Google’s right to be forgotten: how does it work?

What is the right to be forgotten, and how does it work? Here is the full picture.

On 13 May 2014, the Court of Justice of the European Union (the CJEU) recognized every individual’s right to ask for the de-indexing of links that lead to pages mentioning their personal data. To comply with that European ruling, Google set up a procedure that lets individuals request the removal of content directly.

What is the right to be forgotten on the internet?

The right to be forgotten is a right aimed at removing personal information published online that harms a person.

More precisely, there are three types of right to be forgotten:

• The right to object applies when a person’s personal data is used unlawfully. It also applies if that person considers the information about them useless relative to the reasons it was published.

• The right to erasure covers personal data accumulated by websites. It is an individual’s right to ask site owners to delete the URLs of posts and articles that mention them. It also covers photos, videos, and any other content that harms them. Digital media beyond the web are covered too. Article 17 of Regulation 2016/679 of the European Parliament sets out the grounds for this right.

• De-referencing comes into play when Google, Yahoo, and other search engines index an individual’s personal information. In that case, the person can assert their right to be forgotten on the search results in order to remove their name and details from Google’s catalogs. After a search, that removal leaves URLs pointing to empty pages.

The right to be forgotten around the world

After the CJEU decision of 29 May 2014, the American company received more than 70,000 right-to-be-forgotten requests in the United Kingdom alone. The European court also puts individuals’ right to privacy ahead of search engines’ freedom.

The company’s CEO criticized the ruling, citing the collision between the right to be forgotten and the right to information. The decision also requires the search engine to remove links that point to outdated and inaccurate information, including information that is in the public interest. When it processes user requests, the company therefore sorts justified claims from abusive ones.

The appearance of the right to be forgotten prompted many reactions around the world. In Germany, numerous requests were filed, including one from an academic who asked for the removal of four press articles showing old photographs of him. The person had changed sex and name and no longer wanted to be identified by the former name. The company rejected the request because the material remained relevant to professional life and scientific research. In Hungary, Google refused to remove articles about a senior official’s criminal conviction. In Italy, Google granted a woman’s request to remove an old article that mentioned her husband’s murder and included her name. By contrast, the company refused to remove articles about a businessman’s lawsuit against a newspaper in Poland. Each case is reviewed carefully, according to how relevant the request is.

Google’s right to be forgotten: privacy versus freedom of expression

The Court of Justice of the European Union (CJEU) requires Google to comply with the right to be forgotten. Since that ruling, two camps have emerged: those who favor privacy, and those who favor freedom of expression.

Supporters of the right to privacy argue that Google must erase from its database the links that point to pages whose content is useless and compromising for the people concerned. Supporters of freedom of expression, especially the media, treat this right of erasure as a form of censorship.

That is why Google decided to review European requests gradually, looking for middle ground between the two sides. The internet giant has therefore had to set aside about half of users’ requests. That rejection has in turn fed discontent among privacy advocates.

Google’s right to be forgotten: how does it work?

The right to be forgotten established by the CJEU requires Google and its subsidiaries to erase and de-reference from their SERP data that is harmful to a natural person’s private life. The rule still applies even when the content is lawful. Hyperlinks used to rank dubious pages must be excluded from indexing robots.

The aim of this legislation is to protect the reputation of people who are subject to defamation. CNIL (France’s data-protection authority) wants this new legislation to be applied properly. It therefore issued a list of criteria for search engines that handle the right to be forgotten and de-referencing. Those criteria cover the authenticity of the published data, the status of the complainant, the purpose of the publication, the date of publication, and the context in which it was circulated.

To get a green light from the company, requests go through an evaluation. The request must point to content that is obsolete, defamatory, inaccurate, or out of date. By contrast, information that is in the public interest (professional negligence, fraud, a criminal conviction, and so on) stays in Google’s index. De-referencing has been limited to the European area. Google has stressed that the CJEU decision applies only to European countries.

The steps to file a right-to-be-forgotten request all happen online. The applicant starts by filling in the content removal request form on the web. They enter their first and last name and their email address. Then they give the URL of the page they want excluded from the index. The applicant also explains the reasons for the request. They attach a copy of an identity document. Finally, the request is signed electronically by typing their name. Processing times vary.

How does Google actually handle the right to be forgotten?

Requests sent to Google are handled by a European supervisory group known as “Article 29”. Professor Luciano Floridi is responsible for collecting the requests received and assessing how the company operates relative to the rulings of the European Union’s courts.

Because of its standing on the web, the internet giant has to juggle its duty to respect privacy with its reputation as a source of online information and content. Google’s communications director has said that the CJEU decision requires them to comply with the right to be forgotten. The company stays within the court’s requirements while also referring to what users expect when information is published.

After a right-to-be-forgotten request, Google can give you 3 different answers. It may accept the request outright. In that case, it tells you that your URLs will be de-indexed within a few hours. It may refuse. In that case, it relies on one of 11 grounds for refusal, the most common being “Relates to your professional life”. Or Google may ask you for more detail before giving a final answer.

The case of Mario Costeja González

Mario Costeja González is a 58-year-old judicial expert. He has become a legend on the web because he is the forerunner of the right to be forgotten. The case began after a complaint by Mr. Costeja in 2010 against La Vanguardia, an online press publisher, as well as Google Spain and Google Inc. Typing the then-fifty-year-old’s name into the search engine led to that newspaper. It mentioned an auction related to a seizure for the recovery of his social-security debts.

Costeja believed this information harmed his right to personal-data protection. He therefore asked Google Spain and Google Inc. to remove the data. After they refused, the complainant turned to the AEPD (the Spanish Data Protection Agency). The case then went before the Spanish courts and later the CJEU. The court sided with the judicial expert, stressing individuals’ rights relative to search engines.