The internet is forever, and your personal information is all over it. Try googling your name and see what information comes up. How much of that data is outdated and/or no longer true? If you’re in the European Union, at some point you’ve probably seen the phrase “Some results may have been removed under data protection law in Europe” pop up on Google.
In a landmark case regarding data privacy, you may have the right to be forgotten (also known as the right to erasure). This means you can have certain results removed from Google and other search engines if you meet the specific criteria. Here’s a guide to how you can take advantage of this law.
Before we dive into how you can remove your personal information from searches on the internet, it’s important to get an understanding of what the rules are. First of all, it is important to note that for now this right only applies to European citizens/residents and only applies to search results in Europe as decided by the European Union’s Court of Justice. The decision to limit the location of search results was only made a couple of months ago, so there is still a chance that it may expand to the rest of the world in time.
The right to be forgotten came into effect as part of the General Data Protection Regulation (GDPR) in May 2018, however it actually began four years earlier. In 2014, Mario Costeja Gonzalez took Google to court and won. In the late 1990s, Gonzalez was in the midst of bankruptcy and had to auction his property. At the time, the auction was announced in the local newspaper.
By 2014, Gonzalez no longer had financial problems, but if you searched his name on Google, the newspaper article covering the property auction was the first result. Gonzalez argued that this information was no longer relevant, he had done nothing illegal and that it was harming his reputation, and the EU courts agreed. Ironically, there are now hundreds of search results for his name thanks to the case. However, Gonzalez’s case set an important precedent for individual privacy laws.
In the GDPR, the right to be forgotten is outlined in Article 17 as: ““The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”
To break down all of that legal jargon, if you meet a certain set of circumstances then you can request that Google and other search engines remove search results that involve your personal information.
Naturally, not all types of data are included in the right to be forgotten. There are several conditions, but you only need to meet one to qualify.
The conditions are the following:
That being said, there are a number of conditions that override your right to be forgotten. They are the following:
As you can see, there are several ways the right to be forgotten can be negated. Many people wrongfully believe that they can get any search result removed simply because they don’t like it or it’s slightly embarrassing. For example, a business won’t be able to remove a bad review because that is not personal data. The same applies for if you run a business under your actual name. If you hold a political office, your personal information will probably stay up because it’s in the public interest.
If you aren’t sure if you meet the criteria for removal, you can still try asking Google to take down the search results you want removed. If you want a result removed and Google does not take it down, it may be worth your time to consult a lawyer to figure out if you are eligible in the first place. Remember, this is only for search results in the EU, so search results elsewhere will remain the same.
The first step is to identify the information that you want taken down. This requires finding the specific website address (URL) that shows up with your information. Google recommends that you contact the website with your personal information on it directly, as removing search results is not the same as the data actually being deleted. If you aren’t sure how to contact the webmaster, Google has a handy tutorial.
Next, you need to go to this Google page. You will be prompted to fill in a few answers as to where you want the data removed from and why you want it removed. Note that you will need to fill out separate requests for each type of search result (such as a web result, image result, et cetera). You will need to select that you want to remove your personal information from Google’s search results. Don’t worry, one of the reasons for removal is because of European data protection laws.
The next step is to fill out the provided form. You will need to provide personal information including your name, country of origin, and a copy of an identifying document like a passport or driver’s license. You will also need to outline specifically what search results you want removed (including URLs) and the search term used to find these results. Note that you also need to provide a reason for removal. We recommend that you be as precise as possible and tie your reasoning back into the qualifications we mentioned above.
From there, you will need to wait to hear what Google’s verdict is. The process to remove data is done manually and hundreds of thousands of requests are submitted every year, so it could take some time. It’s important to remember that Google is most likely operating under its own best interest here, so unless you have a really good reason and/or are willing to escalate things further if your case is rejected, Google might just say no. So far, Google has been quite transparent with its processes and have an ongoing transparency report.
If you decide to fight Google’s ruling, your case will be passed on to your local data protection authority. This could take a long time, and it may be a good idea to employ a lawyer at this point.
To date, 43% of requests have been removed, so you have an okay chance of having your information removed. It’s important to remember that this is just the process for Google; other search engines like DuckDuckGo do not offer data removal on the basis of GDPR.
If you truly feel that there are search results about you that contain irrelevant or damaging information that fall within the constraints of the GDPR, we do recommend that you ask for those results to be removed. However, because it only removes search results from Google in the EU, it may not be that useful to you if you work/live in multiple countries.
In any case, if you are serious about pursuing your case to the very end, seeking advice from a lawyer may be worth your time. Be sure that you are working with someone who fully understands the GDPR, especially Article 17.
The right to be forgotten is an important landmark for personal data protection, but it still has a long way to go to be truly effective. It will be interesting to see if other countries follow suit and create similar laws to the GDPR, and how Google reacts.
