Search Engine Erasure

Search Engine Erasure (Right to Be Forgotten)

Overview

The right to be forgotten in the search engine context refers to the right of individuals to request that search engine operators delist (remove from search results) links to web pages containing personal data about them. This right was established by the CJEU in Google Spain SL v AEPD (Case C-131/12) and subsequently codified in GDPR Article 17. It requires a balancing exercise between the data subject's privacy rights and the public's right to access information. This skill provides the assessment criteria, request procedures, and operational workflows for both data controllers (whose content may be subject to delisting) and organizations assisting data subjects with delisting requests.

Legal Foundation

CJEU Case C-131/12 — Google Spain SL v AEPD (13 May 2014)

The Court of Justice of the European Union held that:

1. A search engine operator is a data controller in respect of the processing of personal data that appears on web pages published by third parties.
2. The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person's name, links to web pages published by third parties and containing information relating to that person, if certain conditions are met.
3. The data subject's rights override, as a rule, the interest of internet users in having access to that information, unless particular reasons (such as the role played by the data subject in public life) justify the interference with the data subject's fundamental rights.

CJEU Case C-507/17 — Google LLC v CNIL (24 September 2019)

The Court clarified the territorial scope of de-indexing:

1. EU law does not require that de-indexing be carried out on all versions of the search engine globally.
2. The search engine operator must carry out de-indexing on the versions of its search engine corresponding to all EU Member States.
3. The search engine operator must take sufficiently effective measures to prevent or seriously discourage users in the EU from accessing the de-indexed links via non-EU versions of the search engine (geo-blocking).

GDPR Article 17 — Right to Erasure

Article 17(1) establishes six grounds for erasure. In the search engine context, the most commonly invoked grounds are:

• Art. 17(1)(a): Data no longer necessary for the original purpose
• Art. 17(1)(c): Data subject objects and no overriding legitimate grounds exist
• Art. 17(1)(d): Unlawful processing

Article 17(3) establishes exceptions, particularly:

• Art. 17(3)(a): Freedom of expression and information

EDPB Guidelines 5/2019 on the Right to Be Forgotten in Search Engine Cases

Adopted 7 July 2020, these guidelines provide 13 criteria for assessing delisting requests.

Delisting Assessment Criteria

EDPB 13-Point Assessment Framework

The following criteria must be evaluated when assessing a delisting request. The assessment is a balancing exercise — no single criterion is determinative:

Assessment Decision Matrix

[Delisting Request Received]
         │
         ▼
[Preliminary Assessment]
   │
   ├── Is the data subject identifiable from the search results? ──► No ──► Reject (no personal data at issue)
   │
   ├── Is the request against a search engine operator? ──► No ──► Redirect to content publisher (separate Art. 17 request)
   │
   └── Yes to both ──► [Full EDPB 13-Point Assessment]
         │
         ▼
[Apply Balancing Test]
   │
   ├── STRONG DELISTING CASE:
   │     - Data subject is a private individual
   │     - Information is inaccurate or outdated
   │     - Information is sensitive (Art. 9 categories)
   │     - Data subject was a minor when information published
   │     - Significant demonstrable harm from continued indexing
   │     - Information was not self-published
   │     ──► APPROVE delisting
   │
   ├── STRONG REFUSAL CASE:
   │     - Data subject is a prominent public figure
   │     - Information relates to their public role
   │     - Information is accurate and current
   │     - Strong public interest in access to the information
   │     - Information published by journalistic source
   │     - Legal obligation to maintain the information
   │     ──► REFUSE delisting (cite specific public interest justification)
   │
   └── BORDERLINE CASE:
         - Mixed factors present
         ──► [Detailed written balancing assessment required]
         ──► [Consider partial delisting or time-limited delisting]
         ──► [Consult DPO and Legal counsel]

Delisting Request Procedures

Step 1: Submitting Delisting Requests to Search Engines

Each major search engine maintains a dedicated form for delisting requests:

Google

• Form: Google Search removal request under European privacy law
• URL path: Available via Google's support documentation under "Remove personal information"
• Required information: Full name, email address, country of residence, specific URLs to delist, explanation of why each URL should be delisted, identity verification
• Response timeline: Google typically responds within 3-6 months; complex cases may take longer