The Right to be Forgotten

The so-called ‘right to be forgotten’ — which is perhaps better described as ‘the right to erasure’ or ‘the right to be de-listed’ — entails a right to request commercial search engines, such as Google, to remove links to private information when asked.  The right to be forgotten progresses from the idea that the right to private life includes a right for past information about oneself, where there is no public interest in accessing, not to be profiled prominently on search results, even though the information will normally remain available on the websites where it is being held.

The leading case on this was decided in 2014, when the Court of Justice of the European Union (CJEU) handed down its ruling in the case of Google Spain v Gonzalez.(1) Mr Gonzalez, a Spanish national, lodged a complaint in 2010 with the Spanish information regulator.  The cause of Mr Gonzalez’s complaint was that, when an internet user entered his name into Google’s search engine, the user would obtain links to pages of a Spanish newspaper from 1998 referring to attachment proceedings against him for the recovery of certain debts.  Mr Gonzalez requested that the personal data relating to him be removed or concealed because the proceedings against him had been fully resolved and the reference to him was therefore now prejudicial.

The CJEU upheld the claim, relying on the EU data protection law in effect at the time.  The CJEU noted that the very display of personal information on a search results page constitutes processing of such information,(2) and there was no reason why a search engine should not be subject to the obligations and guarantees laid out under the law.(3) Further, it was noted that the processing of personal information carried out by a search engine could significantly affect the fundamental rights to privacy and to the protection of personal data when a search is carried out using a person’s name, as it enables any internet user to obtain a structured overview of information relating to that individual and establish a profile of the person.(4) According to the CJEU, the effect of the interference “is heightened taking into account the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.”(5)

The CJEU went on to hold that a data subject is permitted to request that information about him or her no longer be included in a list of search results where, having regard to all the circumstances, the information appears to be inadequate, irrelevant or no longer relevant, or excessive in relation to purposes of the processing carried out by the operator of the search engine, taking into account the public interest in accessing it.(6) In such circumstances, the information should be delinked from search engine results.(7)

The right to be forgotten has also been recognised in domestic contexts.  For instance, Italy’s Supreme Court of Cassation has held that the public interest in an article diminished after two and a half years, and that sensitive private information should not be available to the public indefinitely.(8) The case was brought before the European Court of Human Rights, which found the restriction on freedom of expression to be justifiable after declining to interfere with Italy’s Supreme Court of Cassation’s balancing of this right with the right to respect for one’s private life.(9) The Belgian Court of Cassation has also recognised the right to be forgotten.(10)

There are, however, limits to the ambit of the right to be forgotten.  In 2017, the CJEU was seized with a request for a preliminary ruling in the case of Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni.(11) Mr Manni, relying on the Gonzalez decision, sought an order requiring the Chamber of Commerce to erase, anonymise or block any data in the register of companies linking him to the liquidation of his company.  The CJEU declined to uphold Mr Manni’s request and held that in light of the range of possible legitimate uses of data in companies registers and the different limitation periods applicable to such records, it was impossible to identify a suitable maximum retention period.  Accordingly, the CJEU declined to find that there is a general right to be forgotten from public company registers.

Furthermore, other jurisdictions have refused to uphold a right to be forgotten vis-à-vis search engines.  In Brazil, for example, it was held that search engines cannot be compelled to remove search results relating to a specific term or expression;(12) similarly, the Supreme Court of Japan declined to enforce the right to be forgotten against Google, finding that deletion “can be allowed only when the value of privacy protection significantly outweighs that of information disclosure”.(13)

In India, the law on the right to be forgotten remains unsettled. Certain judicial decisions have given effect to the right to be forgotten as a corollary of the right to privacy. For example, the Orissa High Court of the state of Odisha(14) and the High Court of Kerala(15) both found that survivors of sexual violence have a right to have certain online information removed (in the former case non-consensual images in the form of uploaded videos and photos and in the latter case identifying information in a judgment). In 2021, the High Court of Delhi issued an order to block search results for a judgment posted online relating a charge of which the petitioner had been acquitted.(16) In contrast, in 2017, the High Court of Gujarat rejected a similar petition for the removal of a judgment.(17) To date, India continues to lack a comprehensive legislative framework governing the right to be forgotten, although proposed legislation in the form of the Personal Data Protection Bill, first introduced in 2019, includes provisions codifying this right.(18)

According to Article 19’s Global Principles of Freedom of Expression and Privacy (Global Principles),(19) the right — to the extent that it is recognised in a particular jurisdiction — should be limited to the “right of individuals to request search engines to delist inaccurate or out-of-date search results produced on the basis of a search for their name.”(20) It states further that de-listing requests should be “subject to ultimate adjudication by a court or independent adjudicatory body with relevant expertise in freedom of expression and data protection law.”(21)