NEWSLETTER-2017

319 PERSONAL DATA PROTECTION without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent and where there is no other legal ground for the processing; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation in EU or its Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services. The right to be forgotten was also accepted by the European Court of Justice (“ECJ”) before the entry into force of the GDPR. In its Google v. Spain ruling of May 13th, 2014, ECJ found that “ (…) even initially lawful processing of accurate data may, in the course of time, become incompatible with the Directive [95/46/EC] where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or exces- sive in relation to those purposes and in the light of the time that has elapsed. Therefore (…) the information and links concerned in the list of results must be erased. 5 ” • Right to Portability . Art. 18 of the GDPR introduces the right to portability, which is defined as the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit 5 Case C‑131/12, Google v. Spain, Judgment of the Grand Chamber, § 93-94.