Right to be forgotten

Those who favor a right to be forgotten cite its necessity due to issues such as revenge porn sites and references to past petty crimes appearing in search engine listings for a person's name. The main concern is for the potentially undue influence that such results may exert upon a person's online reputation indefinitely if not removed.

Those who oppose the right worry about its effect on the right to freedom of expression and whether creating a right to be forgotten would result in a decreased quality of the Internet, censorship, and the rewriting of history.

The right to be forgotten is an example of the broader right to privacy. It is distinguished from the right to privacy in that the latter concerns protecting information that is not known publicly, whereas the right to be forgotten involves revoking public access to information that was known publicly at a certain time.

Recognition by jurisdiction

Argentina

Argentina has had lawsuits by celebrities against Google and Yahoo! in which the plaintiffs demand the removal of certain search results, and require removal of links to photographs. One case, brought by artist Virginia da Cunha, involved photographs which had originally been taken with her permission and uploaded with her permission, however she alleged that the search results improperly associated her photographs with pornography. Da Cunha's case achieved initial success resulting in Argentina search engines not showing images of the particular celebrity, however, this decision is on appeal.

Virginia Simari, the judge in favor of Da Cunha, stated that people have the right to control their image and avert others from "capturing, reproducing, broadcasting, or publishing one's image without permission". In addition, Simari used a treatise written by Julio César Rivera, a Buenos Aires lawyer, author, and law professor "the right to control one's personal data includes the right to prevent others from using one's image." Since the 1990s, Argentina has also been a part of the habeas data movement in which they "adopted a constitutional provision that is part freedom-of-government-information law and part data privacy law." Their version is known as Amparo. Article 43 explains it:

"Any person shall file this action to obtain information on the data about himself and their purpose, registered in public records or databases, or in private ones intended to supply information; and in case of false data or discrimination, this action may be filed to request the suppression, rectification, confidentiality or updating of said data."

Argentina's efforts to protect their people's right to be forgotten has been called "the most complete" because individuals are able to correct, delete, or update information about themselves: overall, their information is bound to remain confidential.

China

In 2016, a Chinese court in Beijing rejected an argument for the right to be forgotten when a judge ruled in favor of Baidu in a lawsuit over removing search results. It was the first of such cases to be heard in Chinese court. In the suit, Ren Jiayu sued Chinese search engine Baidu over search results that negatively associated him with a previous employer, Wuxi Taoshi Biotechnology. Ren argued that by posting the search results, Baidu had infringed upon his right of name and right of reputation, both protected under Chinese law. Because of these protections, Ren believed he had a right to be forgotten by removing these search results. The court ruled against Ren, claiming his name is a collection of common characters and as a result the search results were derived from relevant words. The court described search results as neutral findings based on an algorithm and stated that retaining such information was necessary for the public.

As the call for personal information protection has grown louder, China has taken active measures to strengthen data protection. In 2018, China released the national standard "Information Security Technology—Personal Information Security Specification," which was the first systematic regulation for personal information protection. In 2020, the updated national standards replaced the version that came into effect in 2018.

Subsequently, in 2021, China introduced the formal legal framework, the "Personal Information Protection Law of the People's Republic of China" (PIPL). The enactment of this law filled a legal gap and made detailed provisions regarding the collection, storage, use, transfer, and deletion of personal information. The law explicitly outlines that individuals have a range of fundamental rights over their data, including the right to know, the right to decide, the right to access and copy, the right to rectify or supplement, and the "right to be forgotten."

For businesses, it is essential to follow the principles of legality, fairness, and necessity when collecting and using personal data, ensuring transparency and data security. Moreover, the PIPL strengthens the regulation of cross-border data flows, requiring risk assessments in specific cases and mandating additional protective measures for users.

European Union and United Kingdom

Europe's data protection laws do not implement a "right to be forgotten", but a more limited "right to [data] erasure". Variations on the concept a right to be forgotten have existed in Europe for many years, including:

• In the United Kingdom the Rehabilitation of Offenders Act 1974 provides that after a certain period of time many criminal convictions are "spent", meaning that information regarding said person should not be considered when obtaining insurance or seeking employment and referring to them may constitute defamation as though such claims were false.
• In France le droit à l'oubli (the right to be forgotten) was enacted in French Law in 2010.

Although the term "right to be forgotten" is a relatively new idea, the European Court of Justice legally solidified that the "right to be forgotten" is a human right when they ruled against Google in the Costeja case on May 13, 2014.

