Balancing between Right to Be Forgotten and Right to Freedom of Expression in Spent Criminal Convictions

Being two distinct fundamental rights, the coexisting state of the right to be forgotten and freedom of expression has already been confirmed by the competent authorities through balancing in situations when they collide. The paper focuses the balancing apprehensions concerning spent criminal conviction data while considering Google Spain ruling and the General Data Protection Regulation (GDPR) primarily for analysis. From the Google Spain ruling till the development of the GDPR, the balancing apprehension has already seen another generation resolving conflicting issues derived both from statutes and case laws. Though lawful authorities stepped into easing the tension between different elements of the two rights, it has been seen that the outcome of balancing intellection depends on the application of diverse norms and principles. The contemporary principles in balancing the rights of spent criminal conviction datum have been identified in this paper which needs to be enhanced carefully in the future towards a more privacy‐friendly atmosphere to envisage the need of data‐driven Europe and to upheld the right to be forgotten of spent criminal convicts.


INTRODUCTION
The English philosopher John Locke considered "trust" and "prestige" as the two elements that humans consider the most based on which humans instinctually manage themselves to lead the emersion of the self-concept. 1 Because of the Internet, the information is so willingly obtainable which remains online permanently, facilitates a permanent slandering on someone's reputation 2 which makes hiding from the past mistakes an implausible event since an indefinite amount of data can be achieved by inputting the data subject's name in a search engine, 2 (p. 352). The phenomenon of forgetting is an anomaly nowadays 3,4 since personal data is just one click away in Google search. The problem occurs when a particular information brings an adverse impact on someone's life by bringing facts to light. Facts might be parts of social media, news, archive, or any other website directed through hyperlinks. The conflict of interest happens when someone is accessing, receiving or disseminating those facts while exercising his or her legal right to freedom of expression and other their sentences through reaching the set period and the data has been erased following the lawful procedure, viz, under the English Rehabilitation of Offender's Act 1974, or non-habitual trivial offense records, or any offense which happened in a moment of madness' that does not belong to the character of the offender which happened once and a long time ago. Thus, the debts are paid to society for their faux pas. Furthermore, the balancing task is carried out primarily based on the Google Spain ruling and different provisions of the GDPR. Last but not the least, the reader is expected to possess the minimum knowledge necessary to build the basic concepts of the right to freedom of expression and the right to be forgotten.

BALANCING ISSUES DERIVED FROM GOOGLE SPAIN RULING
The Google Spain case possesses an overwhelming position in the right to be forgotten history since the judgment strengthened the position of the right to be forgotten in the way of delisting in 2014, just 2 years before GDPR has been adopted in 2016. Pre Google Spain initiatives proved that the right did not emerge out of anywhere, rather it was a polished version of almost four decades existing in the European region. In 1973, a recommendation on halting unbridled hoarding of data was found in paragraph (para.) 21 of the Council of Europe (CoE) resolution titled "Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private Sector". 16,17 Then right to erasure (RtE) provisions were found in German and French data protection enactments in 1977 and 1978 respectively. 18 It is to be noted that German law BDSG not only defined a RtE but also categorized criminal offense data along with other types of data as "sensitive data". 18 On the other side, French law provided a compilation of data protection rights altogether under Art. 26 of Loi Informatique et Liberté. After that RtE was found in a paragraph in OECD guidelines of 1980 19 which reflected a year later in Art. 8 of Convention 108. 20 With the adoption of the data protection Directive (DPD) in 1995, RtE eventually was reaffirmed based on which the CJEU ruled the Google Spain case. 21 The CJEU in this case elaborated the right as an outright propagation of the fundamental right of data protection under the Charter. 21 This event assisted RTBF in attaining a distinctive position apart from the right to access as the former right was always deemed as a subordinate version of the latter since its inception in the Union territory 22 which is evident in the repealed Art. 12 of the Directive. 23 However, many still believe that it is still a subset of the right to access. The court embarked to do so by relying upon certain Articles of the DPD 23 and adhered to certain balancing initiatives between the right to free expression and data protection rights under Art. 12(b) of the DPD with special reference to right to erasure (RtE).

