Table of contents
- What is the right to be forgotten
- Right to be forgotten and GDPR
- The jurisprudential origin: the Google Spain case
- How to exercise the right to be forgotten
- Balancing with the public interest
- Right to be forgotten and search engines
- Limits and practical challenges
The right to be forgotten represents one of the most complex and debated challenges in the field of personal data protection.
This right allows an individual to request the erasure of personal data concerning them when such data are no longer necessary for the purposes for which they were collected or processed. It is a right deeply connected to human dignity, privacy, and individual freedom, but also one that must be balanced against other fundamental values such as public interest in research, freedom of expression, and the right to information.
In this article, we will analyze what the right to be forgotten is, how it can be exercised, what limitations it faces under the GDPR, and how it seeks balance between the right to erasure and public interests.
What is the right to be forgotten
The right to be forgotten is not a new concept: it existed even before the internet, expressing the idea that every individual should not be forever tied to past events. However, with the rise of digital technology and search engines, it has taken on a profoundly different meaning.
Today, when we speak of the right to be forgotten, we refer to the right of an individual to obtain the erasure of personal data that no longer have reason to be disseminated or stored. The main legal reference is Article 17 of Regulation (EU) 2016/679, better known as the General Data Protection Regulation (GDPR). It defines the right to erasure (“right to be forgotten”) as the data subject’s right to request the data controller to delete their personal data and the controller’s obligation to do so without undue delay.
In practice, if the data are no longer necessary, have been processed unlawfully, or the individual has withdrawn consent for their use, they can request their removal.
Right to be forgotten and GDPR
The right to be forgotten and GDPR are closely linked. The European Regulation establishes both the scope and the limits of this right.
According to Article 17, the right to erasure may be exercised when:
- the data are no longer necessary for the purposes for which they were collected;
- the individual withdraws consent and no other legal basis for processing exists;
- the data have been processed unlawfully;
- the data must be deleted to comply with a legal obligation under national or EU law;
- the data were collected in relation to the offer of information society services to minors.
The data controller therefore has the duty to act, deleting or anonymizing the information that is no longer relevant. However, the GDPR also provides exceptions: deletion may be denied when data are required for the exercise of legal rights, for the defense of legal claims, for reasons of public interest in the area of public health, for purposes of archiving in the public interest, for scientific or historical research, or for statistical purposes.
The jurisprudential origin: the Google Spain case
The right to be forgotten was first clearly recognized in the landmark judgment of the Court of Justice of the European Union (CJEU) on May 13, 2014, in the case Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.
The Spanish citizen had requested Google to remove from search results a link to an old newspaper article mentioning a property seizure that had been settled years earlier. The Court ruled that the individual had the right for such information to no longer be accessible to the general public via the search engine, as it was no longer necessary for the purposes of its original publication.
Since then, the right to be forgotten has become a cornerstone of online data protection across Europe.
How to exercise the right to be forgotten
The exercise of this right can take place directly or through competent authorities.
The individual can send a request to the data controller or data processors, asking for the erasure of personal dataconcerning them. The request must include clear information: the applicant’s identity, a description of the data to be deleted, and the reason for the request.
The controller must respond without undue delay and, in any case, within one month, indicating the actions taken or the reasons why erasure is not possible. In the absence of a response or in the case of refusal, the individual may contact the Data Protection Authority or take legal action to enforce their rights.
Major platforms such as Google, Facebook, and LinkedIn have implemented online forms for requesting the removal of search results that violate the right to be forgotten, after assessing whether a public interest justifies their continued availability.
Balancing with the public interest
One of the most sensitive aspects of the right to be forgotten is its relationship with public interest and freedom of information.
Not all information can be erased, even if it is uncomfortable or damaging to the person concerned. The right to be forgotten has limits when data relate to public figures, individuals involved in matters of public relevance, or when reasons of public interest justify the continued publication of the information.
Example
In the public health sector, this right may be limited if data retention is necessary for collective protection, or in the case of academic or statistical research, where scientific research interest or archiving in the public interest prevails.
The interpretation of “public interest” is often left to judges or supervisory authorities, who assess on a case-by-case basis whether deletion is compatible with the informative function of the data.
Right to be forgotten and search engines
In the digital era, the internet’s memory is virtually infinite. Search engines amplify the reach of data, making them accessible even many years after publication.
For this reason, the right to be forgotten plays a crucial role: it does not delete the original source (which may remain online) but removes the direct links that make it easily discoverable through a name search.
In other words, the right to be forgotten does not rewrite history but limits the visibility of information that no longer serves any public interest. It represents a balance between collective memory and the individual’s right to privacy.
Limits and practical challenges
Despite its ethical and legal significance, the right to be forgotten faces several practical obstacles.
The main challenges include:
- the difficulty of determining when data are no longer necessary for their purpose;
- the complexity of harmonizing laws among EU Member States;
- the global nature of the internet, which makes it difficult to ensure deletion worldwide;
- potential conflicts with freedom of the press and freedom of expression;
- the persistence of data in digital archives, cached pages, or mirror sites.
Therefore, the exercise of the right to be forgotten requires careful evaluation and the support of data protection professionals capable of managing communication with data controllers and supervisory authorities.
The right to be forgotten is a milestone in the defense of the digital individual. It enables people to protect their reputation and privacy in a world where information can remain accessible indefinitely. Yet, it is not an absolute right it is a balancing act between individual freedom and public interest, between the right to privacy and the collective right to know.
Understanding what the right to be forgotten is, how it operates, and its limits means understanding one of the key principles of data protection in the digital age: a right that restores control over our past to help us shape a more conscious digital future.
