The Right to Be Forgotten: Your Guide
In an age of ever-expanding permanent digital footprints, the Right to Be Forgotten has become a vital tool for reclaiming control over your personal data and online privacy. People may be concerned about an outdated news article, an embarrassing photo or a misleading piece of content but, whatever it is, you now have the legal grounds to ask for it to be removed or delisted.
This guide explains how the Right to Be Forgotten works in the UK, its legal foundation, how it applies post-Brexit and the role of tools like video redaction in protecting your reputation. Note that the Right to Be Forgotten is sometimes referred to as Right to Erasure.
What is the Right to Be Forgotten?
The concept of the Right to Be Forgotten grew out of evolving concerns about online privacy and data protection. As technology advanced and search engines became ubiquitous, the need to balance information accessibility with personal privacy became critical. That's where the term gained traction, thanks to landmark court cases and the General Data Protection Regulation (GDPR).
Article 17 of the GDPR sets out the legal right for individuals to ask for their personal data to be erased when certain conditions are met. That includes data that's no longer necessary, processed unlawfully or where the subject withdraws consent.
Background of the Right to Be Forgotten
The idea behind the Right to Be Forgotten has been explored and implemented in several regions around the world, such as the European Union, the UK, the Philippines and Argentina. This erasure concept centres on granting individuals more control over their personal data, especially when that data may no longer be relevant or could negatively affect their future.
Essentially, it reflects a desire by individuals to remove outdated or incorrect information from the internet, particularly content that could unfairly harm their reputation. One frequently cited example is the online availability of old criminal records, which may continue to impact a person's life long after they have served their sentence or reformed.
Debates and Criticisms Surrounding the Right to Be Forgotten
The implementation of this erasure right remains a contentious issue. Critics question whether it’s feasible to treat the Right to Be Forgotten as a universal, enforceable human right, especially given the inconsistent legal standards and interpretations across different countries.
Another major point of debate involves its potential conflict with other fundamental rights, such as people’s rights of freedom of expression. Opponents argue that removing information from search results may hinder open access to information or dilute the effectiveness of online search tools.
On the other hand, supporters of the erasure right point to serious concerns such as the long-term harm caused by non-consensual content like revenge publications or the resurfacing of sensitive personal data. Opponents argue that in these cases, the right offers necessary protection and dignity to individuals who otherwise have no way to erase damaging digital footprints.
ICO Oversees UK Data Protection Rights
The ICO (Information Commissioner’s Office) offers advice on UK individuals’ Right to Be Forgotten entitlements and the extent of obligations of UK organisations to adhere to erasure requests.
The UK GDPR introduces a right for individuals to have personal data erased.
The right to erasure is also known as ‘the right to be forgotten’.
The right is not absolute and only applies in certain circumstances.
Individuals can make a request for erasure verbally or in writing.
[organisations] have one month to respond to a request.
This right is not the only way in which the UK GDPR places an obligation on [organisations] to consider whether to delete personal data.
Key Definitions
In the context of the Right to Be Forgotten, the terms "Data Controller," "Data Subject," and "Delisting" play pivotal roles:
Data Subject
This refers to the individual whose personal data is being processed. Under GDPR, data subjects have the right to request the erasure of their personal data in certain circumstances.
Data Controller
This is the entity that determines the purposes and means of processing personal data. When a data subject exercises their Right to Be Forgotten, they submit a request to the data controller, who is then obligated to assess and act upon the request in accordance with GDPR guidelines.
Delisting
This process involves removing links to specific web pages from search engine results without deleting the content from the original source. Delisting is a common method for implementing the right to be forgotten, especially when the information remains online but is no longer easily accessible through search engines.
Understanding these roles and processes is essential for effectively navigating and exercising data protection rights under GDPR.
Defamation vs Right to Be Forgotten
Defamation involves false statements harming someone’s reputation, addressed through legal action. The right to be forgotten allows individuals to request removal of outdated or irrelevant online content. While defamation targets falsehoods, the right to be forgotten focuses on limiting access to truthful but potentially harmful personal information.
Historically, individuals often turned to defamation or privacy laws to address damage to their reputation.
However, as people increasingly depend on the internet for information, these legal remedies are sometimes insufficient, particularly in cases where content spreads rapidly online or originates from websites based outside the UK.
Additionally, there are occasions when defamation and privacy laws don't apply because the information was published legally. For instance, media reports on criminal trials are generally protected by legal privilege, even if the defendant is acquitted.
Similarly, news coverage that presents both sides of a false allegation may be shielded from defamation claims by defences such as truth or public interest, especially when the reporting acknowledges that the claims were eventually disproven. In such situations, the most effective approach may be to request the removal of links from search engine results.
When Does the Right to Be Forgotten Apply?
To make a valid request, you'll need to meet certain criteria. The most common grounds are:
Outdated or irrelevant data: information that no longer serves a public interest.
Inaccurate or misleading information: incorrect facts or statements that can harm your reputation.
Data processed unlawfully: where consent was never given or data was obtained illegally.