This raises questions about the limitations of application in a jurisdiction include the inability to require removal of information possessed by companies outside the jurisdiction. There is no global framework to allow individuals control over their online image. However, Professor Viktor Mayer-Schönberger has argued that Google cannot escape compliance with the law of France implementing the decision of the European Court of Justice in 2014, pointing out that the U.S. and other nations have long maintained that their local laws have "extra-territorial effects".

In 1995, the European Union adopted the European Data Protection Directive (Directive 95/46/EC) to regulate the processing of personal data. Data protection is now considered a component of human rights law. The European General Data Protection Regulation (GDPR), in force since 2018, provides protection and exemption for companies listed as "media" companies, like newspapers and other journalistic work. However, Google purposely opted out of being classified as a "media" company, therefore the company is not protected. Judges in the European Union ruled that because the international corporation, Google, is a collector and processor of data it should be classified as a "data controller" under the meaning of the EU data protection directive. These "data controllers" are required under EU law to remove data that is "inadequate, irrelevant, or no longer relevant", making this directive of global importance.

In Article 12 of the Directive 95/46/EC the EU gave a legal basis to Internet protection for individuals. A right to be forgotten was replaced by a more limited right of erasure in Article 17 of the GDPR, which came into force in May 2018.

To exercise the right to be forgotten and request removal from a search engine, one must complete a form through the search engine's website. Google's removal request process requires the applicant to identify their country of residence, personal information, a list of the URLs to be removed along with a short description, and – in some cases – attachment of legal identification. The applicant receives an email from Google confirming the request but the request must be assessed before it is approved for removal. If the request is approved, searches using the individual's name will no longer result in the content appearing in search results. The content remains online and is not erased. After a request is filled, their removals team reviews the request, weighing "the individual's right to privacy against the public's right to know", deciding if the website is "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed". Google has formed an Advisory Council of various professors, lawyers, and government officials from around Europe to provide guidelines for these decisions. However, the review process is still a mystery to the general public. Guidelines set by EU regulators were not released until November 2014, but Google began to take action on this much sooner than that, which (according to one author) allowed them "to shape interpretation to [their] own ends". In May 2015, eighty academics called for more transparency from Google in an open letter.

The form asks people to select one of the 27 countries that make up the European Union, as well as Andorra, Iceland, Liechtenstein, Monaco, Norway, San Marino, Switzerland, and the United Kingdom, plus several dependent territories. "The form allows an individual or someone representing an individual to put in a request" for the removal of any URLs believed to be a violation of the individual's privacy. Regardless of who is submitting the form, some form of photo identification of the person the form is being submitted for must be present. This is meant to serve as proof that the person for whom the request was made for does in fact approve.

If Google refuses a request to delink material, Europeans can appeal to their local data protection agency. As of May 2015, the British Information Commissioner's Office (ICO) had treated 184 such complaints, and overturned Google's decision in about a quarter of those. If Google fails to comply with a decision of the ICO, it can face legal action.

In July 2014, in the early stages of Google's effort to comply with the court ruling, legal experts questioned whether Google's widely publicized delistings of a number of news articles violated the UK and EU Data Protection Directive, since in implementing the Directive, Google is required to weigh the damage to the person making the request against any public interest in the information being available. Google indeed acknowledged that some of its search result removals, affecting articles that were of public interest, were incorrect, and reinstated the links a week later. Commentators like Charles Arthur, technology editor of The Guardian, and Andrew Orlowski of The Register noted that Google is not required to comply with removal requests at all, as it can refer requests to the information commissioner in the relevant country for a decision weighing the respective merits of public interest and individual rights.

Google notifies websites that have URLs delinked, and various news organizations, such as BBC, have published lists of delinked articles. Complainants have been named in news commentary regarding those delinkings. In August 2015 the ICO issued an enforcement action requiring Google to delink some of these more recent articles from searches for a complainant's name, after Google refused to do so. Google complied with the request. Some academics have criticized news organizations and Google for their behavior.

In July 2015, Google accidentally revealed data on delinkings that "shows 95% of Google privacy requests are from citizens out to protect personal and private information – not criminals, politicians and public figures." Only 5% of requests were made by criminals, politicians, and public figures. One request for data removal was from a British doctor requesting to have 50 links removed on past botched medical procedures. Google agreed to remove three search results containing his personal information.

The European Union has been advocating for the delinkings requested by EU citizens to be implemented by Google not just in European versions of Google (as in google.co.uk, google.fr, etc.), but on google.com and other international subdomains. Regulators want delinkings to be implemented so that the law cannot be circumvented in any way. Google has refused the French Data Protection Agency's demand to apply the right internationally. Due in part to their refusal to comply with the recommendation of the privacy regulating board Google has become the subject of a four-year-long antitrust investigation by the European Commission. In September 2015, the French Data Protection Agency dismissed Google's appeal.

