Right to Be Forgotten: Erasure Requests Explained

The basic idea

The “right to be forgotten” is a popular name for the idea that, in some circumstances, people should be able to ask that information about them be erased or no longer be easy to find. The more formal term in many laws is the right to erasure, and the request itself is often called an erasure or deletion request.

The concept grows out of a plain observation: information used to fade with time, but digital records and search engines can keep old facts available indefinitely. Someone who made a minor mistake, was once mentioned in the news or simply stopped using an online service may want their data gone. Others worry that deleting information can erase history or let people hide things the public has a legitimate interest in knowing.

This article is general information, not legal advice. The rights available depend on where you and the organization are located.

Where the idea comes from

In the European Union, the concept became widely known after a 2014 court ruling concerning a search engine and links to old newspaper notices about a person’s financial history. The court held that, under the rules of the time, individuals could in certain situations ask search engines to remove links to information that was inadequate, irrelevant or no longer relevant, when searching their name. The ruling did not require the original publication to be deleted.

The General Data Protection Regulation, which applies from 2018, includes a right to erasure. Other places have created their own versions, which range from broad rights to deletion of data a business holds about you, to narrower rights covering specific groups, such as children’s data, or particular situations. Some countries and jurisdictions have no general right at all. The details, and even the name, differ.

Two different things

People often blur two separate requests.

1. Erasure of data held by an organization. You ask a company, agency or service to delete the personal data it holds about you, such as an old account and its associated records.
2. Delisting from search results. You ask a search engine to stop showing links to certain pages when someone searches your name. The page itself may remain online on the original website, but becomes harder to find.

The first is about data an organization controls directly. The second involves a service that indexes material published elsewhere. Getting something removed from the original site is a third path, where the site owner decides or a court orders.

When erasure may apply

Rules that grant a right to erasure usually list situations where it can apply. Common examples include:

• The data is no longer needed for the purpose it was collected for.
• You withdrew consent, and consent was the only basis for handling the data.
• You objected to the use, and there is no overriding reason to continue.
• The data was handled unlawfully.
• The data relates to a child and was collected in connection with an online service.
• A legal obligation requires deletion.

The right is typically not automatic or absolute. The organization usually has to assess the request.

Common limits and exceptions

Even in systems with a strong right, the organization can often refuse, in whole or in part, for stated reasons. Typical grounds include:

• Freedom of expression and information. Journalism, art and public discussion are often protected, and a person’s interest in privacy is weighed against others’ interest in access.
• Legal obligations. Tax, accounting, employment and financial regulations may require keeping records for set periods, which is where data retention rules come in.
• Public interest. Public health, archiving and scientific research may allow retention under conditions.
• Legal claims. An organization may keep data needed to establish, exercise or defend a legal claim.
• Public records. Some information, such as certain court or company registry entries, is meant to remain public.
• Technical and practical issues. Backups, logs and data already shared with third parties are hard to scrub, though organizations may be expected to take reasonable steps and to inform recipients where required.

Where information is public figures’ conduct or concerns serious matters, requests are more likely to be declined than for private individuals’ outdated or trivial information, but outcomes depend on the facts and the legal framework.

What making a request typically looks like

Procedures vary, but a common pattern is:

1. Find the right contact. Many organizations have a privacy contact or web form, often described in their privacy notice. Search engines usually provide a dedicated request form.
2. State what you want. Identify yourself, say which data or pages you mean and why you are asking. Include specifics, such as links.
3. Expect identity checks. Organizations may verify who you are before acting, to avoid deleting someone else’s data.
4. Wait for a response. Some laws set time limits; under the European regime, a response is generally expected within about a month, with possible extension for complex cases.
5. Receive a decision. The organization may delete, partly delete or refuse and explain why. If you disagree, you might be able to complain to a regulator or seek other remedies.

Deleting an account through a service’s own settings is often faster than a formal request, and many services offer this. Keep in mind that deletion may be permanent, may remove access to purchases or messages and may leave some information in backups for a period.

Related ideas

The right to erasure is one of several data rights found in many privacy regimes, which may also include rights to access data, correct it, restrict its use, object to it or move it to another service. Erasure interacts with other principles too: the idea of collecting only what you need supports having less to delete in the first place, as in data minimization. And what counts as covered depends on how the law defines personal data.

Newer technology adds complications. If personal data was used as training data for a machine learning model, removing it from a database may not undo its influence on the trained model, and how erasure rights apply to such systems is an area where thinking is still developing.

Arguments in the debate

Supporters say people should have some control over their digital past, that old or inaccurate information can harm employment, relationships and safety, and that second chances matter, particularly for young people and for those who were victims or only incidentally involved in events.

Critics raise concerns that:

• Erasure can distort the historical record or enable people to hide matters of public interest.
• Decisions about what to delist may be left to private companies, which would have to balance privacy and expression case by case.
• Rules apply differently in different places, raising disputes over whether a removal should apply worldwide or only in one region.
• Heavy compliance demands may be burdensome for smaller organizations.

Reasonable people disagree about where the lines should fall, and legal systems with strong speech protections often take a more cautious view of a general right to erasure.

Practical takeaways

• Check what rights apply to you by reading the privacy notice and looking at the account settings of the service concerned.
• Be specific in your request and keep a record of when you made it.
• Understand that a delisted page may still exist on its original site.
• Consider that deletion can be irreversible.
• For difficult or high-stakes situations, consider consulting a qualified legal professional or your local data protection authority.