Tension in balancing between public access to information and privacy rights
While ruling the RtE (often referred to as a right to delist [RtD]) case, the honorable court used such languages which is responsible to incite the controversy between penetrating information and the right to protect private data. 21 The CJEU exactly meant that since a right to erasure is not an exclusive right, it will cease to subsist unless it has been balanced with other similar dominions such as the right to free expression or other publication rights. 21 To put it differently, the precedence of right depends on each context. In many cases, the CJEU considered it to be justified to allow access at will to information, 21 especially true under Art. 9 of the Directive 95/46 when the data is not used unlawfully and under journalistic, artistic, or literary purposes exemption. 21 The "personal data" 13 remains on the web and who is to determine whether the data subject has the right to delist or not. Because while assessing "public interest" as one of the overriding justifications of RtE, the honorable court held that in cases where a "legitimate right to removal" 13 is found, that right overrides the public's interest in finding that particular information on the basis of that person's name. 21 It further said in para. 81 that acceptance of an individual's interest in removing personal data under Art. 7 and 8 outweighs the public's interest in accessing his or her information under Article 11 of the Charter, 21 provides an individual with a prevailing right of removal. 13 But the court did not mention any tangible element to prioritize between "public interest" and "right to removal" when both public and private interests are competing, rather mentioned public figure principle under which applicant's social position or applicant's public activities can generate public interest which can outweigh a right to be forgotten so easily. So, what remains unanswered is whether any information is directed to qualify RTBF claim now, and some other subsequent information is generated about that including all the material facts happened again will be considered as lawful or unlawful.
To add to the crisis, after GDPR came into force, another aspect pushes the controversy to another level which might occur through data controllers like Google's responsibility to inform the third party (who hosts the data) under Art. 17 (2) of the GDPR, of any possible erasure, that the data subject apprehended and the subsequent effects caused by it. 24 The effects are essentially related to subsequent processing of the same data sought for removal. A case can be illustrated in this regard which occurred in the United Kingdom, in which Google already delinked his previous outdated conviction data from its database, 25 and informed the host of the content where the article was published. 25 Subsequently, the owner of the webpage produced another article with the notification of Google's removal from its search results along with the original story from the beginning about the applicant's conviction which drew the attention of other media websites too and ended up producing more articles. 25 However, the applicant further requested Google to delink all the article links again but this time Google denied to do so on the ground of the news articles were new and of public interest. 25 Consequently, the applicant moved to the UK's data protection officer (DPO) which is ICO with a data removal request. The ICO took into consideration certain principles such as whether a public figure, nature of data, time-lapse, the detriment of the data subject's reputation, graveness of offense, and the involvement of journalistic material. While partially agreeing with Google, the ICO found that the news articles as newsworthy and of public interest, the ICO further stated that the public interest can also be mitigated without the name of the applicant which exposes him to his long spent criminal history. 25 The ICO found the articles to be excessive with the purposes, pose a disproportionately detrimental effect on privacy rights and cause the data subject anguish and ordered Google to delink the applicant's identity from the news articles. 25 So, though there is a tension between the public's right to access information and an individual's privacy rights, there are also certain principles applied by different authorities that might be helpful to get a direction of balancing norms.

Tension in balancing between public right to access to archived information and right to be forgotten
This second point of tension is derived from another lawful data processing exception which is data collection for scientific, historical research, or public research purposes, and an individual's right to delink that information. In Google Spain, the CJEU, while supporting to determine on a case to case basis, ruled that the search engine data controllers can be obliged to wipe the links which lead anyone searching for information against a name to the site the data is hosted, under the DPD. 25 Again, it did not outline exact elements when a request of removal of these unwanted links shall be respected because the public's right to access was already well established through laws and case laws but a right to removal was not. Thus, it left tension between specific law and unspecific ruling though the processing of data for archiving purposes in public interest, statistical, scientific or historical research purposes is allowed under Art. 6 (1)(b) of the Directive. 23 While determining RtE, the CJEU delimited the right within search only which is performed through the search engines, not broader which means that the delinking was only effected against search engine lists while the information remained in other places online. Indeed, the information can be retrieved by going to the direct website or even by searching any other thing except the distinct name or any other identifying element of the data subject, for example, by home or official address of the convict or other data subject's name who did not apply for a RtE. Consequently, the RtE had not been defined as total erasure of data, rather, mere restriction in finding the data. That is coherent to earlier critics such as Markou's argument who argued that forgotten does not mean a total erasure of the data. 26 According to a distinguished Internet scholar John Roberts, compared the scenario metaphorically by saying that it can be compared to making the catalog of a library disappear, while the book is unharmed, stays in the same place in the collection. 27 However, the analogy might seem to be not entirely right according to the findings of Google Spain since it more or less appearing that the books stay, so as the catalog, just an entry from the catalog is omitted, not the entire catalog. For better fathom, even the book remains in the exact place to say that if anyone knows the name of the author or category of the book, he or she can find it by going to the exact place. That is why Jimmy Wales opposed in page 27 of Google Advisory Council Report 2015 which stated that the exposer's actions "are being suppressed" and said that the report represents an exaggerated effect of RtE, 28 which is not true, in particular, not consistent with the actual effects of RtE. However, other commentators are also available who supported the Advisory Council Report to an extent by saying that there should not be any distinction between data available in different sources such as files, archives such as newspaper, or government records which can be found through search engine searches. 28 In my opinion, data hosting and processing exponentially matters, and it matters heavily since the government is not a private organization or institution that is driven by profitability, unlike any other private institutions for whom making a profit is a legitimate interest in their business. That is why the CJEU became so serious while nullifying the economic interest of the search engine operator Google in paragraph 81, 21 stressed on considering the nature of the personal data, in particular, considering the payoff of those data in data subject's private life in and balance with the public's interest in accessing the information. 21 Of course, the data subject's having a public role needs to be taken into account. 21 This is in pessimism to the scholars like Mayer-Schönberger 29 and Bernal 30 who wanted to see a pure deletion or erasure through a successful exercise. However, since the data is usually still available, any party with legitimate interest for example, if any bank is considering to provide a loan and wishes to look into a bankruptcy history, then it can perform a search by putting the loan applicant's formal name or anything else though it is not guaranteed that it will be able to find something even if, there is any data. To accommodate relevant legitimate interests, specific provisions in multiple domestic data protection acts have been made to empower the relevant stakeholders to keep the balance which will be adhered to later on. For now, the distinction in this case from the above case is in the former situation, the search example is general, but in the latter case, a purposive search is performed. So, the ultimate balance is that total erasure was and never supported by the Google Spain judgment, and so the history, or the data is intact online. Besides, whether the data subject's activities involve any public interest or not will be taken into account. According to Bernal, the judgment failed to reach the milestone which many privacy advocates asserted to cross. 30

