Right to Be Forgotten
What does right to be forgotten mean?
The right to be forgotten refers to an individual's right to request the deletion of their personal data when it is no longer necessary, has been unlawfully processed, or the individual withdraws consent. This concept gained legal strength with the Court of Justice of the European Union’s ruling in the Google Spain case and is now codified in laws such as the GDPR.
How does right to be forgotten work?
When a data subject submits a valid request under the right to be forgotten, data controllers must erase the data without undue delay, unless retention is legally required or justified (e.g., for exercising freedom of expression, compliance with a legal obligation, or reasons of public interest). Businesses must verify the identity of the requester and determine whether an exception applies before deleting the data.
This right gives individuals control over their digital footprint and privacy, especially when outdated or irrelevant information affects their reputation or safety. It compels organizations to think critically about how long they retain data and encourages better data minimization practices.
FAQs about right to be forgotten
Yes. Search engines may be required to delist search results under certain circumstances, especially in the EU.
No. It is balanced against other rights such as freedom of expression and legal obligations.
Typically through a data subject request form provided by the business, often via a privacy dashboard or email.
Yes, if they process data of EU residents under the GDPR, they must comply with erasure requests.
Under GDPR, the controller must respond within one month, extendable by two months for complex requests.