Questions About the Right to be Forgotten

What is meant by the right to be forgotten?

The right to be forgotten has two commonly understood meanings:

The first is the right of an individual to ask internet search engines to remove unwanted search results. The right to be forgotten by internet search engines, arises from a 2014 decision of the European Court of Justice known as Google v Spain, in which the judge held that where information was irrelevant, outdated, or otherwise inappropriate, it should be removed from results when an individual’s name is searched.
The second meaning of the right to be forgotten, is the right of an individual under the GDPR to ask an organisation to delete data and information about them, that they hold and process. Specific criteria in the GDPR have to be met before an organisation is obliged to delete data that it holds about an individual and there are exceptions which permit an organisation to continue processing your data, even if you ask for it to be deleted.

What is the GDPR right to be forgotten?

The right to be forgotten under Article 17 of the General Data Protection Regulations (GDPR) gives individuals the right to ask organisations to delete any information that they hold about them. The organisation will be obliged to delete the data, if certain criteria are met, including:

The organisation no longer needs the data
The person withdraws consent for their data to be processed, which was necessary for the organisation to be able to hold it
If the organisation has no overriding legitimate interest in continuing to process the individual’s data
Where the data is being used to carry out direct marketing, and the individual asks for the data to be deleted
Where the organisation had no right in the first place to process the individual’s data
If a court or other similar organisation has ordered the organisation to delete the data
In the case of children, where their data is processed by social media companies or other such organisations

If any of these conditions are met, then the organisation should delete the data that they hold about the individual.

How do I apply for right to be forgotten?

If you want to apply to an internet search engine, Google, Yahoo and Bing all have standard forms which can be used to submit the applications. In each case, you will need to give the search engine specific information, including:

the URLs which you want to block
an explain of why you think they should be blocked
identifying information about yourself

If you want to ask an organisation to delete data that they hold about you, you need to put your request in writing. In your request, you need to identify yourself properly and confirm whether you are making the request on your own behalf, or on behalf of someone else. To identify yourself, you will need to provide the organisation with photographic ID such as a driving licence, or passport, as well as identification documents to show your address, such as a recent utility bill. You also have to explain exactly what data you want to be deleted, and why the data should be deleted. Your application needs to be finished with a declaration that what you have said is true. The organisation should typically respond to you within a month.

Is right to be forgotten a fundamental right?

The right to be forgotten is not a fundamental right and there are circumstances in which your application for the right to be forgotten might be refused. If you make an application to an internet search engine, for results to be blocked from a search of your name, the search engine can refuse if they believe it is in the public interest for the results to still be available.

If you are applying to an organisation for your data to be deleted, they can refuse in certain circumstances, such as:

Where they are using your data to exercise their right to freedom of expression
If the organisation has to hold the data in order to comply with legal obligations or orders
It is in the public interest for the organisation to hold and process your data, of they are exercising their official right to do so
If the organisation is holding and processing your data for public health reasons
If the case of health professionals who are obliged to keep your data private, where the data is necessary to perform medical functions
Where the data is important for historical, statistical or scientific reasons, and erasure of the data would harm any research being undertaken
Where the data is necessary for a legal claim or defence

If any of these criteria are met, the organisation can refuse to delete your personal data.

What are the pros and cons of right to be forgotten?

If you are an individual and you want to take control of your personal data, the right to be forgotten is a powerful tool, but there are pros and cons. The pros to the right to be forgotten are:

You can use the right to be forgotten to remove damaging information about you from the internet, which is preventing you from moving on with your life, or stopping you get employment.
If damaging material is removed, you will remove a great source of stress from your life.
You can also ensure that organisations who might misuse your information in some way are prevented from doing so.

There are of course cons to the right to be forgotten as well, including:

You may have to pay fees to the organisations you apply to
In some cases, you may end up removing data about yourself which is positive as well as negative.
If you are an organisation, it is possible that you could spend a lot of time and resources complying with right to be forgotten requests, and requests for the erasure of data.

It can be time consuming and costly to deal with such requests, particularly if there is a great deal of data about an individual which is held across a number of databases, or in paper records as well as electronically. If it would be too costly to deal with a request for erasure, then an organisation has the right to refuse a request.

What are the benefits of right to be forgotten?

If there are negative stories about you which appear online, they can seriously affect your employment prospects and your ability to progress with your life. At the other end of the scale, you may simply be annoyed by badgering phone calls, emails or mail shots from organisations engaging in direct marketing activities. In either case, if you are able to achieve the right to be forgotten, the results can be very effective. For many people, the real benefit of the right to be forgotten is peace of mind. If unwanted information is erased, you no longer have to worry about friends, family or employers being able to find it, or to discover things that you have done in the past that you are not proud of. If you are worried that an organisation might misuse the data that they hold about you, or sell it on to third parties, then once it has been deleted, these worries will dissipate.

Do I have the right to be forgotten?

Any individual has the right to be forgotten, but this does not mean that every application for the right to be forgotten will be successful. You have the right to be forgotten as a result of the GDPR, in relation to information that an organisation holds about you, and, in case of removing information from internet search results, from the European Court of Justice decision in Google v Spain. You can exercise your right to be forgotten at any time – there are no time limits that you need to abide by. In fact, when you are requesting the removal of material from the internet, the longer it has been available the better, as one of the criteria the search engine will consider is whether the information is outdated. You do not lose your right to be forgotten if you have made an application which is unsuccessful, but it will be important to consider the reason that the application has been rejected, and decide whether another application at a later date, or an appeal to the Information Commissioner’s Office, would be appropriate.

Do criminals have the right to be forgotten?

