Right to be forgotten in Google and other search engines

What is the online right to be forgotten?

This right, under EU law, derives from a May 2014 ruling of the European Court of Justice in a case where a Spanish individual successfully sought removal of Google search results relating to a newspaper article about an auction notice placed on his home some 16 years previously.
Unexpectedly, the European Court decided that individuals had a right to seek removal from Google (and other search engines) of search results on privacy grounds in certain circumstances.

Is it the same as the GDPR “right to erasure”?

The EU data protection law, known as the GDPR, which came into force in 2018, includes an individual’s “right to erasure”, also known as the “right to be forgotten”, under which you are entitled (subject to certain restrictions) to seek deletion of your personal information by anyone who holds your personal information – i.e., not just search engines. So the GDPR right to erasure is far wider than the 2014 EU court ruling, which still remains relevant for search engines.

Where does it apply?

The right to be forgotten applies in the EU only e.g. to Google UK and to local versions of Google in other EU countries. Following disputes with various EU data protection authorities, Google also started implementing such removals on Google.com insofar as accessed within the EU. However, note that, while the right to be forgotten doesn’t apply outside the EU (e.g., in the US), there may still be a case for removal from those search results based on privacy grounds.

What exactly can search engines be required to “forget” in the EU?

The 2014 EU court decision simply referred to personal information which was “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed”. So, not the clearest definition. However, EU data protection authorities have since issued guidance on the criteria which should be taken into account when assessing such requests plus there have been some court decisions. So, the landscape is now much clearer than it was. The factors include: any public role played by the individual; whether the individual is a child; whether the information relates to private life or is sensitive; the journalistic context etc. So It’s crucial to deal with these criteria when making a request under the right to be forgotten.

Is it necessary to show that material is inaccurate?

While inaccuracy (if proved) is one of the factors which will be taken into account in assessing a right to be forgotten request, it isn’t essential. The right to be forgotten revolves around privacy, unlike say defamation where truth of what is being said is a key factor. For example, in the Google Spain case (see above), the search result accurately reflected the fact that an auction notice had been placed on the complainant’s home. The point was that the information was so old that it was no longer relevant and unfairly impacted on the individual’s privacy.

What about convictions for criminal offences?

In principle, reference to criminal convictions can be removed but it all depends on the circumstances. The older, and more minor, the conviction, the more likely that de-listing will be granted. Other factors include whether the conviction is “spent” (i.e. covered by the law about rehabilitation of offenders – but this isn’t conclusive), acknowledgment of guilt and remorse, and, for business-related crimes, whether the offender is now operating in the same field or not.

Which search terms are covered?

Only searches against the person’s exact name e.g., “John Smith”. The right doesn’t apply if extra qualifying terms are added, even if they relate say to the person’s location, e.g., “John Smith London”.

Is there a right of appeal?

Yes. If Google or the other search engines reject a right to be forgotten request, there is a right of appeal to your local data protection authority. In the UK, this is the Information Commissioner’s Office.

What’s the best strategy?

In our experience, it’s best not to quickly dash off a request via the form on the search engine website. Google and other search engines rarely change their mind. While there is still a right of appeal to the data protection authority, you might as well maximise your chances of removal by putting in a strong submission first time round.

Instead, the submission should carefully address the factors which search engines are required to take into account – as set out in official guidance and court decisions. The same applies of course if appealing to a data protection authority. Relevant supporting evidence should be supplied if applicable.