The French Data Protection Agency appealed to the EU courts to seek action on Google for failing to delink in its global servers. In September 2019 the Court of Justice for the EU issued its decision, finding that Google is not required to delink on sites external to the EU, concluding that "Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject ... to carry out such a de-referencing on all the versions of its search engine."

As of September 2015, the most delinked site is www.facebook.com. Three of Google's own sites, groups.google.com, plus.google.com and www.youtube.com are among the ten most delinked sites. In addition to Google, Yahoo! and Bing have also made forms available for making delinking requests.

In September 2019, the European Court of Justice ruled that the right to be forgotten did not apply outside of its member states. The ruling meant that Google did not have to delete the names of individuals from all of its international versions. In a separate judgment delivered on the same day, the Court also ruled that search engines generally have to remove 'special category' data search results, such as those revealing health status or criminal records, returned upon a search for a person's name upon request, with a very high bar for an exception. They do not however need to obtain explicit consent before indexing such data, even though the law typically requires explicit consent before data processing, on the basis that such examination would not be within the powers, responsibiities or capabilities of a search engine. The consequences of this judgment have been criticised in data protection scholarship, as its logic implies that technologies that are designed in a way that renders data protection compliance impossible may be given the right to avoid the law.

In December 2022, the judges in Luxembourg further extended the right to be forgotten in the case C-460/20 TU, RE v Google LLC. The case related to two managers of a group of investment companies, who argued that three unflattering news articles should be 'de-referenced' from the search engine results of Google, when searching for their names. They claimed that the information presented in the articles was wrong factually, which raised the question whether search engine operators need to check the accuracy of the information. Additionally, the applicants required that photographs showing them in preview images – or thumbnails – when carrying out a search ought to be removed. In this judgment the European Court of Justice largely agreed with the request of the applicants. Search engine operators such as Google are required to de-reference the respective information, if a person who seeks de-referencing submits 'relevant and sufficient' evidence capable of substantiating his or her request, and thereby manifests the inaccuracy of the information found (para. 72). For thumbnails an independent assessment must be performed, but essentially the same thinking applies.

Europe's jurisdiction of data also extends beyond its borders into countries that does not have "adequate" protections. For instance, Europe's transfer of data to vulnerable countries are limited, resulting in companies like Google and Amazon establishing European data centers to quarantine data from Europe.

Case law in Spain

In May 2014, the European Court of Justice ruled against Google in Google Spain v AEPD and Mario Costeja González, a case brought by a Spanish man, Mario Costeja González, who requested the removal of a link to a digitized 1998 article in La Vanguardia newspaper about an auction for his foreclosed home, for a debt that he had subsequently paid. He initially attempted to have the article removed by complaining to the Spanish Data Protection Agency, which rejected the claim on the grounds that it was lawful and accurate, but accepted a complaint against Google and asked Google to remove the results. Google sued in the Spanish Audiencia Nacional (National High Court) which referred a series of questions to the European Court of Justice. The court ruled that search engines are responsible for the content they point to and thus, Google was required to comply with EU data privacy laws. On its first day of compliance only (May 30, 2014), Google received 12,000 requests to have personal details removed from its search engine.

Case law in Germany

On October 27, 2009, lawyers for Wolfgang Werlé who—together with Manfred Lauber—was convicted of murdering Walter Sedlmayr sent the Wikimedia Foundation a cease and desist letter requesting that Werlé's name be removed from the English language Wikipedia article "Walter Sedlmayr", citing a 1973 Federal Constitutional Court decision that allows the suppression of a criminal's name in news accounts once he is released from custody. Previously, Alexander H. Stopp, attorney for Werlé and Lauber, had won a default judgment in German court, on behalf of Lauber, against the Wikimedia Foundation. According to the Electronic Frontier Foundation, Werlé's lawyers also challenged an Internet service provider in Austria which published the names of the convicted killers.

Wikimedia is based in the United States, where the First Amendment protects freedom of speech and freedom of the press. In Germany, the law seeks to protect the name and likenesses of private persons from unwanted publicity. On January 18, 2008, a court in Hamburg supported the personality rights of Werlé, which by German law includes removing his name from archive coverage of the case.

On November 12, 2009, The New York Times reported that Wolfgang Werlé had a case pending against the Wikimedia Foundation in a German court. The editors of the German-language Wikipedia article about Sedlmayr removed the names of the murderers, which have since then been restored to the article. The Guardian observed that the lawsuit has resulted in the Streisand effect, an upsurge in publicity for the case resulting from the legal action.

