The ‘Right To Be Forgotten’
A Guide To Removing Content From Google
The 'right to be forgotten' has been around for some time, but the practical reality of getting Google to remove content can be extremely difficult. So what can you do?
As Google regularly updates its algorithm, it continually revises its internet search rules (SERPs). These revisions are risky, because adverse or unwanted information which creates an inaccurate, false or misleading impression could be brought forward onto its front pages.
In some cases, an individual has a right to be forgotten and can, at least in theory, legally request that Google removes certain content from its search results in the UK and Europe.
But the practical reality is that for most individuals, this is far from straightforward. One must carefully navigate the infinite loop of boilerplate responses that Google generates to obfuscate matters instead of fulfilling takedown requests.
David vs Goliath: What is the 'right to be forgotten'?
The right to erasure, also popularly known as “the right to be forgotten”, is an individual’s fundamental right in the UK and Europe to request that sensitive information should be removed from Google search results. This also applies to information held by other search engines, websites and online databases.
This privilege emerged more than a decade ago, around the same time privacy and data protection laws started maturing. In a landmark 2014 judgement for a case between Spanish lawyer Mario Costeja and Google, the European Court of Justice ruled that EU citizens can request for their unwanted personal data to be removed.
This was widely seen as a rare win in a David vs Goliath situation between an individual and Google, a multinational US corporation.
The disputed data remained on the website, but Google was forced to delete any link that connected Costeja to it.
This ruling was further complemented in 2018 by a new European framework for data protection laws, called the GDPR. In the UK, the Data Protection Act 2018 adopted the same laws so UK rights weren't affected by Brexit. The UK framework strengthened the principles of the right to be forgotten.
An individual now also has “the right to find out what information the government and other organisations store about you”. This development renewed public interest in the right to be forgotten as organisations using people’s personal data were required to follow strict rules called data protection principles.
Who can request the removal of content from Google?
The right to be forgotten applies to individuals who fall under the jurisdiction of either UK or European Union territories, as well as other European countries that have adopted similar laws, such as Switzerland. This right cannot be exercised by a company or an organisation that is governed by the same jurisdictions.
However, the GDPR also carries extra-territorial powers. If a UK or EU citizen requests for their information to be removed from search engines and organisations that are outside their respective jurisdictions, these entities have a duty to comply.
The GDPR applies to any non-EU organisations, from websites to social networking sites to app providers, that offer goods or services to those who are within its jurisdiction.
Surfshark, a data research platform, found in 2023 that half of these data removal requests came from users in Western Europe, with France, Germany and UK making the greatest number of takedown requests, exercising their 'right to be forgotten'.
What is the practical reality of removing content from Google?
The practical reality of successfully removing content from Google is very different to the legal theory. In reality, there are severe deficiencies in the practical application of the right to be forgotten. In response to takedown requests, Google frequently claims its default position:that it is not equipped to accurately assess a request for removal and cannot take action without objective evidence in support of a claim.
Most often, this involves Google requesting quixotic evidence in support of a double negative. For example, it will reply to a request saying “please provide evidence that you were absolved of the activity that you were never involved with”. This approach also ignores 'the right to be forgotten' principle which states that when the merits of a request are unclear, the data processor (Google) should have good faith in the individual making the request and favour removal of the data.
Google also seems to give a cursory analysis even to sophisticated and legally-sound removal requests. It is highly reliant on serving boilerplate responses as reasons to decline a request, often citing incorrect exceptions that represent an erroneous interpretation of the 'right to be forgotten'.
Often, one common response from Google is that it will ask the individual for more information for one reason for removal, and then request that it be followed upon provision of that information. This will be followed by yet another boilerplate response declining the original request for an entirely different and unrelated reason.
The Google Removals team also has a habit of automatically closing a request in an out of hand manner, regardless of the soundness of their judgement and with no further opportunity for the individual to communicate further.
When do you have the right to be forgotten?
Individuals or their legal representatives have the right to erase their personal data if it is no longer necessary for the purpose it was originally collected for. It could also apply in cases where the information is collected for marketing purposes, or if the data is held with consent from the individual, which has then been retracted. You cannot request the removal of data in the future, as the right only applies to data held at the time the request was received by the organisation.
A grey area for individuals is personal data held by an organisation unlawfully. This could be tricky to argue for, as there are many instances where personal data could be unlawfully handled, for instance when the information is inaccurate, or when the individual wasn’t sent a privacy notice upon engagement.
When don’t you have the right to be forgotten?
The right to be forgotten is not an absolute privilege. In the UK particularly, data removal requests can be rejected if the organisation argues that the data-holding is necessary for public interest or is useful to provide specific social or healthcare services. Generally, freedom of speech and freedom of information can override an individual’s right to be forgotten.
Elsewhere, if the individual’s information is required to fulfil their legal or a public company’s obligations, then the request can also be denied.
Even a successful removal is rife with challenges
Even if you do successfully exercise your right to be forgotten, there is still a good chance that the information you seek to remove will still affect you.
For example, a well-cited law study found that residual data that remains after the removal request, which only proximally links you, can be decoded by “powerful re-identification algorithms”.
These algorithms can function with a minimum of three data points, and with that, “any attribute can be identifying in combination with others”.
So how can you remove adverse content from Google?
Exercising your right to be forgotten is fraught with difficulties, with no guarantees of removal from Google. While our team has extensive experience making successful requests, our advice will always be to consider a 'right to be forgotten' removal request as just one of the available tactics in reputation management. We can instead apply a comprehensive and holistic approach to reputation-building that takes the challenges posed by artificial intelligence and clever algorithms into account.
One such challenge is Google’s EAT algorithm, which favours negative content as well as diverse content, and thus significantly increases the propensity for adverse content to feature highly in search results. To combat this, we utilise a proprietary synthesis of media, intelligent content and deep tech to build resilient and resistant reputations online and in the global media.
We can also deploy human intelligence activities to find other grounds for data removal that are legally valid, but which fall outside of the ‘right to be forgotten’ framework. In many instances, dynamic solutions like these are overlooked by SEO specialists and law firms in favour of a drawn out and combative approach with Google or regulators.
Perhaps, what's most important for individuals to consider is the concept of reputation ‘in the round’. If the appearance of adverse content in Google is causing damage to a reputation, and especially if it is creating traction or restricting an individuals’ ability to achieve private, commercial or even philanthropic outcomes, then the problem lies much deeper than the case of adverse URLs appearing in search.
In the near future, Google will no longer be a site that aggregates data by algorithm and then ranks a series of third-party websites. AI-powered search will see Google provide comprehensive answers to search queries, using information drawn from multiple sources but presented in a single place. AI will then ‘click through’ and assess the information on each site and compile it on behalf of the user, instead of leaving it to the user.
This is Google’s stated trajectory, and when that occurs, it will become essential to curate authentic profile attributes which reflect the true position of who someone is, and to substantiate these profile attributes consistently across democratised media.
Done properly, AI-search can be 'trained' to give answers and results that represent a genuine position and persona, and to diminish false, misleading and inaccurate or outdated content. This is where our expertise can support you greatly.