The Right to Be Forgotten

The Google Spain Ruling

In 2014, the Court of Justice of the European Union ruled in Google Spain v. AEPD that individuals have the right to request search engines to remove links to personal information that is 'inadequate, irrelevant, or no longer relevant.' The case involved a Spanish man, Mario Costeja Gonzalez, who wanted Google to remove links to a 1998 newspaper notice about his debts.

The ruling established that search engines are 'data controllers' under EU law and must balance an individual's right to privacy against the public's right to information. It does not erase the original content - the newspaper article remained online - but it removes the search engine link that makes it easily discoverable.

Since the ruling, Google has received millions of requests to delist URLs. It grants roughly 45-50% of them, applying criteria that weigh the requester's right to privacy against public interest. Requests involving public figures, political content, or matters of ongoing public relevance are more likely to be rejected.

Worked Example: From a Court Ruling to a Codified Right

The Google Spain decision in 2014 created the right to be forgotten through case law, but it left hard questions open. Four years later the GDPR turned it into a written statutory right. Article 17 of the GDPR ('Right to erasure') lets individuals demand deletion of their personal data - but crucially, it builds in exceptions where erasure would conflict with freedom of expression, a legal obligation, public-interest tasks, or scientific and historical research. This balance is what stops the right from becoming a tool to erase legitimate news.

The hardest open question was geographic scope: if a link is delisted, should it disappear worldwide or only within the EU? France's regulator, the CNIL, argued for global delisting and fined Google to enforce it. In September 2019, in Google v. CNIL (C-507/17), the CJEU sided with Google: delisting is generally required only on EU versions of the search engine, not worldwide, because forcing EU standards on the whole internet would let other regimes do the same.