The right to be forgotten, and how a request is actually made

Two different requests share the name, and mixing them up wastes months

The right to be forgotten is a nickname, and it covers two things that behave differently. The first is erasure by whoever holds the data: the shop, the employer, the forum, the social network. In UK law this is the right to erasure, and the regulator’s own summary is plain — “you can ask an organisation that holds data about you to delete that data. In some circumstances, they must then do so.”

The second is delisting by a search engine, and it is narrower than the name suggests. Google’s own description of the outcome: “We’ll only delist content from search results for queries related to your name. Content that we delist for your name may remain in our results for other queries.” The page stays online. What changes is one route to it.

The order follows from that, and the search engine says so itself: “removing material from the web can be more effective than removing it only from Google on searches for your name”. Where the material is something you published, that route is a setting rather than a legal request — which is what making a Facebook profile private and locking a Facebook profile are for.

How the request is actually made, which is less formal than it sounds

The most useful thing the ICO publishes is how little ceremony is required. A request can be made “verbally or in writing”, it can go to “any part of the organisation” rather than a named privacy officer, and “there are no specific words that you must use”. You do not have to cite Article 17 or use the phrase “right to erasure” at all.

The regulator does recommend writing it down: “we recommend you follow up any verbal request in writing because this will allow you to explain your complaint, give evidence and explain what you want to happen” — and because it gives you proof if the decision has to be challenged later. The ICO publishes a template letter on the same page; it asks for a “full response within one calendar month” and for a date if that is not possible.

Say what you want erased rather than everything. The right applies in named circumstances: the organisation no longer needs the data for the original purpose; you have withdrawn consent you previously gave; you have objected and your interests outweigh theirs; you have objected to direct marketing; the data was collected or used unlawfully; there is a legal obligation to erase it; or the data was collected from you as a child for an online service — and that last one still applies now you are an adult.

Then the clock. The organisation has one calendar month, and may take up to an extra two months for a complicated request provided it tells you inside the first month why. If it needs to check who you are, the month starts when it receives that information. A fee is only possible where the request is “manifestly unfounded or excessive”.

When they can lawfully say no, and what a refusal must still contain

The exemptions are published, which is what makes a refusal checkable. An organisation can refuse where keeping the data is necessary for freedom of expression and information — the ICO includes “journalism and academic, artistic and literary purposes” — where it is legally obliged to keep it, where it is carrying out a task in the public interest, where the data is needed for legal claims, or where erasure would prejudice research or public-interest archiving. Health and other special category data carries its own separate list.

Two things are true even when the answer is no. The organisation must still respond: the ICO’s words are that it “must still respond to you”, explain why, and tell you about your right to complain to the ICO or go through the courts. And where it does erase, it must tell others: “if your data has been made public online — such as on social networks, forums or websites — then the organisation must take reasonable steps to inform the people with responsibility for these sites to erase links or copies of that data”. That clause is the one that does the work this right is named for.

If nothing arrives, the sequence is: complain to the organisation first, then to the regulator. The ICO is explicit that you can also enforce the right through the courts, and equally explicit about what to do first: “we strongly advise you to seek independent legal advice”. This page is not that advice.

The search engine is a separate request, judged case by case

Google’s account of where this came from is short and worth having: the right was “first established in May 2014 in the European Union as the result of a ruling by the European Court of Justice”, and in 2018 “Article 17 of the GDPR sets out a ‘right to erasure’ similar to the right that the European Court of Justice had recognised”. Russia, Turkey and Serbia have since established versions of their own.

A delisting request is a form, and Google lists what it must carry: the specific URLs, a description of how the content relates to you and why it should be delisted, the search query — normally your full name — and an email address. Requests can be made on somebody else’s behalf by a person legally authorised to do so.

It is then reviewed by a person, not a rule. Google names the factors its reviewers weigh against the public interest: your role in public life, where the information comes from, how old it is, its effect on users, whether it is true, and whether it is sensitive data. Search engines “must consider if the information in question is ‘inaccurate, inadequate, irrelevant or excessive’”.

And the outcome is bounded twice over. It applies to name queries only, and it is territorial: Google delists “from versions of Google’s search results for countries applying European data protection law” and uses location signals to restrict access in the requester’s country, but “consistent with a 2019 decision of the European Court of Justice, we don’t apply these delistings to services for countries outside the EU”.