Your name in Google over an old case: the right to be forgotten

The case, in five lines

What is brought

A request for erasure and delisting addressed to the search engine and to the site's publisher, followed by a complaint to the AEPD for failure to attend to the right if it goes unresolved.

Before which court

The AEPD (the Spanish data protection authority) hears the complaint for failure to attend to the right. Compensation for the harm suffered is claimed before the Civil section of the Tribunal de Instancia (the first-instance court).

Deadline

The controller must inform you of its action within one month of receiving the request, extendable by two more if it notifies and justifies the delay. Thereafter, the complaint to the authority is decided within six months.

Who can bring it

The individual whose name produces the results. Article 93 speaks of any person, without requiring that the published information be false or that keeping it on the site be unlawful.

Financial risk

If the information retains current public interest, the balancing goes against you and the links remain. A badly framed claim can also revive attention on the very matter you wanted buried.

The search engine and the outlet are two controllers, and both get asked

Article 93 of Organic Law 3/2018 says something that settles half of these matters: the right to have the search engine remove the link subsists even where keeping the published information on the linked website is lawful and even where that site has not deleted it beforehand or at the same time. They are two separate decisions and they can come out differently.

That is why the newspaper's refusal does not close the case. Keeping the report in the archive may be entirely legitimate, since it serves an archival function, and even so the search engine may be obliged to stop associating that report with your name. Anyone who writes only to the outlet and gives up when told no loses the route that actually works.

The strategy therefore addresses both at once, with different requests. The search engine is asked to remove the link from the result lists produced by searching your name. The publisher is asked for erasure or, at the least, for the content to be blocked from search engine indexing. Each letter invokes its own ground and neither depends on the other.

Article 93 gives you five adjectives, and time works in your favour

The rule grants the right where the links contain information that is inadequate, inaccurate, irrelevant, out of date or excessive, or that has become so with the passage of time. That last phrase is the key to old cases: the information may have been impeccable the day it was published and have become irrelevant since, with nobody lying and the outlet doing nothing wrong.

The balancing is done having regard to the purposes for which the data were collected or processed, the time elapsed and the nature and public interest of the information. Three variables, and only one works against you: if you hold no public office and have no notable prominence, the public interest in a nine year old report about a dropped matter is weak, and it fades further each year.

The article adds a second, standalone route: the same applies where the personal circumstances invoked by the person affected show that their rights prevail over keeping the links. That is no ornament. It is where real consequences come in, the job process lost, the exposure of children in your family, health, and where a well built request separates itself from a mere complaint.

Delisting does not delete the story: it disconnects it from your name

Article 93 itself makes it clear: exercising the right does not prevent access to the information published on the website through search criteria other than the name of the person exercising it. Anyone searching the town, the date or the subject will still find the report. Anyone searching for you will not. Understanding that avoids asking for what cannot be granted.

That boundary also explains why the right withstands the censorship objection well. Nothing is taken out of the archive, the record is not altered and history is not rewritten. The only thing cut is the shortcut that turns your name into a permanent label. The information stays available to anyone who searches for it by what it actually is.

In practice this changes how the request is drafted. The specific addresses are identified, the exact search term that returns them is stated, usually first name and surname, and removal is sought in relation to that term. A generic request to delete the story is rejected out of hand and burns the one month reply period for nothing.

Paragraph 3 of Article 17 is the defence you will be met with

Article 17 of the Regulation requires erasure without undue delay where the data are no longer necessary for the purposes, where consent is withdrawn with no other basis, where an objection under Article 21 succeeds or where they have been unlawfully processed. That is the general door, and in old cases it is usually the first of those circumstances that opens it.

Its paragraph 3 cuts the right back in five situations, and they are worth knowing before you write: exercising freedom of expression and information, compliance with a legal obligation or performance of a public interest task, public interest reasons in the field of public health, archiving purposes in the public interest, scientific or historical research and statistics, and the establishment, exercise or defence of legal claims.

Outlets almost always invoke the first and the fourth. That is why the request to the search engine is stronger than the one to the publisher: the search engine does not exercise freedom of information by ordering results under your name, nor does it perform a historical archiving function. That asymmetry is why Article 93 exists as a rule of its own.

