Back to topics

Right to Be Forgotten

May 14, 2018

The expression "right to be forgotten" has been used to label a broad range of very different legal issues, from privacy claims requesting broadcasters and newspapers to remove news from digital archives, to data protection claims requesting Internet search engines to delist results of queries based on a person's name.

If the idea of a right to be forgotten is not entirely new, the topic came to global importance after a 2014 decision of the Court of Justice of the EU. In Google Spain v. Agencia Española de Protección de Datos & Mario Costeja González, the Court affirmed that search engines should be considered data controllers, as defined by the EU's 1995 Data Protection Directive. As controllers, they were obliged to stop some links from appearing, upon the request of an individual, in the web search results when users query for the individual's name.

The decision said that the results should be removed if "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing" by the intermediary. In contrast, the results should not be delisted if there is a public interest in the access to the information for particular reasons, "such as the role played by the data subject in public life."

Since the CJEU decision, the debate on a right to be forgotten spread throughout the world, leading to decisions that are, both literally and figuratively, all over the map. The delisting procedures followed by intermediaries have also raised important concerns about freedom of expression. More recently, the transparency and procedural safeguards for affected webmasters and publishers (see Mexico’s appellate ruling involving Fortuna magazine, and the Spanish DPA’s ruling against Google), and the geographical scope of content delisting  (see the CNIL vs. Google France case) have been at the center of the debate.

Below, you can find the entries tagged as relevant to the Right to Be Forgotten in the WILMap database. Please let us know if you identify any important development that should be included.

 

Other Resources

For a general idea of the legal rationale of the CJEU at the Google Spain case, see The Shaky Ground of the Right to be Delisted, by Miquel Peguera.

Entries

Featured

Administrative Decision
France

Deliberation No. 2016-054, CNIL

According to the French Data Protection Authority (CNIL), by the date of this deliberation Google has processed approximately 80,000 requests of French citizens to delist specific results from its search engine (right to be forgotten requests). The decision affirms the company delisted 51,5% of the requests. To address the complaints of French citizens who had their requests refused, CNIL launched an investigation on the company. Following the assessment of the complaints, CNIL requested Google to delist several results. According to the authority, "it was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com ...). As the delistings were carried out in European extensions, and not in extensions such as google.com or other non-European...
Court Decision
European Union

Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González

European Court of Justice, C-131/12,
(1) ruling that "an internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.” Thus, under certain circumstances, search engines can be asked to remove links to webpages containing personal data. (see also CIS blog post) (2) On November 26, 2014, the Article 29 Data Protection Working Party issued the Guidelines on the Implementation of the CJEU Judgment on Google Spain v. Costeja, 14/EN WP 225, which are summarized in this CIS blog post.

Asia

Court Decision
Japan

Supreme Court (The Third Petty Bench), Heisei 28 (Kyo) No. 45 Google Inc. Case

On January 31, 2017, the Supreme Court of Japan issued a decision on a case filed by an individual residing in Japan against Google Inc. in the United States, demanding the deletion of links in Google's search results to webpages that refer to the individual's crime committed in 2011. The individual's demand was first examined by the Saitama District Court, which accepted the individual's claim specifically mentioning to the "right to be forgotten," and issued an order for Google Inc. to delete the links. Google Inc. appealed the case to the Tokyo High Court, which reversed the decision and dismissed the individual's claim. The individual then appealed the case to the Supreme Court. The Supreme Court stated in its decision that the search result is not only an automatic and mechanical listing of information that simply...

Europe

Policy Document
United Kingdom

Online Harms White Paper

This is a UK government White Paper, setting out the plans to provide for a major reform of the obligations of various online services towards illegal content and user safety. It is under consultation until the 1st of July 2019. The core of the new proposals is a novel, statutory duty of care, tied to tackling illegal content in an adequate and efficient manner, as well ensuring the safety of the service's users. This duty is to be placed on a wide category of entities - “companies that allow users to share or discover user-generated content or interact with each other online”. The exact content of the duty in question is not specified yet - this is to occur through a series of corresponding codes of practice. For now, the possible obligations include: operating specific notice & takedown procedures, with corresponding...
Court Decision
United Kingdom

NT1 & NT2 v Google LLC [2018] EWHC 799 (QB)

This is a key decision on the application of the CJEU judgement in Google Spain. The case combines two nominative deindexing claims against Google Search. The first one (NT1 - claimants were anonymised), was raised by a businessman who was convicted of conspiracy to falsely account in the late 90s. His conviction was spent in 2014, on the basis of the amended Rehabilitation of Offenders Act. Consequently, he requested that Google remove specific links leading to online sources reporting on his conviction. The second claimant (NT2) was also a businessman, who was convicted of using phone and telephone hacking to trace individuals seeking to disrupt his business. His conviction was spent in 2014 in a manner similar to NT1's, and he made a similar request to Google. Google refused to delist the search results in both...
Court Decision
France