Tension in balancing between different provisions of the Charter
According to Drummond, the CJEU prioritized the RTBF in the Google Spain case, while outlaying free expression rights which also have a similar status in CFR, and both are considered as fundamental principles after Lisbon Treaty came into force. 31 The meaning of the sentence is clear and true to be interpreted but to some extent. Such a statement would need to be clarified since it completely overlooks the principle of balancing under Union law. However, CFR protects the free expression right quite vastly, in particular, it does not directly allow free expression to be hindered by an RTBF. 31 But a limit on free expression based on an RTBF can easily be accommodated through interpretation within the limitation sub Article of Art. 11. But the real controversial point is that though individual data protection right is also ensured in CFR, it does not entail any other ground other than consent-based processing and any other lawful way in Art. 8, 9 for example, under any of the grounds mentioned in Art. 6 (1) of the GDPR, the latest procedural dictation. Analogically, it does not purport to prioritize one right over the other, at least does not authorize to limit freedom of expression on the ground of exercising RTBF. 9 It will not be excess to tell that the statute manifests equality over both the rights. To put it differently, every provision in the Charter has its exclusive goal, for example, being a primary and substantive piece of legislation, the Charter aims to provide control over personal data in its Art. 8 while the GDPR tends to supplement the secondary and procedural part of it. 22 But in Google Spain case, it recognized the right in concern (RTBF) in the form of delinking to personal data over right to freedom of expression in the form of restricting right to access information. Consequently, it remained unclear whether data protection right is prioritized over publication right such as free expression under the CFR when the same practice is applied to a specific situation, viz, data erasure requests on behalf of the spent convicts.
Though it is true that one right cannot exist without the other, now, Article 10 of GDPR provides special protection on data related to criminal convictions and offenses.

Post GDPR tension in balancing between GDPR and CJEU practice on privacy rights
Right to be forgotten codified by the GDPR which can be considered as the second generation of this right as well as the second generation of balancing regime.
Article 10 of GDPR mandates the processing of personal data with criminal offense record upon authorization of Union or Member State law only. Recital 19 of GDPR reaffirms the protection against the processing of data regarding criminal convictions under specific Union legal Act though this enactment does not deal with this issue in particular. Furthermore, while outlining the derogations relating to the "archiving purposes in the public interest, scientific or historical research or statistical purposes," GDPR emphasizes data minimization because of rights and freedoms of the data subject. 13 It is to be mentioned that data minimization has been mentioned or already has the status of a monumental principle in the data processing area (Art. 5). 9 To serve this purpose, pseudonymizing is mentioned as a tool so that the data subject becomes unidentified. But in reality, maintaining consistency with Art. 10, the CJEU as an EU institution authorizes processing through its communication by publishing its rulings in form of a press release and allowing third party processing for journalistic and public interest purposes which leaves room for tension in complying with the GDPR concerning privacy rights.
Also, while applying the concept of personal data to be removed for the right to be forgotten application, the CJEU limited the definition in Google Spain ruling to the name of the data subject. But in GDPR, under Art. 4 (1), the notion of "any information relating … " broadened the scope of defining personal data in a way which undoubtedly went beyond the notion of the name only, but to include anything possible to indicate the data subject such as a residential or official address, any specific health condition, location data, online credentials identification or any other unique identifier. This raised concerns of the historians, researchers, statisticians, and other relevant stakeholders of legitimate data user groups.