On December 15, 2009, the German Federal Court of Justice (Bundesgerichtshof) in Karlsruhe ruled that German websites do not have to check their archives in order to provide permanent protection of personality rights for convicted criminals. The case occurred after the names of the brothers were found on the website of Deutschlandradio, in an archive article dating from July 2000. The presiding judge Gregor Galke stated "This is not a blank check", and stated that the right to rehabilitation of offenders had been taken into consideration.

On November 28, 2019, the federal constitutional court in Karlsruhe ruled that German murderer Paul Termann had the right to be forgotten.

General Data Protection Regulation

The 2012 draft European Data Protection Regulation Article 17 detailed the "right to be forgotten and to erasure". By Article 17 individuals to whom the data appertains are granted the right to "obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child or where the data is no longer necessary for the purpose it was collected for, the subject withdraws consent, the storage period has expired, the data subject objects to the processing of personal data or the processing of data does not comply with other regulation".

The EU defines "data controllers" as "people or bodies that collect and manage personal data". The EU General Data Protection Regulation requires data controllers who have been informed that an individual has requested the deletion of any links to or copies of information must "take all reasonable steps, including technical measures, in relation to data for the publication of which the controller is responsible, to inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that personal data. Where the controller has authorized a third party publication of personal data, the controller shall be considered responsible for that publication". In the situation that a data controller does not take all reasonable steps then they will be fined heavily.

The European Parliament was once "expected to adopt the proposals in first reading in the April 2013 Plenary session". The right to be forgotten was replaced by a more limited right to erasure in the version of the GDPR adopted by the European Parliament in March 2014. Article 17 provides that the data subject has the right to request erasure of personal data related to him on any one of a number of grounds including non-compliance with article 6.1 (lawfulness) that includes a case (f) where the legitimate interests of the controller are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (see also Costeja).

The European Union is an influential group of states, and this tendency towards the right to be forgotten in the EU is an indicator of its recognition globally as a right. To support this, in 2012 the Obama Administration released a "Privacy Bill of Rights" to protect consumers online. It did not become law.

Hong Kong

In June 2014, Privacy Commissioner Allan Chiang Yam-wang (蔣任宏) expressed his support for introducing the right to be forgotten to Hong Kong. Opposition expressed their worry that the right would inhibit freedom of information, and introducing erase from history. Charles Mok, Hong Kong Legislative Councillor from I.T. occupation, oppose to introduce the right to be forgotten, citing the difficulty of enforcing and abuses of practising the right. He described the abuses as "right to be deleteion" In July 2015, Stephen Wong Kai-yi (黃繼兒) replaced Chiang's position and promised not to introduce the right to be forgotten.

India

In April 2016, the Delhi High Court began to examine the issue after a Delhi banker requested to have his personal details removed from search results after a marital dispute. In this case, due to the dispute being settled, the banker's request is valid. The High Court has asked for a reply from Google and other search engine companies by September 19, upon which the court will continue to investigate the issue.

In January 2017, the Karnataka High Court upheld the right to be forgotten, in a case involving a woman who originally went to court in order to get a marriage certificate annulled, claiming to have never been married to the man on the certificate. After the two parties came to an agreement, the woman's father wanted her name to be removed from search engines regarding criminal cases in the high court. The Karnataka High Court approved the father's request, stating that she had a right to be forgotten. According to the court, its ruling would align with western countries' decisions, which typically approve of the right to be forgotten when dealing with cases "involving women in general and highly sensitive cases involving rape or affecting the modesty and reputation of the person concerned." The woman in this specific case was worried that the search results would affect her standing with her husband, as well as her reputation in society.

As of February 2017, the Delhi High Court is hearing a case involving a man requesting to have information regarding his mother and wife to be removed from a search engine. The man believes that having his name linked to the search is hindering his employment options. The Delhi High Court is still working on the case, along with the issue of whether or not a right to be forgotten should be a legal standard in India. Currently, there is no legal standard for the right to be forgotten, but if implemented, this would mean that citizens no longer need to file a case in order to request for information from search engines to be removed. This case could have significant impacts on the right to be forgotten and search engines in India.