You can make a request if you're a UK citizen or an individual affected by online content whose privacy and dignity are at risk.
Legal Background and Precedent Cases
The Google Spain case (2014) set a global precedent for delisting rights. A Spanish citizen asked Google to remove outdated financial information. The European Court of Justice ruled in his favour.
The NT1 & NT2 v Google LLC case (2018) refined how courts interpret privacy versus public interest in the UK. While one claimant succeeded, the other didn't, which illustrates the nuanced approach courts take.
Post-Brexit, the UK retained its own version of GDPR. The Right to Be Forgotten still exists under UK GDPR, subject to UK-specific interpretations and enforcement through the ICO.
Limitations of the Right to Be Forgotten
Public interest and freedom of expression can override your request. If the data serves a public interest, such as journalistic content, political commentary or public health and safety, requests can be refused.
Some records, like criminal convictions or financial misconduct, must remain accessible owing to regulatory or legal requirements.
Requests can be refused if:
The request lacks merit.
The content remains relevant or accurate.
There's an overriding public interest in its availability.
How to Make a Right to Be Forgotten Request
You can submit a request to search engines like Google, Bing and Yahoo. You'll need to:
Identify the URLs you want removed.
Provide your reasons and supporting evidence.
Prove your identity.
If your request is refused, you can ask the platform for reconsideration, file a complaint with the ICO or seek a judicial review or court injunction.
Tips for Strengthening Your Case
Be clear about why the content is harming you.
Provide supporting evidence.
Be prepared to explain your request.
The right to be forgotten, also known as delisting, isn't a magic wand that erases your online presence. It removes links from search results, but doesn't touch the original content. That requires action from the content host. (That's a key distinction.)
For businesses - especially SMEs - delisting can be a lifeline if they're impacted by outdated or defamatory content.
But there's a catch. Trying to hide valid criticism, avoid accountability or delete truthful news reports can lead to refusal or even legal penalties.
Search engines are considered data controllers. They must weigh your right to privacy against the public interest. That's why they have to assess delisting requests carefully.
Regional limitations come into play here. A successful request in the EU or UK might not affect search results in other regions like the US, unless the search engine decides to take global action.
Google, for example, uses internal panels to evaluate requests. They look at the nature of the information, the subject's role in public life and how long ago the content was published.
Video Redaction and the Right to Be Forgotten
Video redaction is a related concept. It involves blurring or muting identifiable personal data in video content. Personal data includes faces, voices, and vehicle licence plates This is especially relevant for YouTube videos, CCTV footage, news segments and social media clips.
If a video reveals identifiable visual or audio personal data that meets the Article 17 criteria for erasure, redaction can be a legally justifiable way to comply without full deletion.
There are technical and legal challenges to redaction. Some hosts may resist or delay action. There are jurisdiction issues with international platforms not complying with UK-specific laws. And there's copyright to consider, as removing or altering footage must comply with content ownership rights.
Redaction offers a middle ground between full removal and keeping the content intact. It maintains content integrity while protecting individual privacy.
Legal Support and Professional Help
If your case involves sensitive data, high public exposure or legal complexity, it's worth consulting a data protection solicitor for advice.
They can craft compelling requests, handle negotiations with platforms and represent you in court if needed.
Legal fees vary, but often cover initial consultations, document preparation, legal correspondence and court representation.
Reputation management firms can offer video redaction, content suppression and SEO strategies to bury unwanted links. Or they can work directly with video hosts to take down problematic footage.
Final Thoughts
The balance between privacy and public interest is key. The right to be forgotten isn't about rewriting history but about fairness in the digital age.
As AI, deepfakes and data scraping technologies evolve, so too will privacy laws. Ongoing legal updates will expand how and when the Right to Be Forgotten applies.
The Growing Role of Video in Reputation and Data Protection
In recent years, the amount of video footage recorded and published has increasd massively. Contributing factors include the widespread use of CCTV and body worn cameras for security purposes, and the capability of mobile phones to record high definition videos.
Whenever video footage is published or shared with third parties, the privacy rights of people shown or heard in the video must be respected.
Facit’s Identity Cloak provides a fast, reliable, cost-effective way to mask personally identifying information automatically in videos, including faces, voices, vehicle licence plates and distinguishing features.
Get in touch today to learn how video redaction enables you to share and publish video footage in compliance with UK GDPR.
FAQs
Q. How do I apply for the Right to Be Forgotten?
A. Submit a request via the search engine’s delisting portal with proof of identity and justification.
Q. What about the UK's Right to Be Forgotten following Brexit?
A. It remains in place under UK GDPR, with oversight by the ICO.
Q. What are the Right to Be Forgotten requirements?
A. The data must be outdated, irrelevant, inaccurate or unlawfully processed.
Q. Can someone legally ask to have their data removed?
A. Yes, if the legal criteria under Article 17 are met.
Q. What are examples of the right to be forgotten?
A. Old convictions, revenge posts, outdated news articles or false claims.
Q. What is the time limit for the right to be forgotten?
A. There’s no fixed time limit, but older data is more likely to be considered for erasure.
