Right to be forgotten: how to have your data deleted?

An old conviction that appears on the first page of Google when an employer types your name. An embarrassing photo published by a third party ten years ago. A press article reporting a commercial dispute settled long ago. These digital traces can hold back a recruitment, weaken a business relationship or simply disturb a private life. French and European law nevertheless offers concrete levers to regain control. This FAQ explains what the right to be forgotten really is, how to obtain the deletion of personal data, how Google delisting works, and what remedies to use when a data controller refuses.

What exactly is the right to be forgotten?

The term "right to be forgotten" is a convenient but imprecise shorthand. It actually covers two distinct legal mechanisms that must be differentiated in order to act effectively.

The first is the right to erasure, enshrined in Article 17 of the General Data Protection Regulation (GDPR, EU Regulation 2016/679, applicable since 25 May 2018). It allows a person to obtain from a data controller the erasure of personal data concerning them. The text is explicit:

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay."

The second is the right to delisting, which does not delete the content at source but asks a search engine to remove a result associated with a search made on a person's name. The article stays online on the original site, but it no longer appears when the person's name is typed in.

This distinction is essential. Having a defamatory article removed by the site's publisher and asking Google to stop surfacing it are two different steps, which may in fact be combined. In French law, these rights are articulated with Law No. 78-17 of 6 January 1978 known as the "Informatique et Libertés" Act, amended to adapt it to the GDPR, whose application is supervised by the CNIL (the French data protection authority, Commission nationale de l'informatique et des libertés). The missions and powers of the CNIL, and their bearing on the obligations arising from the GDPR, are presented in our guide devoted to that authority.

In what cases can you ask for your personal data to be deleted?

Article 17 of the GDPR lists specific situations giving rise to a right to erasure. The request is not an absolute right: it must rest on one of the grounds provided for by the text.

• the data are no longer necessary in relation to the purpose for which they were collected (for example, a customer account inactive for years with an online retailer);
• the person withdraws the consent on which the processing was based, and there is no other legal ground;
• the person objects to the processing and there are no overriding legitimate grounds for continuing it;
• the data have been unlawfully processed;
• erasure is required by a legal obligation;
• the data were collected from a child in connection with online services.

In concrete terms, an individual may ask a retail site to delete their account and the purchase history that has become useless. An internet user may demand the removal of a photo published without their consent on a social network. A business may also act: a director whose name appears in a commercial prospecting file to which they never consented may demand its erasure.

Personal data is defined broadly: any information relating to an identified or identifiable natural person. A name, an address, a registration plate, an IP address, a photo of a face, an internal evaluation score are all data concerned.

Does the right to erasure have limits?

Yes, and there are many. Article 17 of the GDPR itself provides for exceptions that allow the data controller to legitimately refuse erasure.

The first concerns freedom of expression and information. A media outlet may keep online a news article serving the public's right to information, even if it names a person. The press enjoys strong protection, and the right to be forgotten cannot be used to rewrite the judicial or economic history of a public figure.

The second concerns compliance with a legal obligation. An employer must keep payslips for a period set by law. A bank must retain certain data under its anti-money laundering obligations, under the supervision of the ACPR (the French prudential supervision and resolution authority, Autorité de contrôle prudentiel et de résolution). A trader must keep invoices for accounting and tax reasons. In these cases, the erasure request runs up against a superior obligation.

The third concerns the establishment, exercise or defence of legal claims. A party to a dispute may keep evidence for the duration of the proceedings and of any appeals.

For businesses faced with an erasure request, the challenge is to identify precisely the basis for any refusal. Refusing without valid grounds exposes the business to a CNIL complaint and, where appropriate, to a sanction. Granting erasure where a legal obligation requires retention creates another risk. A case-by-case analysis is essential.

How does Google delisting work?

Delisting specifically targets search engines. Its principle was laid down by the Court of Justice of the European Union in a landmark judgment, the Google Spain judgment of 13 May 2014 (CJEU, C-131/12). The Court held there that a search engine is a data controller and that a person may, under conditions, demand the removal of results associated with their name.

The idea is as follows: when a search is made on a person's first name and surname, certain results may be removed from the list displayed because they are inadequate, irrelevant, excessive in relation to the purposes of the processing, or because the passage of time has removed their informational interest.

The limited scope of the operation must be properly understood. Delisting does not erase the web page: the article remains accessible on the original site and can still be found by other means, notably by a search that does not use the person's name. It simply makes the information much harder to find for someone searching for a name.

Balancing privacy against the public interest

Delisting rests on a balancing exercise. On one side, the right to respect for private life and to data protection. On the other, the legitimate interest of the public in accessing information. Several criteria guide this balancing: the sensitive nature of the data, the person's role in public life, the age of the facts, their accuracy and the possible existence of judicial proceedings.

An anonymous person whose old and minor news item comes up at the top of the results has a strong chance of obtaining delisting. Conversely, a well-known director, an elected official or a public figure whose functions justify citizen scrutiny will see their requests examined more strictly. The Conseil d'État, in several leading decisions, has specified the applicable analytical framework, distinguishing notably sensitive data, data relating to offences and other information.

The territorial scope of delisting

A long-debated question was whether delisting should apply worldwide or only at European level. The Court of Justice of the European Union answered it in its judgment of 24 September 2019 (CJEU, Google v CNIL, C-507/17). Delisting is required on the versions of the search engine corresponding to the Member States of the Union, but EU law does not, in principle, require delisting on all worldwide versions of the engine. The engine must nevertheless put in place measures that are sufficiently effective to prevent or seriously discourage access to the results from within the Union.

How do you actually formulate a deletion request?

The process always begins with a direct request to the data controller, that is, the body that holds and uses the data. Going straight to the CNIL or to a court without first approaching the controller is generally premature.

Identify the right counterparty

To have content removed at source, you must approach the site's publisher or host. For delisting, you must approach the search engine, which provides dedicated online forms. Many organisations have also appointed a data protection officer (DPO), whose contact details often appear in the privacy policy. The DPO is the natural point of contact for this type of request.

Draft a reasoned request

An effective request clearly identifies the author, specifies the data or URL concerned, and sets out the legal basis relied on. Citing Article 17 of the GDPR, restating the ground (data not necessary, withdrawal of consent, unlawful processing, etc.) and attaching proof of identity strengthen admissibility. For delisting, the exact address of the pages concerned and the query (the name) on which they appear must be given.

The data controller has in principle one month to reply, a period that may be extended by two months for a complex request, provided the person is informed. In practice, absence of a reply amounts to a refusal and opens the way to a remedy.

Keep the evidence

Keeping a written record of each step is decisive. A dated screenshot of the disputed content, a copy of the request sent, the acknowledgment of receipt, the organisation's reply or silence: these items will be essential if the matter is referred to the CNIL or to a judge. A bailiff's report (constat by a commissaire de justice) may be useful to fix online content before it is modified or deleted.

What to do if the data controller refuses?

A refusal, whether explicit or resulting from silence, is not the end of the road. Several remedies coexist and may, depending on the case, be combined.

The first is a complaint to the CNIL. The authority investigates the complaint, may issue a formal notice to the data controller and, in the event of an established breach, impose sanctions. The GDPR provides for administrative fines that may reach, for the most serious breaches, up to €20 million or 4% of the undertaking's total worldwide annual turnover, whichever is higher. That ceiling, rarely reached for a mere refusal of erasure, nevertheless shows the seriousness of the system. The procedure for filing a complaint with the CNIL and its admissibility conditions are detailed in our dedicated article.

The second route is court action. Summary proceedings (référé), that is, an urgent procedure, may be brought before the tribunal judiciaire to obtain the swift removal of content that is manifestly unlawful or infringes privacy. The judge may order removal subject to a daily penalty (astreinte), that is, a financial penalty for each day of delay.

As regards delisting, a search engine's refusal may be challenged before the CNIL and then, where appropriate, before the administrative court where the decision comes from the CNIL itself. Delisting litigation has given rise to extensive case law of the Conseil d'État, which has set the assessment criteria by reference to the nature of the data and the role of the person concerned.

The choice between these routes depends on the objective. To put a swift end to a serious infringement, summary proceedings are often the most effective. To penalise a lasting failure by an organisation to meet its obligations, a CNIL complaint is appropriate.

Right to be forgotten and online reputation: how do they fit together?

The right to be forgotten is one tool among others in managing digital reputation. It is frequently combined with other legal bases depending on the nature of the content concerned.

Where content is defamatory or insulting, the Law of 29 July 1881 on freedom of the press applies, with its short limitation periods that must be strictly observed. Where a photo or video is published without authorisation, it is the right to one's image, tied to Article 9 of the Civil Code on respect for private life, that is invoked. Where an online review abusively disparages a business, the dispute may fall under wrongful disparagement (dénigrement) in civil liability. On the remedies available in case of unauthorised use of an image, including where the infringement targets a business, see our analysis devoted to that area of litigation.