South Korea

In May 2016, South Korea's Communications Commission (KCC) announced citizens will be able to request search engines and website administrators to restrict their own postings from being accessible publicly. The KCC released "Guidelines on the Right to Request Access Restrictions on Personal Internet Postings", which took effect in June 2016 and do not apply to third party contents. To the extent that the right to be forgotten concerns a data subject's right to limit the searchability of third party postings about him/her, the Guideline does not constitute a right to be forgotten. Also, as to the right to withdraw one's own posting, critics have noted that people have been able to delete their own postings before the Guideline as long as they have retained their login credentials, and that people who have misplaced their login credentials were permitted to retrieve or receive new ones. The only services significantly affected by the Guideline are Wiki-type services where people's contributions make logical sense only in response to or in conjunction with one another's contributions and therefore the postings are made permanent part of the mass-created content, but KCC made sure that the Guideline applies to these services only when the posting identifies the authors.

The guidelines created by the KCC include that data subjects can remove content that includes the URL links, and any evidence consisting of personal information. The commission included different amendments to the guideline. This includes describing the Guidelines as a "minimum" and "preliminary" precaution regarding privacy rights in vague areas of existing laws. The guideline encompasses foreign Internet companies that provide translation services for South Korean consumers. In order to have a person's information "forgotten" he or she has to go through a three step process: the issue posted with the URL, proof of ownership of the post, grounds for the request. There are restrictions on each step. When posting the URL, the web operator has the right to preserve the posting issue. The second being that if the post is relevant to public interest, web operators will process this request on the terms of relevance.

Switzerland

The right to be forgotten was added in the constitution of the Canton of Geneva in the new article 21A right to digital integrity voted on June 18, 2023.

United States

In law

Consideration of the right to be forgotten occurred in US case law, specifically in Melvin v. Reid, and in Sidis v. FR Publishing Corp.

In Melvin v. Reid (1931), an ex-prostitute was charged with murder and then acquitted; she subsequently tried to assume a quiet and anonymous place in society. However, the 1925 movie The Red Kimono revealed her history, and she successfully sued the producer. The court reasoned that "any person living a life of rectitude has that right to happiness which includes a freedom from unnecessary attacks on his character, social standing or reputation."

In Sidis v. FR Publishing Corp. (1940), the plaintiff, William James Sidis, was a former child prodigy who wished to spend his adult life quietly, without recognition; however, this was disrupted by an article in The New Yorker. The court held here that there were limits to the right to control one's life and facts about oneself, and held that there is social value in published facts, and that a person cannot ignore their celebrity status merely because they want to.

There is opposition to further recognition of the right to be forgotten in the United States as commentators argue that it will contravene the right to freedom of speech and freedom of expression, or will constitute censorship, thus potentially breaching peoples' constitutionally protected right to freedom of expression in the United States Constitution. These criticisms are consistent with the proposal that the only information that can be removed by user's request is content that they themselves uploaded.

In a June 2014 opinion piece in Forbes, columnist Joseph Steinberg noted that "many privacy protections that Americans believe that they enjoy – even some guaranteed by law – have, in fact, been eroded or even obliterated by technological advances". Steinberg, in explaining the need for legislation guaranteeing the "right to be forgotten", noted that existing laws require adverse information be removed from credit reports after a period of time, and that allowing the sealing or expunging of criminals records are effectively undermined by the ability of prospective lenders or employers to find forever the removed information in a matter of seconds by doing a web search.

On March 11, 2015, Intelligence Squared US, an organization that stages Oxford-Style debates, held an event concerning the question, "Should the U.S. adopt the 'Right to be Forgotten' online?" The side against the motion won with a 56% majority of the voting audience.

While opinions among experts are divided in the U.S., one survey indicated that 9 in 10 Americans want some form of the right to be forgotten. The consumer rights organization Consumer Watchdog has filed a complaint with the Federal Trade Commission for Americans to obtain the right as well.

In March 2017, New York state senator Tony Avella and assemblyman David Weprin introduced a bill proposing that individuals be allowed to require search engines and online speakers to remove information that is "inaccurate", "irrelevant", "inadequate", or "excessive", that is "no longer material to current public debate or discourse" and is causing demonstrable harm to the subject.

In June 2018, California enacted the California Consumer Privacy Act, providing consumers with the right to delete their personal information from covered businesses. In October 2023, the state enacted the California Delete Act, requiring the California Privacy Protection Agency to establish a one-stop shop deletion mechanism for consumers to direct data brokers to delete their personal information.

By private entities

In January 2021, the Boston Globe announced a program to allow subjects of relatively inconsequential stories to have the stories contextualized, removed from Google searches or anonymized. In January 2025, it was reported that The Oregonian, The Plain Dealer, Bangor Daily News, The Atlanta Journal-Constitution and NJ.com offered similar services.