FOOTSTEPS OF DIFFERENT AUTHORITIES IN UNFASTENING THE TENSION AND THEIR SOLICITATION
This portion tends to analyze balancing approaches made by different sectors of competent stakeholders. In this section, based on core role players such as the Court of Justice of the European Union(CJEU), European Court of Human Rights (ECtHR), Scholarly and GDPR approaches are analyzed to identify the loopholes while discussing the approaches with two real-life and two fictitious cases.
Easing tension or balancing the conflicting interests mentioned in the previous section can better be understood with real-life scenarios of the victims who already spent their convictions or in a similar sense. In one prominent case, one claimant GC requested a link to be delinked from the Internet in which she is represented satirically with the city mayor to whom she served as a cabinet head to show the existence of an intimate relationship between them so that in the long run, she can derive political benefits. 32 The montage of the photo in question came into light when GC was running a provincial election in which she was a candidate but ceased performing in the previous job. In the second case, ED, the claimant, requested for delinking two articles disclosing his criminal history of sentencing 7 years imprisonment and additional 10 years of judicial overseeing for committing a sexual offense against 15 years old children. 32 Also, there are some fictitious cases which are collected from different sources, mostly based on the UK such as the guest speeches of ICO's Data Protection Conference 33 and Unlock, an NGO that collects evidence of people who have applied for their "search results" to be removed by Google and others but failed. 34 First case is about Sonia (anonymized) who was convicted of Arson, spent her conviction, and was doing a job at a good pace. Her previous husband decides to destroy her after divorce and for that he prints off the newspaper article found in Google about her convictions and threatens to post everywhere. 34 Second case is about Natasha (anonymized), a school teacher convicted for 4 years of fraud in duty. Now after spending her conviction, she is again working with a school but at entry-level. The employer informed her about few chances of progressing due to the possibility of backlash from the concerned parents of the school children. All these happen because her conviction article is visible online. 35 Now, based on the balancing approaches derived from the CJEU and ECtHR rulings, scholarly thoughts, and the law, the following section will try to answer a logical issue in general. The issue is that whether the scope of Google Spain ruling demands all links connecting to the personal data to be obliterated.

Implication of CJEU and ECtHR approaches in balancing privacy rights and freedom of expression
Easing the tension between publication right in the particular right to freedom of expression and individual data protection right in particular right to be forgotten proved to be difficult as both have to accommodate each other and coexist. The CJEU approach in easing the tension is worth mentioning in this context because the honorable court tended to balance them in analogous dominations. Using the same mechanism might serve as derogatory grounds from freedom of expression for privacy rights or the right to be forgotten.
In Bodil Lindqvist, 36 the CJEU stated that gauge of weighing between those contradictory rights race against each other within the ambit of the contemporary data protection enactment. 36 Specifically, the contemporary data protection law defined the scope of lawful and unlawful processing intending to prevent illegitimate processing from happening or continuing under the native legal intellection. 36 The GDPR also empowered and encouraged the domestic data protection enactments through Art. 2, 23, and 85. Art. 2 described that the Regulation extends to every automatic processing wholly or partly, and other processing as well which involve filing system while Art. 23 empowers the Member States to formulate laws to restrict the data controllers or processors conditionally from exercising data protection rights within their jurisdiction when the condition respects the essence of fundamental rights and freedoms which indicate balancing because the restriction is essentially associated with the values of a democratic society. Last but not the least, Art. 85 marks the needs of reconciling freedom of expression and information while vesting the responsibility in the alignment of the Member States to align it between Art. 11 and Art. 8 of the Charter including processing carried out for journalistic, academic, artistic, or literary expression purposes and their derogations. To make it clearer, the effective balancing mechanism has been outsourced in the hands of the national legislators. Again, while delegating powers, the GDPR recognized the wide variety of national divergence evolved from the DPD 37 and thus, prevented the CJEU from providing abundant primary interpretations at the EU level. 38 Consequently, a remarkable number of European nations have already enacted data protection laws at the local level to maneuver the rules and procedures of balancing apprehensions. For instance, the Federal Data Protection Act 39 of Germany is worth mentioning since the territory was one of the predecessors of RtE. Sections 27 and 28 of the Act allow the processing of special categories of personal data (section (sec) 48) for scientific, historical research, historical and archival purposes while facilitating particular safeguards such as anonymization, authoritative custody, or severance from mainstream processing mechanism (sec. 50). Again, section 35 interestingly provides a RtE by adding to the RTBF derogatory grounds within Art. 17 (3) of the GDPR. It enumerates that in the event of nonautomated data erasure is impossible or if the mode of data storage and data subject's interests in erasure lead towards a minimum impairment, the data subject is barred from claiming a RtE conditioning that the data has not been processed unlawfully, or negatively affect the legitimate interests or the retention period has expired. In addition, to illustrate Finnish Data Protection Act, 40 it has an exclusive provision based on Art. 10 of the Regulation, in sec. 7 which particularly deals with issues relating to the processing of personal data relating to criminal convictions and offenses which only permits processing for legal claim related issues while allowing processing only under official and competent capacity and within a secured manner of processing (sec. 6). 40 Again, it is all about providing tools of balancing.
So, certain native legal intellections along with Art. 17 (3) of the Regulation with having the reflection of Art. 9 of the DPD include derogatory grounds that leave rooms for the Union Members to allow processing under any of those particular principles. The purpose of providing the exceptions in the name of derogations is clearly stated in the DPD which is to ensure the coexistence of both the rights through weighing each other in a particular situation. 23 It needs to be kept in mind that the mechanism of ensuring coexistence completely differ now and before when the DPD was operative. That is why in the Bodil Lindqvist case, the CJEU instructed the Member States to make sure the enforcement of the weighing mechanisms through the exercise of their freedom of approach manifested in the contemporary law. 36 It further added to show persistency while weighing since the domestic courts were expected to balance the competing rights by relying on the primary principles set by the Union legal order. 36 In addition to that the CJEU stressed in paragraph 81 to envisage different interests in motion by considering the particular information's impact on personal life while balancing between privacy interest such as RtD and publicity interests such as monetary gains of the search engine, the data subject's having any public role or practicing freedom of expression. 21 In another case before the ECtHR, the honorable court found the necessity of unifying the approaches so that a better harmonization can be achieved through providing guidelines for weighing competing interests. 41 The judgment vigorously made it clear that none of the competing interests, in particular, individual privacy right and public freedom of expression are exclusive, therefore, both of them can be restricted if appropriate reasons are found reconciled within the law, serve the purpose of providing rights and last but not the least is consistent with the democratic merits of a particular legal system or the society. 41 Being a privacy right, this logic can be applied to the right to be forgotten. Turning to the abovementioned case of GC and ED, the CJEU interpreted publication or further processing of data and right to freedom of expression must exclude the processing of sensitive or special category of information unless otherwise is expressed in the law. It is to be noted that Article 9 of the GDPR defines special categories of data that are affiliated with expressing "racial or ethnic origin, political opinions … " 32 In the case of GC, the article was associated with her political belief and orientation. Besides, the alleged relationship was not proven which makes it an inaccurate data subject to exercise right to object under Art. 21 of the GDPR which interfered with her privacy rights unlawfully. However, she was a public figure at the time of performing in the city council, even at the time of the judgment she was a figure whose activities were related to the public. To put it differently, the common people had the interest to know about her since she was running the provincial election. But the fact needs to be brought up that, not only the accuracy of the information is questioned, but also the information was brought to light in a crucial moment when she was running her campaign. Journalism is clearly in bad faith and to harm her public face which was not brought any time before. Furthermore, she has not connected with her previous profession anymore.
In that situation, her privacy right should be respected in the event only the information about personal relationships is nothing but false.
Turning the situation in the case of ED who was convicted for sexually abusing children under 15 years of age. Article 10 of the GDPR forbids the processing of criminal data without the control of the official authority. Even it says that any maintenance of criminal history database has to be under official authority. Though the law seems to be attracting a deletion of ED's conviction data, other factors compete to detract it. For example, the nature of the offense is gruesome. It might become relevant to the public as long his activities include the common public in general which will necessarily attract both journalism and public interest. For example, if at any time he starts performing duties with institutions that offer its activities to the children, then the common people having services from that institution have a legitimate interest in the former criminal activities associated with children and thus, the adverse impact to his personal life caused by the availability of his data in question loses traction to grip. Undoubtedly, it can be well beyond his right to privacy and data protection.
Now considering the presumptive case of Sonia, availability of her conviction story for arson presumably does not fulfill any journalistic, artistic, or literary purpose anymore since the journalism purpose has been achieved already and so unavailability after a certain time would not frustrate any of the purposes anymore. Besides, if she does not play any public role, or takes part in any public activity then, her data attracts to be removed online to make her life easier by not providing a weapon of malicious defamation by her ex-husband. On the contrary, the news about the school teacher Natasha might be very crucial for journalistic and public interest purposes as she committed the crime in a position of trust and while involved in taking care of children who belonged to common people. So, Google Spain might not attract the situation as the public has a legitimate interest to know everything related to their children now and in the future since her conviction was against society especially when she was vested with official duty.
The balancing methods employed by the CJEU provide some guidance on the qualification of public interest but lack clear direction for the Member States since guidance does not cover all contemporary challenges raised after GDPR came in force. Rather it encouraged Members to strike a balance at some point against privacy interests which was against EU law harmonization.