One month for them to reply, six for the authority to decide

Article 12 of the Regulation requires the controller to give you information on its action within one month of receiving the request. That period may be extended by two further months on account of complexity or the number of requests, but only if you are told of the extension within the first month, with the reasons for the delay stated.

If they do not act on the request, they must inform you without delay and at the latest within one month of the reasons for not acting and of the possibility of complaining to a supervisory authority and of bringing court proceedings. All that correspondence, including the reasoned refusal, is what later supports the administrative complaint.

Once the month has run, Article 64 of Organic Law 3/2018 applies. Where the matter concerns exclusively a failure to attend to a request under the rights in Articles 15 to 22 of the Regulation, the period to decide is six months from notification to the complainant that the complaint is proceeding, and after that period the complainant may treat it as upheld.

How we run the case, step by step

1. 1

   Map the results precisely

   We list the specific addresses that appear when your full name is searched, with dated screenshots and the position of each. Without that list the request is generic and the search engine rejects it without any balancing.

2. 2

   Build the balancing with facts of your own

   We document the time elapsed, the actual outcome of the matter and the absence of any current public prominence, and add the personal circumstances showing that your rights prevail over keeping the links.

3. 3

   Apply to the search engine and the publisher together

   Two letters, two grounds. To the search engine, removal of the link from lists produced by searching your name. To the publisher, erasure or blocking from indexing. Both go out the same day so that a single month runs.

4. 4

   Complain to the AEPD if the month passes in silence

   The complaint for failure to attend to the right is decided within six months of the complainant being told it is proceeding, and after that period it may be treated as upheld. All the earlier correspondence is attached.

5. 5

   Claim the damage where there is any

   If the links staying up cost you a post, a contract or provable non material harm, compensation under Article 82 of the Regulation is claimed in the civil courts, with the facts and dates already fixed in the administrative file.

6. 6

   Watch for reappearance

   Results are reviewed at intervals and action is taken on mirrors, aggregators and copies. Article 17 requires whoever made the data public to take reasonable steps to inform other controllers of the request to erase links and copies.

The law that applies

• Art. 93 LOPDGDD. It gives everyone the right to have search engines remove from name based result lists the links containing information that is inadequate, inaccurate, irrelevant, out of date or excessive, or that has become so over time, having regard to the purposes, the time elapsed and the nature and public interest of the information. The same applies where personal circumstances show that the person's rights prevail; the right subsists even if keeping the material online is lawful, and it does not prevent access through search criteria other than the name. BOE-A-2018-16673
• Art. 17 RGPD. It requires erasure without undue delay where the data are no longer necessary for their purposes, consent is withdrawn with no other basis, an objection succeeds or they were unlawfully processed, and requires whoever made them public to take reasonable steps to inform other controllers of the request to erase links and copies. It does not apply where processing is necessary for freedom of expression and information, a legal obligation or public task, public health, archiving, research or statistical purposes, or the establishment, exercise or defence of legal claims. 32016R0679
• Art. 12 RGPD. It requires information and communications to be concise, transparent, intelligible and easily accessible, and a reply on the action taken on a request under Articles 15 to 22 within one month of receipt, extendable by two more for complexity or volume if notified within the first month with reasons. If no action is taken, the reasons and the possibility of complaining to a supervisory authority and bringing court proceedings must be communicated within that month. All of it is free of charge, save for manifestly unfounded or excessive requests, where the burden of proof lies on the controller. 32016R0679
• Art. 94 LOPDGDD. It gives the right to have erased, on simple request, the personal data one supplied oneself for publication by social network services and equivalent services. Where a third party supplied them, erasure applies if they are inadequate, inaccurate, irrelevant, out of date or excessive, or have become so over time, or if personal circumstances show the person's rights prevail, excluding data supplied by individuals in personal or household activities. If the data were supplied while the person was a minor, the provider must erase them without delay on simple request. BOE-A-2018-16673
• Art. 64 LOPDGDD. Where the matter concerns exclusively a failure to attend to a request under the rights in Articles 15 to 22 of the Regulation, the period to decide is six months from notification to the complainant that the complaint is proceeding, and after that period it may be treated as upheld. Where it seeks to establish an infringement, the maximum duration is twelve months from the notice of initiation, lapsing and closing on expiry, and six months if it is steered towards a warning with corrective measures. BOE-A-2018-16673

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions