The Right to be Forgotten (RTBF), sometimes called the right to erasure, allows individuals to request that personal data about them be deleted or de-listed from online platforms when that data is inaccurate, outdated, irrelevant, or no longer necessary for the purpose it was collected.
The concept entered mainstream European law through the Court of Justice of the European Union (CJEU) ruling in Google Spain SL v. Agencia Española de Protección de Datos and Mario Costeja González (Case C-131/12), decided on 13 May 2014. The court held that search engines act as data controllers and can be required to remove links to pages containing personal information when those results are no longer relevant, even if the underlying content remains lawful at the source.
The right was subsequently codified in Article 17 of the EU General Data Protection Regulation (GDPR), which came into force on 25 May 2018. Article 17 sets out specific grounds for erasure and balances the right against competing interests such as freedom of expression, public interest, scientific research, and legal obligations.
Key tensions surrounding RTBF include:
- Free expression vs. privacy — critics argue de-listing can amount to a form of historical revisionism or soft censorship of journalism.
- Territorial scope — in Google v. CNIL (Case C-507/17, 2019), the CJEU ruled that Google is generally not required to apply de-referencing globally, only across EU domains.
- Public-figure carve-outs — politicians, executives, and others holding public roles typically receive weaker protection than private individuals.
RTBF has influenced legislation beyond Europe. Variants exist in Argentina, parts of Latin America, and through court rulings in India and South Korea. The United States has largely rejected a general RTBF on First Amendment grounds, though sector-specific removal rights (e.g., for non-consensual intimate imagery or juvenile records) exist at the state level. The California Consumer Privacy Act (CCPA) includes a narrower deletion right against businesses but no general search-engine de-indexing obligation.
Example
In 2014, following the CJEU's Google Spain ruling, Mario Costeja González successfully required Google to de-list search results linking his name to a 1998 newspaper notice about a repossessed property.
Frequently asked questions
Partially. The CJEU ruled in 2019 (Google v. CNIL) that EU de-listing obligations generally apply only to EU domains, not worldwide. Other jurisdictions like Argentina, India, and South Korea have developed their own versions through courts or statutes.
Keep learning