Implications of scholarly opinions on balancing the rights at issue
First of all, scholars are divided in describing the reach of RTBF. Some believe that the CJEU failed to ever establish the comprehension of GDPR, while others believe that it is the inception of the modern era of privacy rights. 42 Opinions of the scholars and advocates can be considered a great source for looking into the balancing approaches. Niilo Jääskinen, the advocate general thinks that since the right to free expression attracts elemental safeguard within the Union legal system, 43 safeguards must be taken from putting the primary responsibility of shifting the balancing approaches to the data controllers such as the Internet search engines 43 or other data controllers, in particular, in cases of erasing a data or deciding right to be forgotten cases, though responsibilities have been vested upon the controllers under Art. 17 (2) of the GDPR. He again tended to reaffirm the strong respect of freedom of expression in the EU while his concern about delivering discretion to search engine companies to decide whether data subjects will be allowed to have their right to be forgotten or not. In a nutshell, the Advocate General is particularly concerned about the greater power vested on the data controllers to take initiatives in balancing complex competing rights since great power demands greater responsibilities and the data controllers can err in disposing of their responsibilities for so many logical reasons, for example, trying to avoid detrimental legal consequences anyway, exploiting more for their legitimate profit interests and some others. Besides, Advocate General Szpunar opined in his opinion on case C-136/ 17 that the settled case laws of the ECtHR think that the ability of the Internet in terms of providing data storage and communication is outstanding which essentially provides enhanced access to the public to news and other information and thus, simplifying the publication of all types of information in general. 44,45 He further added that the ECtHR ruling not only applies to the data retained through the Internet but also to the ways and means through which it is communicated or sent or received. 46 However, while analyzing his opinion, he stressed the fact that the journalism factor used by the journalists and the listing priorities performed by the search engines are completely different.
Again, while noting about balancing between public and private rights, Lindsay stated that it is possible under the GDPR to show and interpret that the privacy interest of the individuals can poise the opposite interest of the common people. 47 The GDPR, the reformed version of the DPD, limits a right to be forgotten when limitations are plausible for "journalistic, artistic, or literary expression, for protecting the public interest in public health, or for historical, statistical, or scientific research purposes". 13 While perceiving disclosure of personal information as governmental and nongovernmental, Jacobs and Larrauri stated that the European countries foster the protection of one's privacy through protecting honor and dignity from both types of disclosure. 48 They added that the disclosure of particular information may lead to the violation of privacy rights irrespective of the information's being true or spurious since the EU legal system never focused on a piece of information's being right or wrong, rather, in the event of communication turns detrimental for others' image, the focus is drawn on if the processor of the data or the correspondent has a right to reveal the information or not. 48 Turning into both real-life and fictitious cases, the majority of scholars indicate that GC, ED, Sonia, and Natasha all can either qualify or disqualify a claim of right to be forgotten depending on so many factors. The most commonly overlapping opinion is that right to access information merits particular protection in the EU. On the contrary, historians such as Antoon De Baets opined that the scope of derogation from the right to be forgotten should expand to all forms of expression. However, in my opinion, the latter opinion suggests no existence of the right to be forgotten and against coexist principle which is contradictory and obsolete with the Union legal system.