Criminals do have the right to be forgotten, in certain circumstances. If you have been convicted of a crime that is now spent, you are no longer obliged to tell your current employer, or any prospective employer about it. However, if there are historical news reports which appear online about your crime, it means that this information is available to anyone. In these circumstances, you would be able to apply to the search engine to say that it is inappropriate that the material is still available, as you are under no statutory obligation to disclose any information about it to anybody. There are of course crimes that are considered so serious that they will never be spent and in those cases, a convicted criminal may struggle to persuade an internet search engine to remove material about them, but it is possible. It would not be possible for a convicted criminal to ask the court service to delete data about the crime, as that would fall under one of the exemptions listed above.

How long does Google right to be forgotten take?

An application to Google for the right to be forgotten can take between 1 week and a few months to be processed, but this is not set in stone. In very straightforward cases, Google may respond within a matter of hours or days of the application for the right to be forgotten being submitted. In other cases, where there are multiple URLs to be considered, or if there are complex legal issues which need to be considered, it can take Google longer to respond. In some cases, a right to be forgotten application to Google might take longer to resolve, if Google asks the applicant for more information about their case. For example, if someone makes an application to Google to say that a criminal conviction has been spent, Google might request evidence of that, before the right to be forgotten is granted. If Google responds to confirm that a right to be forgotten application has been successful, the unwanted search results usually disappear very quickly, and almost always within 24 hours.

Does the right to be forgotten apply to newspapers?

The right to be forgotten does apply to articles which appear in newspapers, and data which newspapers hold about individuals. If you apply to a newspaper directly, asking them to remove data about you from publication, it is likely that they will say they are exercising their right to freedom of expression, and refuse to remove the material. The better approach may therefore be an application for the right to be forgotten to the internet search engines, to block the newspaper articles from a search of your name. This can be very useful if there was a newspaper report saying that you were being tried for a crime, but no subsequent report to say that you had been found not guilty, or exonerated in some other way. Newspaper archives can be a rich source of information about individuals, and in circumstances where the newspaper report is about something negative, such as being arrested, tried or convicted, the continued publication of old newspaper articles can have a devastating effect on someone’s life.

How do you get your name removed from Internet searches?

You can get data about yourself removed from internet searches by making an application to the search engine for the right to be forgotten. The three main search engines (Google, Bing and Yahoo) all have their own procedures that need to be followed. In every case, your application needs to include:

The name searched which throws up the unwanted results
The URLs that you want to block from a search of your name
An explanation of why the URLs should be blocked which meets the criteria of the right to be forgotten
Your identification documents

The internet search engine would consider your application against the criteria of the European Court of Justice in the Google v Spain case, and if the URLs are irrelevant to you, if they are outdated and have been published for far longer than is necessary, or if there is another good reason why they should be removed, the URLs should be blocked from a search of your name. The underlying material would not be removed, but a successful application means that the unwanted material would not appear online when your name was searched.

Are there exceptions to the right to be forgotten?

The right to be forgotten is not an absolutely fundamental right and it is possible that a request for the erasure of your data, or to have results blocked from a search of your name, could be refused. If an internet search engine believes the material you are trying to block is being processed in the public interest, they are likely to reject your application for the right to be forgotten. If you are exercising your right to be forgotten to persuade an organisation to delete data about you, there are a number of exceptions that they can rely on if they want to refuse your request:

Typically, an organisation might say that they have a right to freedom of expression, which trumps your right to be forgotten.
In other cases, they may say that they are obliged by statute to process your data
Alternatively the data processor may have no choice but to hold and process your data.
If your data relates to a legal claim, it is also likely to fall under one of the exceptions to the right to be forgotten.

Each case and each request would be decided on its own facts, but there are indeed exceptions to the right to be forgotten.

Does the UK have the right to be forgotten?

The right to be forgotten applies in the UK. If an application to an internet search engine is successful, it means that unwanted search results would be blocked from results which appear in searches throughout the EU. The English court extended the right to be forgotten criteria in recent years, to provide that where someone has led a blameless life, with no cautions or convictions (other than the caution or conviction which is reported in the material they are seeking to remove) that should be taken into consideration by search engines dealing with applications for the right to be forgotten. The right to be forgotten would not apply to searches carried out in the USA or Australia for example, as they are not subject to the decision of the European Court of Justice in the Google v Spain matter, nor are they bound by the terms of the GDPR. In the UK, organisations are now well-used to handling applications for the erasure of data from individuals wishing to exercise their right to be forgotten. In many cases, applications will be approved swiftly, but in others, one or more of the exceptions to the right to be forgotten will apply and the application will not be approved.

What is the EU right to be forgotten law?

Article 17 of the General Data Protection Regulations contains the EU’s right to be forgotten. This gives individuals the right to request the deletion of any data about them which is held or processed by any organisation. If there is no real reason why the organisation needs to hold on to the data, and if none of the exceptions to the right to be forgotten which are permitted by the GDPR apply, the right to be forgotten should be granted. Even though the UK is no longer part of the EU, the GDPR still applies, and individuals still have the right to be forgotten.

Why we need the right to be forgotten?

We need the right to be forgotten as people have the right to move on if they have paid their debt to society, after making mistakes in the past. The right to be forgotten is therefore an important right in the modern age, where data and information can remain available online forever if it is not removed, which simply would not have been the case in the past. People also have the right to control information about themselves, as information has become a very valuable asset, and databases of names and addresses, and other information, are regularly traded between organisations. Individuals are entitled to ask organisations who hold and process information about them, to permanently delete that data. If there is no reason for the organisation to keep the data, and if none of the exceptions about data processing apply, the data should be deleted within a month.