- Business in Poland -
Right to be forgotten (GDPR) – how to remove data from Google and the internet?
The right to be forgotten is an individual's right to request the deletion of their personal data where the conditions set out in Article 17 GDPR are met and the controller has no legal basis for continuing to process it [1]. In practice, this may mean requesting deletion at the source, for example from an article, register, company website or online portal, as well as submitting a request to remove personal information from Google, meaning the removal of a search result that leads to specific content.
RTBF, short for the right to be forgotten, is not a right to "erase the internet". It is a tool that helps limit the visibility of information that is outdated, inadequate, excessive or unlawfully published. The assessment depends on the specific facts of the case, the type of data, the person's status, the public interest and the context of the publication.
GDPR right to erasure - when can it be used?
The GDPR regulates the right to erasure in Article 17. A data subject may request deletion of their data in particular where the data is no longer necessary for the purpose for which it was collected, consent has been withdrawn, an effective objection to processing has been lodged, or the data has been processed unlawfully [1].
In online matters, the issue most often concerns data disclosed in search results, archived publications, comments, profiles, PDF documents, press releases or media materials. For entrepreneurs, board members, managers and people active in public life, it is also important where old information affects reputation, business relationships, recruitment processes or the assessment of a contractor's credibility.
Not every negative or inconvenient search result justifies removal. If the information is true, current and relevant from the perspective of public debate or the security of business transactions, the chances of successful removal may be limited. However, if the result contains special categories of personal data, data concerning criminal convictions and offences, outdated allegations, information about discontinued proceedings, address details, a PESEL number, a private telephone number or content infringing personal rights, the argument for removal becomes stronger.
Removing data from Google vs removing content from the source website
Removing data from Google usually means de-indexing, that is, removing a specific result from the list of search results displayed after entering a person's first name, surname or another identifier. The content may still exist on the source website, but it is no longer easily accessible through the search engine.
Removal at the source, on the other hand, involves submitting a request to the website controller, editorial team, forum operator, employer, institution or other entity that publishes the data. In many cases, both actions need to be combined. First, the publication should be analysed, then a notice should be sent to the controller, and in parallel or subsequently an RTBF request should be submitted to Google.
Reputation-related matters often also involve the protection of personal rights, press law and liability for unlawful publications. In such cases, not only the GDPR is relevant, but also the provisions of the Civil Code, Press Law and standards concerning freedom of expression. More information about this area of practice can be found in the section on personal rights and media law.
How to submit an RTBF request to Google
Google provides a form for removing search results under European data protection laws. The request should be specific and fact-based. A general statement that a result is unfavourable is usually not enough.
Preparing the request should include:
- identifying the URLs to be removed from search results,
- specifying which personal data the result concerns,
- explaining why the data is outdated, inadequate, excessive or processed without a legal basis,
- describing the effects of the result's visibility, for example on reputation, professional relationships or safety,
- attaching documents confirming the circumstances, if necessary, such as a decision to discontinue proceedings, a judgment, a correction, or correspondence with the website controller.
It is worth distinguishing facts from opinions. If the matter concerns criminal, commercial, employment or media proceedings, the current status of the case should be clearly indicated. Information about the mere initiation of proceedings may carry different weight than information about a final conclusion, acquittal, discontinuance or limitation period expiry.
When can Google refuse to remove a search result?
The right to be forgotten is not absolute. This follows both from Article 17(3) GDPR and from the case law of the Court of Justice of the European Union in the Google Spain case, which established the standard for balancing privacy with the public's right to information [2].
In practice, three exceptions are particularly important:
- exercising the right of freedom of expression and information,
- compliance with a legal obligation or performance of a task carried out in the public interest or in the exercise of official authority,
- the establishment, exercise or defence of legal claims.
If a person holds public office, manages a company of significant market importance, participates in public debate or the matter concerns the security of business transactions, Google may decide that the public interest supports keeping the result visible. This does not automatically mean refusal, but it does require stronger arguments. A separate context applies to well-known individuals and public office holders, where the limits of privacy are discussed in the article on where protection of the image of public figures ends.
What to do if a data removal request is rejected?
A refusal by Google does not close the matter. Further action may be possible against the website controller, editorial office, hosting provider, social media platform or another entity processing the data. In certain cases, it may be worth considering a complaint to the President of the Personal Data Protection Office (UODO), a civil claim for protection of personal rights, a request for correction or removal of unlawful content, as well as actions related to breach of trade secrets, defamation or unlawful disclosure of information.
In business matters, it is important to secure evidence before it is changed or removed. This includes screenshots, URLs, indexing dates, copies of publications, correspondence and documents confirming that the data is outdated. Without such material, it is more difficult to prove the infringement and its consequences.
This material is for information purposes only and does not constitute legal advice. Assessing the effectiveness of an RTBF request requires an analysis of the specific content, the person's status, the grounds for data processing and possible exceptions. In matters concerning removal of data from Google, infringement of personal rights or publications affecting reputation, support may be provided by Kopeć & Zaborowski law firm.
FAQ - Right to be forgotten (GDPR)
Does the right to be forgotten allow any information to be removed from the internet?
No. The right to be forgotten applies where the conditions under Article 17 GDPR are met and no exception applies, such as freedom of expression and information, a legal obligation or the need to pursue legal claims.
Does removing data from Google remove the content from the source website?
Not always. Most often, Google removes the search result, but the publication itself remains on the website. That is why a request to the source controller is often also necessary.
How long does it take to review an RTBF request?
The time depends on the complexity of the case and the number of URLs reported. Google may ask for additional information, especially where the matter concerns a public figure, court proceedings or press materials.
Can a company use the right to be forgotten?
The GDPR protects the personal data of individuals, not the data of companies as such. However, a request may be submitted by, for example, a board member, shareholder, employee or manager if the search result concerns their personal data.
Can information about old criminal proceedings be removed?
It depends on the outcome of the proceedings, the time that has passed, the person's status and the public interest. Information about a final conviction is assessed differently from information about discontinued proceedings, an acquittal or outdated allegations.
What should be done if a publication infringes personal rights?
In addition to GDPR measures, civil claims may be considered, including a demand for an apology, removal of the effects of the infringement, payment of compensation or publication of a correction. The choice of action depends on the content of the publication and the available evidence.
Bibliography
- [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 - General Data Protection Regulation, in particular Article 17 and Article 21.
- [2] Judgment of the Court of Justice of the European Union of 13 May 2014, C-131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González.
- [3] European Data Protection Board, Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1), version 2.0, 7 July 2020.
- [4] Act of 23 April 1964 - Civil Code, in particular Article 23 and Article 24.
- [5] Act of 26 January 1984 - Press Law, in particular the provisions concerning press corrections.
Author: adw. Maciej Zaborowski, Managing Partner
E-mail: m.zaborowski@kkz.com.pl