(Dis)Harmonization through GDPR in pre-established rule of allowing the Member States to strike a balance
The 1995 Directive along with CJEU's empowerment provided the Union Member States with the freedom to choose appropriate approach according to their every domestic adherence to ensure the balancing between the rights in the event of there is a lack of synchronous guidance under the law, caused disharmonization in the EU law. According to the highest court, Art. 13 of the Directive made the Member States free to formulate their legislative acts to indicate the limitation of people's right to information. 49 Besides, the CJEU stressed State involvement in performing the balancing tests. Bodil Lindqvist and Satakunnan Markkinapörssi have been discussed already above in this context. The CJEU confirmed in Bodil Lindqvist that the functionality of balancing between concerning fundamental rights are executed from the domestic enactments of each Member State which is responsible for redacting the Directive. 36 This is however confirmed again in another case in which the CJEU provided broad discretion to the Union Members to take into account their culture and tradition for construing the rules and procedures in balancing rights. 48 Now, with the enforcement of GDPR, harmonization is achieved through the direct effect of this law. Consequently, it is assumed the frustration of disharmonizing derived from the Directive and established by the CJEU waved remarkably.
Hence, one of the greatest obstacles is that only one right has been recognized as one of the overriding justifications over the right to be forgotten that is right to freedom of expression and information. 47 As RTBF has already been recognized by the CJEU and is one of the privacy rights, the balancing mechanisms between privacy rights and freedom of expression can be a tool for now to overcome the situation. In this matter, GDPR's method for choosing between competing rights does not differ from those employed by the case laws though Recital 19 and Article 10 of the GDPR jointly mandate individual's protection against the processing of data regarding criminal convictions and offenses under specific Union legal Act which derives its objective to balance. Recital 153 also supplements the statement since it also emphasizes reconciling the data protection provisions with freedom of expression in audio-visual fields, and maintaining news libraries and archives. 13 Turning into the cases, GC and Sonia deem to be awarded her right to be forgotten under GDPR since any of the overriding conditions of their right to be forgotten is presumably not satisfied. Even if, it becomes necessary for freedom of expression or journalistic or archiving purpose, then using pseudonyms would respect her rights and freedoms through data minimization under the GDPR data processing principle under Article 5 (1)(c). 13 Again, in the case of ED and Natasha, for sake of public interest, journalism, and archiving; these cases might not attract the right to be forgotten since the public's right to access information is necessary. People have a legitimate interest to know on whose hand their children are being educated and raised. However, other competing interests will have adhered to the upcoming sections.

CONTEMPORARY PRINCIPLES OF BALANCING IN MOTION
To summarize, the fundamental rights must be weighed against each other so that they can co-exist together. In that case, the highest Court showed greater importance particularly on weighing the legitimate interests of the public in a piece of particular information sought. 21 For this reason, elements responsible for making a person a public or private figure and what activities fall within the scope of public needs to be discussed as one of the implicated principles in another paper along with the elements of other principles which is not a subject matter of this paper. Analyzing the previous discussion, it is ascertained that balancing between the right to freedom of expression and the right to be forgotten comprises balancing of multiple connotations. The substances are sometimes mentioned directly in law and sometimes derived from CJEU and ECtHR cases, and scholarly opinions. Ensuring proper balancing proved to be a herculean task due to several reasons among which the most important is that the principles are dynamic and function differently on a contextual basis. Though RTBF strengthened its position in the guise of delisting right in CJEU Google Spain ruling, it is materialized for the first time in GDPR altogether. Now, we will turn into identifying the active principles of balancing between RTBF and the right to freedom of expression.