Google Inc., no. 399922, Conseil d'Etat

This case refers to the geographical scope of delistings in "right to be forgotten" (droit au déréférencement) requests. Google filed a complaint on the Conseil d'Etat against the decision of CNIL to fine the company in the amount of 100,000 Euros for failing to comply with the commission letter of formal notice. On the letter, CNIL demanded Google to delist search results on all the extensions of domain name of its search engine (google.fr; google.uk; etc...). CNIL considered the measures took by the company insufficient to ensure the data protection rights of European citizens. In this decision, the Conseil d'Etat stayed the proceedings and referred three questions to the European Court of Justice (ECJ). The first question is if a search engine, when implementing the ECJ's Google Spain decision, must delist the...
Court Decision
Spain

Audiencia Nacional, Administrative Chamber, Google Inc v Spanish Data Protection Authority, May 11, 2017 (ES:AN:2017:2433)

The Spanish Data Protection Authority (AEDP) issued a decision ordering Google Inc to delist a search result pointing to negative comments about the professional conduct of a medical doctor; Google Inc appealed the decision to the Audiencia Nacional (AN); the AN found that the public interest should prevail so that potential patients of that doctor may know about the experiences and opinions of former patients; therefore, the AN reversed the AEDP decision]. [See more info, in Spanish, here.
Court Decision
France

Mme C, M. F, M. H, M. D, F, Conseil d'Etat

With this decision, the Conseil d'Etat refers to the ECJ questions about the implementation of the "right to be forgotten", based on four requests refused by Google, brought to CNIL and refused by the Commission, and then brought by the claimants to the Conseil. The Conseil d'Etat seeks clarification on the interpretation of the Google Spain about the obligations of a search engine to delist search results pointing to web pages that contain sensistive data - as defined in the EU Directive 95/46/EU (the Data Protection Directive)
Administrative Decision
Spain

Procedimiento Sancionador PS/00149/2016. Resolución R/02232/2016

In this administrative proceeding within the Spanish DPA (AEPD - Agencia Española de Protección de Datos), Google was fined in 150,000 Euros for communicating webmasters about the delisting of content based on data protection requests (Right to be Forgotten requests, based on the European and Spanish rights to cancellation and opposition). Building upon the guidelines issued by the Article 29 Working Party, the agency decided that a search engine does not have the legal obligation to inform webmasters and that the communication could render the request to be delisted inefficient, by allowing, among other things, the publisher to change the URL delisted or to create lists of URLs subject to de-indexed. When considering that Google would only inform that a URL was delisted based on the European data protection...
Court Decision
Belgium

Belgian Supreme Court, 29 April 2016, ref. C.15.0052.F

Nearly two years after the European Court of Justice has issued its famous judgment on the right to be forgotten, in its famous Google Spain Case, the Belgian Court of Cassation has for the first time decided itself on the matter (Cass. 29 April 2016, n° C.15.0052.F). On 29th April 2016, the Belgian Court decided that the right to privacy and right to be forgotten expressed by the claimant justify the limitation of the right to freedom of expression from the newspaper Le Soir. Therefore, Le Soir was ordered to remove the name of the applicant from the archives section of its printed newspaper. According to the Court, the right to be forgotten is a component of the right of personal privacy (Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms). The protection of the right to privacy...
Court Decision
Spain

Supreme Court, Civil Chamber, An individual v Google Spain, 210/2016

Holding Google Spain SL liable for damages for failing to remove links to personal information after a “right to be forgotten” request by the claimant; damages were awarded following art. 19 of the Spanish Data Protection Law, which implements art. 23 of the Data Protection Directive (95/46) that orders Member States to “provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.”; the court rejected the defendant’s contention that Google Spain – the local subsidiary – is not the data controller and thus lacks standing; however, in other cases, another Chamber of the court concedes Google Spain’s lack of standing...
Administrative Decision
France

Deliberation No. 2016-054, CNIL

According to the French Data Protection Authority (CNIL), by the date of this deliberation Google has processed approximately 80,000 requests of French citizens to delist specific results from its search engine (right to be forgotten requests). The decision affirms the company delisted 51,5% of the requests. To address the complaints of French citizens who had their requests refused, CNIL launched an investigation on the company. Following the assessment of the complaints, CNIL requested Google to delist several results. According to the authority, "it was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com ...). As the delistings were carried out in European extensions, and not in extensions such as google.com or other non-European...
Legislation
Russia

