In contemporary society, marked by the proliferation of digital technologies and the constant circulation of data online, the protection of personal privacy has gained increasing importance. In this context, the right to be forgotten stands as an essential legal tool to safeguard the reputation and personal data of individuals in digital environments. This right allows individuals to request the removal or de-indexing of information that, even if truthful, may be outdated, irrelevant, or harmful to the affected person.
The right to be forgotten, also known as the right to erasure, is a manifestation of the fundamental right to personal data protection, recognized in various international regulations. It consists of the possibility for a person to request the deletion of their personal data from databases, websites, or search engines when such data is inappropriate, irrelevant, outdated, or excessive in relation to the purposes for which they were collected or processed. This right does not imply the absolute removal of information from the internet, but rather aims to balance the public interest in accessing certain information with the individual’s right to preserve their private life and personal image.
Legally, this right is enshrined in the European Union’s General Data Protection Regulation (GDPR), particularly in Article 17, which establishes the right of the data subject to obtain from the data controller the erasure of personal data without undue delay, under certain conditions. The jurisprudence of the Court of Justice of the European Union (CJEU) has also been crucial in shaping this right. A landmark ruling was issued in May 2014 in the case of Google Spain SL, Google Inc. versus the Spanish Data Protection Agency and Mario Costeja González, which determined that search engines must remove links to personal data when such data is inappropriate or irrelevant.
Exercising the right to be forgotten online generally involves contacting the data controllers: both the administrators of websites and operators of search engines such as Google or Bing. The first step is to identify the content to be removed or de-indexed and then submit a formal request to the responsible party. This request should include clear identification of the requester, specific links to the content to be removed or de-indexed, a justification for the request (for example, that the information is irrelevant, outdated, inaccurate, or disproportionately harmful), and documentation proving the identity of the requester and, if applicable, legal representation. If the personal data is published directly on a website, the site administrator should be contacted first. If the content cannot be removed at its source but appears indexed in search results under the requester’s name, a request for de-indexing can be submitted using the search engine’s specific forms.
Once the request is received, the data controller must evaluate whether to comply with it. This evaluation involves balancing the requester’s rights against the public interest in maintaining access to the information. Factors considered typically include the nature of the information, the time elapsed since its publication, the public role or relevance of the requester, and the impact on freedom of expression and the right to information. If accepted, the content will be removed or de-indexed. If denied, the requester may appeal to the competent data protection authority or take legal action.
It is important to emphasize that the right to be forgotten is not absolute. Its application requires careful balancing with other fundamental rights such as freedom of expression, freedom of the press, and the right to information. For example, removal requests are generally rejected when the information concerns matters of public interest, such as recent judicial records, valid journalistic investigations, or information about public figures in the exercise of their duties. Additionally, removing content from search engines does not mean the information disappears entirely from the internet; it simply stops appearing in search results associated with the requester’s name.
To exercise this right effectively, it is advisable to clearly document the request, providing all necessary elements that justify the removal, to first try an amicable approach by contacting the responsible party directly, to keep records of all communications including copies of emails or submitted forms, and in case of difficulties or denial, to consult a legal professional specializing in data protection or to approach the relevant data protection authority.
If you need assistance exercising your right to be forgotten, do not hesitate to contact us. We are here to guide you through every step of the process and protect your privacy rights in the digital environment.
Frequently Asked Questions (FAQs) about the Right to Be Forgotten
What type of information can I request to be removed under the right to be forgotten?
You can request the removal of personal information that is irrelevant, outdated, inaccurate, inappropriate, or disproportionately harms your reputation or privacy. This includes old news articles, forum posts, expired court rulings, photos, or links that no longer reflect your current situation.
Does the right to be forgotten mean that the information completely disappears from the internet?
No. The right to be forgotten does not erase the original content from the internet; rather, it prevents that content from appearing in search engine results associated with your name. The information may still exist on the original website but will no longer be easily accessible through search engines.
What can I do if a search engine or website rejects my removal request?
If your request is denied, you can appeal to the data protection authority in your country or pursue legal action. It is also advisable to consult a lawyer specialized in data protection to assess your options and receive proper guidance.