Lawfulness and unlawfulness of processing
The vagueness in the balancing principle is analogously persisting under CFR and GDPR when it comes to the spent convicts. On one hand, traits between Art. 8 (right to respect private and family life) and 11 (right to freedom of expression) of the CFR remains in discomfort though the matter has been discussed in the earlier part of this paper. On the other hand, Art. 10 and recital 19 of GDPR, vests responsibility on the data controllers to process data related to criminal convictions or offenses only under official authority like the Data Protection Officer. But being a primary and substantive source of law, 22 Art. 11 of the CFR allows exercising freedom of expression regardless of any frontier and public authority which clearly shows the complexity of determining the lawfulness of the processing. Depending on the matters and principles at issue, it is clear that it is a matter of contextual determination only which has to be performed in compliance with the motives and provisions of the law. The processing principles exercised by the CJEU, ECtHR and GDPR can be construed towards striking balancing mechanism through a gradual developmental framework. Because one thing is common among all the undertakings which are per law or the grounds of the lawfulness of data processing. While setting out the parameter of lawfulness, the CJEU introduced terms like "inadequate, irrelevant, no longer relevant, excessive with the purposes of processing." 21 Besides, both CJEU and the ECtHR legalized processing for archiving data for public use in the conduction of scientific or historical research. Public protection is adhered to by allowing processing on the ground of exercising freedom of expression too. And public rights are protected if that is consistent with the principles laid down by the law, meets the objectives of fundamental protection, and comports with the values of a democratic society. Now, the provisions of the law are clear with the enforcement of GDPR which defines the scope of the lawfulness of processing in its specific Articles. However, in construing the principles of case laws derived from both CJEU and ECtHR in collaboration with the GDPR, certain principles abrogated with the enforcement of GDPR which were appointed during the Directive regimen. For example, while prioritizing between public and private interest: both the instruction and discretion of the Member States to adopt national provisions following personal social values and traditions are presumed to be eroded and ousted.
GDPR only broadened the scope from search engine to controller but did not architect any design defining who is responsible to cross-check these balancing enforcements which should be efficient enough to respect the right to privacy and personal data of spent convicts in each case. Maybe this is to accommodate the best practice to adopt which would suit to confront the upcoming issues and challenges.
At this moment, though GDPR might be the hegemony of related lawfulness of processing, it lacks to stir the proper balance well with special reference to the spent convicts. It can be said for now that the ruling started filling the gaps through outlining principles, more needs to be done after the expansive provisioned enforcement of GDPR to keep data protection in the spirit which is intended to discuss thoroughly in another paper.

Countervailing public and private interests at stake
In terms of the apex court, it failed to formulate a test to prioritize public and private interests when both interests are competing in the same litigation. This problem is still lurking especially after GDPR's allusion of freedom of expression as one of the derogations to the right to erasure. It would be reasonable to say the right to freedom of expression would remain backed up like an antecedent. Express derogation from erasure on the ground of free expression supports that claim while it is also true that according to Art. 85, balancing between the rights is one of the objectives of the GDPR.
Here the potential clash is again visible because GDPR mandates the right to exercise freedom of expression and information as one of the derogations of the right to be forgotten under Art. 17 (3)(a) of GDPR. According to Recital 19 and Article 10 of GDPR, one of the objectives is to protect the basic freedoms and rights of the convicts. Additionally, Art. 10 (2) of ECHR outlines the protection of reputation and rights of others as one of the reasons for restricting freedom of expression. So, as long right to erasure or to be forgotten has the effect of protecting other's reputation and rights, balancing becomes inevitable since it might impose a restriction on freedom of expression which is not ensured comprehensively because certain tensions are yet to be eased for better fathom. In this matter whether the present legislation encourages the removal of information needs to be discussed in the next paper.
Also, to prioritize free expression right over RTBF, the Spanish Tribunal Supremo (Sala de lo civil) formulated a justification test for determination through certain judgments. Being truth, newsworthy, and germane are the constituent elements of the so-called justification test. 50 First, the processing is deemed to be justified even if particular information is detrimental if the information concerned is true or the data is the outcome of someone's rational effort of determining the truth, or it is revealed in good faith. Second, newsworthiness is another criterion for acceptable processing which is required to have connected with public opinion or public interest. However, a tendency of elaborating the term "newsworthy" is visible to have a broader interpretation nowadays comparing to the past which facilitates news media to have expansive leeway in publishing criminal history through the publication of any criminal database or any criminal database related to a specific case is not allowed. Last, it has to be studded with a news story that has been published earlier and needs to be published or processed to form an important part or complete the story.
To make it clearer, neither distinction between acts of public interest and private interest, nor acts that fall within the ambit of those two competing interests have been expansively revealed yet though in Google Spain it is said that any work related to the public lies within the public interest. But the reasons are unclear on why the public motivates their interest in an act that is private. So, what are the factors which make certain acts or certain personalities public? or is the term "public interest" have flaws in itself since it is so generic? These are convened neither in any case law, nor in GDPR though both the GDPR and some of the case laws mention some of the components in some names associated aimed at journalistic, research, historical, and archiving endeavors, but did not categorize directly between public and private interests. The same goes with the principles responsible for the construction of public and private individuals: by character or by activity? So, matching the balancing puzzles through discussing the evolving norms of both the public and private interests is necessary to see whether balancing is moving towards a more privacy-friendly environment or not which will be adhered in the next paper.

