Right to be forgotten

The right to be forgotten is a relatively recent and emerging legal concept with great implications for Internet policies, freedom of expression, and privacy. If you live in a country that applies the right to be forgotten, you have the right to request the removal of certain web addresses from search engine results (also called delisting) or the deletion of certain personal data that you do not want search engines to process anymore.

 

The right to be forgotten

The right to be forgotten is still very much debated at the global level, partly due to conflicts in its interpretation, as well as to practical issues regarding its implementation.

The right to be forgotten first derives from the right to erasure, a long-standing principle in European data protection laws. Since the 1995 EU Directive on Data Protection, individuals have been granted the right to have all personal data related to them deleted when they leave a service or close an account. But the interpretation of the right to be forgotten has been extended in the wake of a landmark ruling by the Court of Justice of the European Union (CJEU) in 2014. In the Google Spain case, the CJEU ruled that, deriving from their right to erasure, individuals have a right to delisting. This means that they can request that the search engines delist certain links from their search index, if the results contain personal information that is ‘inadequate, irrelevant, or no longer relevant, or excessive’.

This ruling has raised a number of concerns, in particular regarding its practical implementation by search engines. In 2015, Google had set up an advisory council on the right to be forgotten to develop recommendations for ‘performing the balancing act between an individual’s right to privacy and the public’s interest in access to information’. In February 2018, Google announced that it had received 2.4 million requests for delisting URLs from Google searches since 2014, illustrating the great challenges faced by the company in order to comply with the CJEU ruling.

Following the 2014 ruling of the CJEU, the right to be forgotten has been incorporated in the newly adopted EU General Data Protection Regulation (GDPR), and has increasingly been gaining ground worldwide.
From India to Brazil, and from Japan to Canada, the right to be forgotten has raised both significant interest and concern from courts, policymakers, companies, and civil society, as differing global positions regarding this emerging right remain.

Critics of the right to be forgotten argue that it could lead to the widespread removal of online content, and thus harm the freedom of expression and other human rights. For instance, though it supports the right to erasure, Access Now strongly opposes establishing a right to delist or a right to obscurity, because ‘if misinterpreted or implemented the wrong way — particularly in the absence of a comprehensive data protection law and with inadequate transparency — it poses a significant threat to human rights’.

Proponents of the right to be forgotten, and in particular of the right to delist, instead argue that the continuing availability of certain personal information can cause serious injustice to individuals, without any public interest in having such information available. The French data protection authority (CNIL) for instance, has been among the leading voices in favour of a global right to delist.

In 2019, in a landmark ruling, the CJEU decided as part of the Google v CNIL case that the territorial scope of the right to be forgotten and the obligation to delist under EU law (GDPR) only applies to the territory of the EU.

The map below shows which countries have implemented the right to be forgotten. This visualisation is based on data from several sources, such as the CJEU, government websites, and various online media sources.