Back More
Salem Press

Table of Contents

Privacy Rights in the Digital Age

Right to be forgotten

by Crystal N. Le

A principle that gives a data subject (an individual whose personal data relating to him- or herself is in dispute) the right to demand that search engines delete the data subject's personal data. The Right to Be Forgotten stems from the European Union's Data Protection Directive labeled 95/46/EC, outlining “the processing of personal data and … free movement of such data” and a natural person's particular right to privacy. This directive was enacted in 1995, but a contemporary interpretation was not adopted until a landmark decision in Case C-131/12, Google Spain SL, Google, Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, CJEU 13 May 2014, that allows data subjects “the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, and to obtain from third parties the erasure of any links to, or copy, or replication of that data …” under certain conditions (Data Protection Directive, art. 17, Oct. 24, 1995, 95/46/EC). Currently, the Right to Be Forgotten is limited to citizens of member countries of the European Union, but it is open to search engines operating outside the European Union.

The original 95/46/EC Directive was proposed in 1990, when the Internet was in its early stage of development. The directive passed in 1995, and the Internet's most popular search engine, Google, made its debut three years later.

Google v. AEPD, González

In the Google v. AEPD, Gonzalez case, the European Court of Justice decided the liability of third parties. In this case, Google Spain and Google Inc. lawfully published links to web pages with true information on data subjects, but the information of those data subjects may be prejudicial to them, and the data subjects may wish to be “forgotten” after a certain time.

The current interpretation of Right to Be Forgotten from the March 5, 2010, lawsuit commenced by the AEPD on behalf of Mario Costeja González, a Spanish citizen (Spain is an EU member state). Gonzalez claimed his fundamental right to data protection and dignity was violated after the newspaper La Vanguardia Ediciones SL published information and documents with personal debts searchable by his name using Internet search engines. Mr. Gonzalez asserted that the matter of his personal debts was resolved, and the information and documents that resulted from searching his name were no longer relevant to the public proceedings on his debts.

Mr. Gonzalez asked for relief against La Vanguardia either to remove or alter pages with his personal data or to use certain tools in the search engines to protect the data. Mr. Gonzalez also asked for relief against Google Spain and Google Inc. to remove or conceal his personal data from its search results and the links to La Vanguardia.

On July 30, 2010, AEPD dismissed La Vanguardia from the action because a legal nexus existed between the posting of Mr. Gonzalez's information and the Ministry of Labor and Social Affairs's intent to give maximum publicity to the auction of Mr. Gonzalez's debts in order to secure as many bidders as possible. Google Spain and Google Inc. remained as parties in litigation.

To protect privacy, family life, and a balanced necessity for the erasure of data based on its irrelevancy or prejudice against the data subject, the Court interprets 95/46/EC as such:

Per Article 2(b) and (d), “Processing of personal data” is the activity of a search engine consisting of finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference when that information contains personal data; and “Controller” is the operator of the search engine for processing data.

A “controller of a Member State” under Article 4(1)(a) is an operator of a search engine who sets up a branch or subsidiary in a Member State that intends to promote and sell advertising space offered by that engine that orientates its activity towards the inhabitants of the Member State.

The provisions of Article 12(b) and subparagraph (a) of Article 14, Paragraph 1 require [that] the operator of a search engine is obligated to remove from the displayed list of search results on the basis of:

  1. A data subject's name links to web pages with personal data;

  2. That is published by third parties and contains information relating to that data subject; and

  3. The name or information is not erased beforehand or simultaneously from those web pages, and

  4. When the publication in itself on those pages is lawful.

Furthermore, when appraising the conditions for the application of those provisions, it should be examined, among other things, whether:

  1. The data subject has a right that the information personally relating to him should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name, where prejudice to the data subject is not a necessary element.

  2. The data subject may, under Art. 7 and 8, request that personal data no longer be made available to the general public. Those rights override, as a rule, the economic interest of the operator of the search engine and the interest of the general public in having access to that information upon a search relating to the data subject's name.

  3. Exception: a data subject's role in public life creates a preponderant interest of the general public in maintaining access to the data subject's information and overrides the data subject's fundamental rights.

Companies such as Google, Inc., Microsoft's Bing, and Yahoo! provide an online web form for any data subject who is a citizen of a European Union member state to request the removal of their personal information. Personal information includes, among other things, the name used to search, the urls to be removed, and an explanation about why it pertains to the data subject.

The United States strongly values freedom of expression and freedom of the press as fundamental values. Such values are incompatible with the Right to Be Forgotten as applied in 95/46/EC, yet practices in U.S. bankruptcy law, credit reporting, and criminal law conceptually recognize the doctrine of the Right to Be Forgotten. Private companies such as Twitter are adopting policies mirroring the basic principles of the Right to Be Forgotten.

The U.S. Supreme Court has held that states may not pass laws restricting the media from disseminating truthful but embarrassing information (for example, the name of a rape victim) as long as the information was legally acquired (Florida Star v. B.J.F., 491 U.S. 524 (1989). Particular state laws governing online privacy issues currently exist as well.

Further Reading

1 

Grande, Allison, “EU, Google in Power Struggle Over ‘Right to Be Forgotten.’” Law360, July 30, 2014.

2 

“Recent Case: Internet Law—Protection of Personal Data—Court of Justice of the European Union Creates Presumption That Google Must Remove Links to Personal Data upon Request, Case C-131/12, Google Spain SL v. Agencia Española de Protección de Datos (May 13, 2014).” Harvard Law Review 128 (2014): 735–742.

3 

Toobin, Jeffrey. “The Solace of Oblivion: In Europe, the Right to Be Forgotten Trumps the Internet.” New Yorker, September 29, 2014.

4 

Walker, Robert Kirk. “Note: The Right to Be Forgotten.” Hastings Law Journal 64 (2012): 257–286.

See also: Florida Star v. B.J.F.; Financial information, privacy right to; Privacy torts; Search engines

Citation Types

MLA 9th
Le, Crystal N. "Right To Be Forgotten." Privacy Rights in the Digital Age, edited by Christopher T. Anglim & JD, Salem Press, 2016. Salem Online, online.salempress.com/articleDetails.do?articleName=PRDA_0180.
APA 7th
Le, C. N. (2016). Right to be forgotten. In C. Anglim & JD (Ed.), Privacy Rights in the Digital Age. Salem Press. online.salempress.com.
CMOS 17th
Le, Crystal N. "Right To Be Forgotten." Edited by Christopher T. Anglim & JD. Privacy Rights in the Digital Age. Hackensack: Salem Press, 2016. Accessed May 30, 2026. online.salempress.com.