Removing your information from Google search results: what is the “right to be forgotten”?

1. What is the right to be forgotten?

The right to be forgotten allows you to compel a search engine like Google, Bing or Yahoo to de-list website links (URLs) from search results for your own name, where the information contained in those URLs is irrelevant, outdated, inaccurate or otherwise unlawful, as specified in full in Article 17(1) GDPR. Usually, the older and less relevant to others the information is deemed to be, the more likely you are to succeed in having it removed. There are a number of circumstances in which the right to be forgotten does not apply, as discussed below.

It is important to remember that a successful right to be forgotten request will result in the negative URLs no longer appearing in Google search results for your name, but will not remove the articles from the web entirely. This means that the damaging information can still be found by individuals who use other search terms or who visit the publisher's website. For this reason, where highly defamatory and/or false content has been published, the best option is still to remove it at source. However, where this is not possible (such as where the story has gone viral or is being published in jurisdictions where defamation law is ineffective) the right to be forgotten can prove extremely useful and cost-effective.

While this article is focused on search results, the right to be forgotten also applies to material published elsewhere such as in newspapers and on KYC databases (including World-Check). In these circumstances there will be different factors to consider, which we will discuss in future updates.

2. When does the right to be forgotten apply?

The right to be forgotten is not absolute. There are a number of qualifications and exemptions in both the GDPR and (for those in the UK) the Data Protection Act 2018, which specify the circumstances in which search engines can continue to process your information and produce search results.

The right to be forgotten is balanced against a search engine's legitimate interest in processing data lawfully and the right to freedom of expression (which includes the public's right to publish and receive information). This means that where a search engine can demonstrate that on balance, there is a public interest in the information continuing to be available through a Google search, the information still has some relevance (for example to your professional activities or public profile) or there is another legitimate reason to continue processing (such as compliance with a legal obligation), they can lawfully deny your request. Examples might include where the information is a matter of public record (such as government documents) or where there is a potential risk to the public if the information is not available.

You do not need to show you have suffered harm to make a right to be forgotten request, but evidence of harm may help to demonstrate that on balance, any legitimate interest claimed by the search engine should not override your right to have the search results removed. By law, search engines must respond to your request within one month either confirming they will not take action or letting you know what action will be taken. This may be extended to two months where the request is complex. Unfortunately, search engines often take significantly longer as they are inundated with requests. It is therefore important to seek legal advice as soon as you become aware of the information being available online.

3. Who can make a right to be forgotten request?

The GDPR applies to all data processing by organisations operating within the EU (and the UK during the transition period), as well as to organisations offering goods or services to individuals in the EU, even where the data subject is resident elsewhere. This means that anyone can request the removal of their personal data from European search results (see below), regardless of their nationality or residence. In practice this can be hard to achieve because search engines typically require proof of European citizenship or residence in order to submit a right to be forgotten request through their online forms. While this can (and should) be disputed, it does mean that the process can be slower and more frustrating for individuals outside Europe.

4. Are search results blocked worldwide?

Last year Google won a high-profile case against the French data protection authority that confirms the limited scope of the right to be forgotten. Whereas previously, there was some debate about whether URLs should be blocked from search results worldwide, in Google v CNIL [2] the Court of Justice of the European Union (CJEU) confirmed that Google does not have to remove URLs from global search results. This was widely seen as a major victory for Google and other search engines.

However, the CJEU also confirmed that search engines must remove URLs from all European versions of their search engine as well as putting in place measures "which effectively prevent, or at the very least, seriously discourage" internet users in Europe from using non-European versions of their search engine. This should mean that the negative search results are not accessible from a search engine within Europe. For example, you may notice that if you try to access "Google.com" from your UK browser, you will automatically be directed to a UK version. The CJEU's decision does little to protect individuals with a significant reputation outside of Europe. It also does little to stop those who are willing to go the extra mile to uncover the negative information such as journalists, who can opt for non-European versions of Google when researching a story. In general, however, most people will not go to such efforts for the purposes of conducting a Google search. This means that for individuals who mainly operate within Europe, a right to be forgotten request is still likely to be effective.

[2] Google LLC v Commision nationale de l'informatique et des libertés (CNIL) (C-507/17)

5. Does the right to be forgotten apply to my individual circumstances?

Determining how the right to be forgotten applies to individual circumstances is difficult. There are rare instances where the information being published is completely false or manifestly private. In these circumstances, it would be difficult for a search engine to justify making the search results available. In most cases, however, the information being complained about is partially or wholly true and was published lawfully. As a result, a careful balancing exercise must take place between the rights of the individual making the request, the search engine's legitimate interest in processing the data, and the public's right to freedom of expression.

Google summarises its approach as follows:

"we will balance the privacy rights of the individual concerned with the interest of the general public in having access to the information, as well as the right of others to distribute the information. For example, we may decline to remove certain information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials."

In 2018 two high-profile cases went before the High Court which provide additional guidance on how the right to be forgotten should be applied: NT1 & NT2 v Google LLC [2018] EWHC 799. Both NT1 and NT2 (whose identities were anonymised) sued Google after it refused to remove information about their spent convictions from search results. In both cases, the court balanced the individuals' rights to have damaging personal data removed against Google's legitimate interest in processing their personal data. Factors the court considered included:

• the role of both NT1 and NT2 in public life;
• the accuracy, relevance and sensitivity of the data;
• the severity of the offences committed;
• the harm caused to NT1 and NT2 by the availability of the search results; and
• the extent to which the availability of the search results was still in the public interest.

Although these cases were decided just before the GDPR came into force, there is no reason to believe the factors considered will be affected.

Only NT2 succeeded against Google. He had been convicted of a lesser offence, had pleaded guilty and had expressed remorse for his actions. The judge took the view that NT2's crime (for which he received a six-month sentence) had no continued relevance to his professional life. He also had young children who were likely to be affected by the search results. Taking all these factors into account, the judge accepted that the availability of information about NT2's conviction in Google search results could not be justified.

In contrast, NT1 had been convicted of a more serious dishonesty offence with a four-year sentence. The judge found that he had not fully accepted responsibility and he had also published material which claimed he was a successful businessman of integrity. NT1 had later been prosecuted for a second dishonesty offence and had been involved in several civil claims. The judge found that information about NT1's spent conviction therefore remained relevant to his professional life and was in the public interest. As a result, Google's legitimate interest in processing NT1's personal data outweighed his right to be forgotten. NT1 appealed this ruling, but settled with Google prior to the appeal hearing.

As the above cases demonstrate, the success of a right to be forgotten request depends heavily on individual circumstances, including the type of information to be removed, the conduct of the person making the request and whether the information is still relevant. Clearly, there is no one-size-fits-all approach. For anyone seeking to make a removal request to search engines, it is therefore important to seek guidance on how the right to be forgotten applies to your circumstances as soon as you become aware of the information being online. This will help to ensure you do not take any action which will undermine your case (such as the steps taken by NT1, which ultimately worked against him), as well as increasing the likelihood of a successful application by focusing your removal request on the relevant factors.