For a business faced with excessive customer reviews or harmful publications, the reflex is often to invoke the right to be forgotten when the relevant basis lies elsewhere. A preliminary analysis of the content makes it possible to choose the right lever, or to combine several: an erasure request under the GDPR, a defamation action, a delisting request and a report to the platform can complement one another.

Finally, a common-sense limit must be recalled: the right to be forgotten does not allow a true, current and publicly relevant piece of information to be made to disappear. A director convicted in a recent, widely reported case cannot wipe out that reality on the sole ground that it harms him commercially. The boundary between legitimate protection of private life and an attempt to rewrite information remains the central issue in any approach.

Conclusion: act quickly and on the right basis

The right to be forgotten is neither a magic wand nor an empty shell. It is a set of precise tools, framed by Article 17 of the GDPR, the Informatique et Libertés Act and European and French case law that is now consolidated. Its effectiveness depends on three factors: speed of action, choice of the right basis and the quality of the evidence file.

The position to retain is clear. Deletion at source and Google delisting are not mutually exclusive; they complement each other, and most serious situations justify pursuing both in parallel. For an individual as for a business, it is better to document the disputed content as soon as it is discovered, make a reasoned written request to the data controller, then, if blocked, consider without delay referring the matter to the CNIL or to the summary proceedings judge.

Before taking any step, have the content concerned characterised in law: a disparaging review, a press article and an obsolete piece of data do not call for the same basis or the same strategy. A preliminary review avoids misdirected requests that end in refusal and wasted time, even though limitation periods, notably in press matters, run quickly.

Frequently asked questions

How long does Google take to process a delisting request?

The search engine has in principle one month to reply to a request under the GDPR, in accordance with Article 12 of the Regulation. That period may be extended by two months for complex requests, provided the requester is informed. In practice, clear and well-documented requests, concerning a person with no public role and old data, are often processed within the one-month period. In the event of refusal or silence, a complaint may be addressed to the CNIL.

Does the right to be forgotten also apply to businesses?

The right to erasure in Article 17 of the GDPR protects natural persons, not legal entities as such. A company therefore cannot invoke the right to be forgotten for itself. Its directors and employees, however, as natural persons, can do so for data concerning them. A business targeted by harmful content will rather rely on wrongful disparagement, defamation or unfair competition, depending on the case.

Can a criminal conviction be removed from the internet?

It depends on the context. A public court decision is a matter of public information, and the press may legitimately report it, especially if it is recent or concerns a public figure. However, delisting of an old article reporting a conviction that has been served, concerning an anonymous person, is often granted following the balancing of private life against the public interest. The Conseil d'État examines these requests taking into account the nature of the offence, the age of the facts and the person's role.

What is the difference between data deletion and delisting?

Data deletion, or erasure, consists in having the content removed by the data controller that holds it, for example a site publisher or a platform. Delisting, by contrast, does not delete the content: it asks the search engine to stop displaying it in results associated with the person's name. The content therefore stays online and accessible by other means. Both steps can be pursued in parallel for a more effective result.

Can the CNIL force a site to delete my data?

A complaint may be lodged with the CNIL where a data controller wrongly refuses an erasure request. It may investigate the matter, issue a formal notice and, in the event of an established breach, impose sanctions of up to €20 million or 4% of worldwide annual turnover for the most serious breaches. It does not, however, act as a court that would directly order deletion subject to a daily penalty: for a binding urgent measure, the summary proceedings judge remains the fastest route.

What to do if the content reappears after being deleted?

The reappearance of content that has already been deleted or delisted is common, notably through republication on other sites or re-indexing. The reappearance must then be documented again by a dated screenshot, or even by a commissaire de justice's report, and the request repeated, targeting the new addresses concerned. If the organisation or the engine shows repeated ill will, these items strengthen a CNIL complaint file or a court action. The persistence of the content despite a favourable decision may justify an application for a daily penalty before the judge.

Do minors benefit from enhanced protection?

Yes. The GDPR pays particular attention to data collected from children in connection with online services, and Article 17 expressly mentions this situation among the grounds for erasure. Requests to delete data or content concerning events that occurred during minority are examined with greater sympathy, because the protection of the child largely outweighs the informational interest. A parent, or the young adult themselves, may start the process to erase old publications dating from adolescence.