Federal Law No. 264-FZ, Amending the Federal Law “On Information, Information Technologies, and Information Protection” and Articles 29 and 402 of the Civil Procedural Code of the Russian Federation (aka Right to be Forgotten Law), July 13, 2015

Russian RTBF law
(1) The law imposes an obligation on search engines that disseminate advertisements targeted at consumers located in Russia to remove search results listing information on individuals where such information is unlawfully disseminated, untrustworthy, outdated, or irrelevant.
Court Decision
Germany

Landgericht Heidelberg [District Court of Heidelberg], Civil, 2 O 162/13

The Court to decide whether Google had to remove links to a web page which claimed to “expose” racists, i.e. the plaintiffs. The Court ordered Google to remove the links and awarded damages for the company's failure to remove the links promptly upon notification. The damages occurred because the plaintiff had been laid off after his employer had taken notice of the search results. Apart from that, the Court follows Bundesgerichtshof Federal Court of Justice of Germany, Sixth Civil Section, Google Autocomplete, VI ZR 269/12, May 14, 2013 (see above). Furthermore, The Court specifically referred to the Google Spain ruling of the European Court of Justice in its reasoning.
Court Decision
France

X v. Google Inc, T.C. (Commercial Court) Paris

Google is subject to data protection law (loi informatique et liberte) and liable for breaching it when kept in Google suggest tools, personal information about art dealer (criminal charges for past activity) when the ex-convicted art dealer had asked Google to delete such information and showed that he had a legitimate reason to do so (breach to image and reputation, right to be forgotten).
Administrative Decision
Italy

Privacy Authority ("Garante") Decision about “The Right to be Forgotten”: Obsolete Information Found in Online Archives of Newspapers through Search Engines, doc. web n. 1583162, December 11, 2008

The claimant was seeking to remove an article concerning an investigation about him dated 1993. The claimant was later found innocent in connection with the investigation described in the article. The articles were still available online. The Privacy Authority rejected the complaint against Google for lack of jurisdiction because the “data processing” through cache copies does not take place in Italy nor in any European country.

North America

Other
Canada

Reference Re PIPEDA (Court File No.: T-1779-18)

In 2017, Office of the Privacy Commissioner of Canada received a complaint claiming that Google violated the Personal Information Protection and Electronic Documents Act (“PIPEDA”) by showing outdated, inaccurate, and sensitive information about the complainant when individuals search for his name. He thus sought de-indexing as a remedy. Google refused, arguing that it was not subject to PIPEDA when processing search queries relating to an individual’s name. PIPEDA applies to organizations which ‘collect, use or disclose’ personal information ‘in the course of commercial activities’ (s. 4[1][a]). Collection, use or disclosure for ‘journalistic, artistic or literary purposes’ are not subject to the federal privacy law (s. 4[2][c]). As a preliminary matter, the Privacy Commissioner has referred elements of the complaint...
Proposed Law
Canada

Consultation on "Right to Be Forgotten" Under Canadian Privacy Law

The Privacy Commissioner of Canada has released a draft report, proposing that Canada's existing law be interpreted in line with the Court of Justice of the European Union's Google Spain case. The draft report concludes that the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes a right for individuals to require search engines to de-index results from search results for that person’s name if they link to information that is inaccurate, incomplete, or outdated. Search engines are to remove or demote search results identified by such individuals if appropriate, and the individuals may lodge complaints with the Commissioner for non-compliance. The proposal would be explicitly limited in geographic scope. It would require search engines to use geo-blocking to limit Canadians' access to the...
Court Decision
Mexico

La Fortuna v. INAI

Expediente Auxiliar 355/2016
In Mexico, the data protection authority responsible both for the access to information and data protection (INAI – Instituto Nacional de Transparencia, Acceso a la Informacion y Protección de Datos Personales) ordered Google Mexico to delist 3 URLs when queries were made using the claimant’s name, in one of the first “right to be forgotten” cases of the country. Citing extensively the Google Spain case, the Mexican DPA affirmed that: Google Mexico was under the jurisdiction of the Mexican DPA; Google Mexico was a data controller in the terms of Mexican Data Protection Law; Google Mexico failed to respond to the requests made by the data subject (based on the right to oppose and the right to cancel the processing of data); The issue was brought to court by the original publisher (magazine La Fortuna), represented by...
Court Decision
Mexico

Séptimo Tribunal Colegiado de Circuito del Centro Auxiliar de la Primera Región, Amparo en Revisión 72/2012, August, 2016.

Séptimo Tribunal Colegiado de Circuito del Centro Auxiliar de la Primera Región, Amparo en Revisión 72/2012, August, 2016. After the Mexican National Institute for the Access to Information (INAI) recognized a "right to be forgotten" in the administrative procedure PPD.0094/2015 (see below), ordering Google Mexico to delist specific URLs, one of the publishers that had their content delisted brought the case to the Mexican courts. In second instance, the court affirmed that the INAI decision affected the ability of the publisher to disseminate information and that the publisher should have been heard in the administrative procedure. The court struck down the decision of INAI and determined that the publisher should be included in the procedure. For more information, see R3D website (in Spanish).
Administrative Decision
Mexico

National Institute for the Access to Information (INAI), Carlos Sánchez de la Peña v. Google México, S. de R.L., PPD.0094/14

(1) The Mexican National Institute for the Access to Information (INAI) ruled in favor of a transportation magnate, Carlos Sánchez de la Peña, who wanted three links removed from Google search results. The links contained negative comments about the business dealings of Mr. Sánchez’s family—including a government bailout of bad loans. The INAI heard the case after Google Mexico rejected a petition from Mr. Sánchez de la Peña to have the links removed. (2) In his request to INAI, Mr. Sánchez claimed that the three Google links distorted and decontextualized information about his activities as an entrepreneur. Mr. Sánchez de la Peña’s family has owned “Estrella Blanca” bus lines for generations. One of the links directed to an article about a lawsuit against Mr. Sánchez’s father, Salvador Sánchez Alcántara, by...

South America

Court Decision
Brazil

Supreme Court. Nelson Curi (and others) x Globo [Decision Pending]

(ARE 833.248 RG/RJ)
The main Right to be Forgotten case, currently in debate in the Brazilian Supremo Tribunal Federal, is the litigation between Nelson Curi and the major broadcaster in the country, Rede Globo. Although the case does not involve an internet intermediary, it is extremely relevant as it may set a basis for the recognition of a “right to be forgotten” in the country against traditional media companies, with possible consequences to search engines and internet intermediaries. In this case, the family of Aida Curi (Nelson Curi and others) filed a lawsuit against the broadcaster claiming damages for the airing of TV program about a crime (the homicide of Aida Curi) which occurred many decades before. The plaintiffs claim that the continuous exposure of the case forces them to remember painful facts, and they seek payment of...
Court Decision
Brazil

Jose Eduardo Tarraf Filho v. Globo Comunicação e Participações S.A. e outro

The Plaintiff requested the removal of a publication available on the defendant’s websites informing about him being kidnapped in 1990. This old piece of information was only recently republished. The judge ruled that it was a mere reproduction of a journalistic case widely divulged at the time of the crime. Additionally, the publication focused on the 30th birthday of the television company and not the Plaintiff's case. Therefore, the Court did not enforce any right to be forgotten.
Court Decision
Brazil

Charles Berbare v. Google Brasil Internet Ltda.

São Paulo State Court
The Plaintiff requested the deletion of Google search results indexing old publications about his involvement in a flagrante arrest for alleged unauthorized practice of medicine. As the falsehood of the publication was not proved, the judge ruled that the publicity of the story should not be considered harmful to the Plaintiff’s honour and image. The delisting would have been contrary to the public right to access historical journalistic publications, hence the right to be forgotten has not been enforced. Additionally, the delisting of the search results does not prevent direct access to the origìnal source at the website where it is published.
Court Decision
Brazil

Gilberto Trama v. Google Brasil Internet Ltda e outras

The Plaintiff sought the delisting of search engines results mentioning his name as one involved with tax crimes committed by a mafia organization. As the Plaintiff did not present any evidence regarding the falsehood of the publications, the judge rejected the request. In this case, the Court noted that the collective and public right to access information should prevail over the individual right to be forgotten.
Court Decision
Brazil

Wilker Aparecido Mendes Fernandes v. Goshme Soluções para Internet Ltda.– ME e Google Brasil Internet Ltda.

The Plaintiff requested the suppression of information available on a legal website regarding a labor suit he filed. The website was listed on Google search. The Plaintiff alleged that the labor suit might have been a reason making hard for him to be hired by other companies. The judge considered that the publicity of decisions by the court is based on the principle of transparency. The interest in maintaining case-law registers and the publicity of the decisions shall prevail over the Plaintiff’s interests, once it does not affect his private life, honour, image or other personality rights. Hence, the judge did not apply he right to be forgotten.
Court Decision
Brazil

SMS v. Google

RECURSO ESPECIAL Nº 1.593.873 - SP Superior Court of Justice. Fourth Panel
The SMS v. Google case illustrates the confusions surrounding the expression “right to be forgotten”. Brought against the search engine Google Brasil, the action required the delisting of images of the plaintiff based on searches using her name. After the case was dismissed in the first instance, the State Court of São Paulo (2nd instance) affirmed that Google should not index the content because there was no public interest in accessing it and that it would violate the human dignity value. Google appealed, arguing that the plaintiff should indicate the specific URLs to be blocked, based on the Civil Rights Framework for the Internet requirement that court orders identify clearly the infringing content. In this case, the Court first affirmed that the decision appealed is based on a “right to be forgotten”, and defined...
Court Decision
Brazil

Roberto Borghette de Melo v. Google Brasil Internet Ltda.

