one of the grounds
provided for in article 17 applies, also has the right to have its personal data erased by
other entities which may have linked, copied or, in any other way, disseminated
those data, particularly when they were made public.
85 The said provision was
82 See, for instance, the Singaporean National Report, Sect. 3.3. Advisory guidelines from the
Singaporean administrative body also comprise guidelines on the treatment of minors, including
how consent to obtaining and using their data should be obtained. The South African National
Report, Sect. 4.1.3, refers to specific provisions for the protection of minors, included in a data
protection law. These provisions determine the conditions under which minors personal data may
be processed. Albeit relevant, these are general provisions, applicable to all types of personal data
processing related to minors, regardless of the means used. Therefore, these provisions aren’t
specific for the processing of personal data by electronic means.
83 See the French National Report, Sect. 2.
84 See the judgment of the CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and
Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González,
ECLI:EU:C:2014:317. In this case, the CJEU held that an electronic search engine operator is the
controller of the processing of personal data available on the websites, run by third parties, which
appear on its search results lists. Consequently, the respective data subject may approach that
operator directly in order to obtain the removal of a hyperlink to a certain website from the search
results list, as long as this website contains his or her personal data and even if this data is accurate
and doesn’t have to be removed from the website where it is made available. On this case, see de
Vasconcelos Casimiro (2014).
85 See the European Union Special Report, Sect. 2.3.
18
D. Moura Vicente and S. de Vasconcelos Casimiro
general statutory rules on whether and to what extent minors may personally
exercise their rights and conclude contracts.
82
In this regard, it is important to highlight the fact that France is the only European
Union country included in the scope of this report which, previously to the GDPR,
had specific provisions on the protection of personal data of minors processed by
electronic means.
83 According to the French legal framework applicable before the
GDPR, minors had a specific right to obtain the erasure of personal data collected
online concerning him or her. This right, which may also be denominated as a right
to be forgotten, or a right to the erasure of personal data, according to the terminology of the GDPR, is now extended to all data subjects comprised in the scope of
application of the GDPR.
3.1.3 The Right to the Erasure of Personal Data Processed by Electronic
Means
This leads us to another relevant provision of the GDPR related to the protection of
personal data processed by electronic means: the “right to be forgotten”, enshrined in
the GDPR and recognized, long before it came into force, in the CJUE’s judgment
on the Costeja case.
84
Under the GDPR, the data subject, besides having the right to obtain the erasure
of its personal data directly by the data controller, whenever one of the grounds
provided for in article 17 applies, also has the right to have its personal data erased by
other entities which may have linked, copied or, in any other way, disseminated
those data, particularly when they were made public.
85 The said provision was
82 See, for instance, the Singaporean National Report, Sect. 3.3. Advisory guidelines from the
Singaporean administrative body also comprise guidelines on the treatment of minors, including
how consent to obtaining and using their data should be obtained. The South African National
Report, Sect. 4.1.3, refers to specific provisions for the protection of minors, included in a data
protection law. These provisions determine the conditions under which minors personal data may
be processed. Albeit relevant, these are general provisions, applicable to all types of personal data
processing related to minors, regardless of the means used. Therefore, these provisions aren’t
specific for the processing of personal data by electronic means.
83 See the French National Report, Sect. 2.
84 See the judgment of the CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and
Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González,
ECLI:EU:C:2014:317. In this case, the CJEU held that an electronic search engine operator is the
controller of the processing of personal data available on the websites, run by third parties, which
appear on its search results lists. Consequently, the respective data subject may approach that
operator directly in order to obtain the removal of a hyperlink to a certain website from the search
results list, as long as this website contains his or her personal data and even if this data is accurate
and doesn’t have to be removed from the website where it is made available. On this case, see de
Vasconcelos Casimiro (2014).
85 See the European Union Special Report, Sect. 2.3.
18
D. Moura Vicente and S. de Vasconcelos Casimiro