Achievement of purpose doctrine
The terms used by the honorable CJEU in Google Spain stating "inadequate, irrelevant, no longer relevant, excessive with the purposes" of processing indicates that there is a point when the purpose of the processing is achieved. To illustrate the purpose achievement doctrine: for instance, when a person is convicted of assault and battery, it can be assumed that after a certain period, the news or information becomes irrelevant to continue processing for journalistic or any other overriding purpose which means that further processing might be performed only for detrimental purposes on behalf of the concerned individual's privacy. It also might be the case where limited processing of the data continues, for example, if the case is being appealed and the previous data is being referred in situations where issues reemerge. The purpose achievement situations are seen in Google Spain where the court judged against further processing in fulfillment of the purpose. Even purpose limitation has now become one of the fundamental principles of data processing in the EU. Data with special reference to data related to spent convictions and offenses are not allowed to process without consent or authority. However, there are justified grounds when data continues to be processing even after the main purpose such as journalism is achieved but secondary purposes are yet to be achieved such as for employment in concerned places. But what happens with those conviction data which can never be processed such as revealing witness identities irrelevantly, or which never fully achieve the purpose of processing due to having public interest, or what happens even if achieved the purpose of processing, but the availability of data is necessary for greater public interest are still unclear since in general, there is no time limit prescribed anywhere to mark the milestone of purpose achievement.

CONCLUSION
To conclude, statutes, the CJEU, the ECtHR, and scholars agree that balancing is needed at some point between the right to be forgotten and the freedom of expression. 50 But the complication is to balance the persisting issues enshrined in CJEU's Google Spain decision which caused tension among these two rights' elements. Historically, the right to be forgotten remained vague for certain reasons. Firstly, the CJEU did not decide how much weight one right should carry against the other. Secondly, the CJEU only ruled for search engines like Google, Yahoo, Bing, and some others to delink the information where the original content remains with the publisher's website. The obvious reasons for that might be the strong mandate and established respect for the right to freedom of expression and maintaining the availability of information in some way so that they are not lost forever since the right possess a considerably strong position in a democracy. Fortunately, now the GDPR tackles both the problems in theory by specifying something to talk about while making data controllers liable for complying with the provision. So, balancing has just entered into youth after surviving infancy and youth maintains considerable lacunas in defining and interpreting principles. However, the existing mechanism of balancing is still working but not diligently as the rights are guaranteed. Since upholding fundamental rights is one of the mandates of the EU legal framework, more visible protection is indispensable. To put it differently, balancing is in its second generation and we need to push it to the third generation for more tangible forms. For this, the identified areas need to be settled down in the next writing while fragmenting and elaborating the elements of each principle to empower the balancing with those necessary enhancing norms which are supposed to show whether the third generation balancing regime will move towards the right direction or not. The emerged principles are the imminent tools of allowing or rejecting the right to be forgotten claims in spent criminal convictions in the future.

ACKNOWLEDGMENTS
Undertaking a research career is one of the most significant and life changing decisions in the walks of my life and in this transaction, I was fortunate enough to attain another master's degree in Law and Information Society in University of Turku, Finland. The attainment would have been difficult without the cooperation and support provided by the university staff and facilities. At first, I am delighted to convey my gratitude to my research supervisor Juha Lavapuro, professor of public law, University of Turku for his authentic guideline and fellowship which helped me to undertake and perform pure doctrinal research aspects. This empowerment enabled me solely to undertake and complete the original master's thesis with the collaboration of the respective educational institution from which original articles have been derived. In addition to the research supervisor, the support of the faculty coordinator Riikka Matikainen, and mentorship of other academic staff such as Dhanay M. Cardillo Chandler and Daniel Acquah who were responsible for conducting the advanced studies played worth mentioning roles in building up research ambience. Last but not the least, the technological and academic research friendly collaboration that I receive from the University of Turku is outstanding to create opportunities for me. It is to be mentioned that the concerned paper is one of the originals articles of my latest master's thesis which I am embarking for publication and is not submitted anywhere else for publication. The paper is not subjected to any commercial undertaking or any project which is funded by the government or any other organization and therefore, there is no possibility of arising any conflict of interest in the future.

DATA AVAILABILITY STATEMENT
The author confirms that the data which has been used to outline the findings of the study collaborates the outcome. The data is available within the statutes, articles, and case laws outlined in the references. The research data has been derived and analyzed for the independent verification of the outcome. A pure doctrinal methodology has been adopted and the workflow was maintained accordingly. That is why the findings have been transfigured from the already existed information.