The Plaintiff was the defendant in a criminal proceeding, in which he was found not guilty. The Plaintiff requested the delisting of this episode from Google search results. The judge stated that Google is a hosting provider, therefore cannot be censored. The judge took also into consideration the public character of the judicial proceeding to deny Plaintiff's right to be forgotten.
Court Decision
Brazil

Maria Helena Jurado Mellilo v. Google Internet Brasil Ltda.

The Plaintiff sought the delisting of her artistic name “Meg Mellilo” from the Google search results. The judge stated that the right to be forgotten was not applicable, since the Plaintiff on her own will always related her image to erotism and pornography. During the lawsuit she did not demonstrate to be concern about her privacy, which makes unjustified the request to hide past conducts that are still perfomed at present time.
Administrative Decision
Peru

Plaintiff X v. Google

DPA Procedure (Expediente 012-2015-PTT)
This case in Peru is about reports associating the plaintiff to criminal procedures from which he has been acquitted. After an initial ruling of the Peruvian DPA (Dirección General de Protección de Datos Personales) determining Google Peru must generally delist all content associating the plaintiff to the news related to the criminal matters mentioned in the complaint. Google appealed within the DPA’s administrative procedure. The Peruvian DPA upheld its initial ruling, but indicated precisely the 16 URLs that should be removed by the search engine. In the decision, the DPA asserted that: Google Peru was under jurisdiction of the Peruvian Law, and therefore, the Peruvian DPA; By indexing search results based on a name query, Google Peru was processing data and should thus be considered a data controller in the terms of...
Court Decision
Chile

Causa nº 22243/2015 (Apelación). Resolución nº 36142 of Corte Suprema

The main case to reach the Chilean Supreme Court and involving a so-called “right to be forgotten” was an action requesting Diario El Mercurio to delist from search engines content relating the plaintiff to crimes of child sexual abuse, that would impede the claimant’s reintegration and would bring him serious psychological harms, violating his constitutional right to psychological integrity (Art. 19, 1) and to private life and honor (art. 19, 4). Therefore, although requesting the publisher to delist the content from search engines, the case is not related to a data protection claim, but to the more traditional idea of rehabilitation or reintegration of the plaintiff to society, after having his name associated with a crime that took place more than 10 years before. In its reasoning, the court recognized the passing...
Court Decision
Brazil

Dulcimar Vilela de Queiroz v. Google Brasil Internet Ltda.

The Plaintiff requested Google to remove search results mentioning her earlier criminal conviction. The judge upheld the inviolability of private life and the right to be forgotten, noting that there was no current public interest in the information. In this regard, the court noted that criminal convictions should not continue to produce extrajudicial effects on individual rights after .
Court Decision
Brazil

Jurandir Gomes de França v. Globo (Candelaria Case)

Recurso Especial Nº 1.334.097-RJ Superior Court of Justice. Fourth Panel.
Although this case does not refer to internet intermediaries, the final decision will serve as an important background to understand the current debate on a “right to be forgotten” in Brazil. In this case (named Candelaria Case – Recurso Especial Nº 1.334.097-RJ), a man who was wrongly sentenced jail time (and later acquitted) based on accusations that he participated in a crime (the killing of eight homeless children and young men who lived near Candelaria Church in Rio de Janeiro downtown) sued the publisher of content (TV Globo) for damages. The rapporteur of the case explicitly affirms that his analysis is restricted to the publication of news at the television, and places the passage of time and the newsworthiness of the reporting at the core of the legal controversy. In the decision, the Court found that the...
Court Decision
Colombia

Constitutional Court, Gloria v. Casa Editorial El Tiempo, T-277/15

Stating that when there is a favorable outcome for an individual in a proceeding—in this case Gloria was acquitted from charges of human trafficking—there is an obligation to update the information and make the outdated information unavailable through searches; however, this obligation would apply only to media outlets—el Tiempo in this instance—which should ensure, using available Internet tools, that search engines would be unable to find the article, while ordering Google to block an article linking an individual to human trafficking would amount to a form of prior censorship.