The right to be forgotten: erasing an old post or record

01What the right to erasure covers

Article 17 of the GDPR gives a right to erasure without undue delay, on a closed list of grounds. For an old publication the usable grounds are these.

• The data are no longer necessary for the purpose they were collected for.
• Consent was the basis and has been withdrawn, with no other basis available.
• You objected under Article 21(1) and there are no overriding legitimate grounds.
• The processing was unlawful.
• Where the data were made public, Article 17(2) adds a duty to inform other controllers.

Article 17(3) then removes the right where processing is necessary for freedom of expression and information, for a legal obligation or public-interest task, for public health, for archiving and research, or for legal claims. The first and the last are what you will be answered with.

02Two requests, two different targets

Erasure and de-listing are different requests with different targets. Treating one as the whole right to be forgotten is the usual reason a case stalls; run both where both are open.

03Google Spain: what it actually held

C-131/12 is the judgment the route rests on. Three holdings matter.

• A search engine operator is a controller for the processing it carries out, though it has no control over the pages it indexes.
• Links must be removed from the results even where the publication on the original page is lawful, and without the source first being erased.
• The data subject's rights generally override the interest of internet users on a name search; a role in public life can reverse that.

04How far de-listing reaches

In C-507/17, Google LLC v CNIL, the French regulator had ordered de-referencing on every version of the search engine worldwide. The Court held EU law imposes no obligation to act on all versions.

• The obligation covers the versions corresponding to all Member States.
• The operator must take sufficiently effective measures to prevent or at least seriously discourage an EU user from reaching the links on a name search.
• EU law does not prohibit global de-referencing; an authority or court may still order it under national standards.
• Google applies this by geolocation and states delistings are not applied outside the EU.

05The balancing test

The GDPR contains no checklist. The factors below come from the judgments and from the criteria the search engines publish.

C-136/17 adds that for special categories of data the operator must verify, before refusing, whether including the link is strictly necessary for users' freedom of information.

06Accuracy and the burden of proof

Where the argument is that the content is false, C-460/20 sets the standard: it is for the requester to establish manifest inaccuracy, with evidence that can reasonably be required.

• You do not need a court decision against the publisher first, not even an interim one.
• The operator cannot be required to investigate the facts; where the inaccuracy is not obvious from your evidence, there is no obligation to de-reference.
• Thumbnail images are separate processing needing their own weighing-up.

07Filing with Google Search

The European privacy route is a dedicated process, described on Google's delisting policy page. The test is whether the information is inaccurate, inadequate, irrelevant or excessive and whether the public interest in it remains.

Requests pass through automated triage before human reviewers, and no single factor is decisive. Google separately runs personal information removal policies open in any country, covering identification and financial numbers, private records, credentials and doxxing content.

08Filing with Bing

Microsoft runs its own process through the Bing European privacy request form, for European residents seeking to block results on their name, and states it must balance privacy against the public interest in free expression.

1. Give your full legal name, and for a request for another person their name and your relationship. A parent or guardian may submit for a minor, and a minor may submit alone.
2. Enter each search name separately; names with special characters count as different search names.
3. Select the country of residence and attach identity documents in jpg, png, docx or pdf format.
4. State whether the subject is a public figure or holds a role involving leadership, trust or safety.
5. Enter exact URLs, one per field. Search results pages are not accepted, and all URLs in one form must share the same topic and basis.
6. Sign the declaration. A repeat request on the same URLs may take up to 30 days.

09When the request is refused

Under Article 77 of the GDPR a data subject may complain to a supervisory authority, in particular in the Member State of habitual residence, and may seek a judicial remedy. The authorities are listed on the EDPB members page.

1. Read the refusal: a controller must give reasons and point you to the regulator and the courts.
2. Complain to the organisation first; regulators expect this step.
3. If unresolved, complain to your supervisory authority. In the UK that is the ICO, which publishes a template letter.
4. Keep the dated request, the acknowledgement and the refusal; that record is the complaint.

The ICO states an organisation has one calendar month to respond, extendable by two further months for a complex request if it tells you within the first month.

10The United Kingdom after Brexit

The right survived withdrawal. UK GDPR Article 17 is in force as part of UK law and is published in its UK form on legislation.gov.uk, with the same grounds and the same exceptions.

• Complaints go to the ICO, not to an EU supervisory authority.
• The ICO lists journalism and academic, artistic or literary purposes among the exemptions allowing refusal.
• Article 17 carries an extra ground for England and Wales only, in force from 31 March 2026, on data processed because of an allegation by a malicious person.
• The ICO states its erasure guidance is under review after the Data (Use and Access) Act.

11The United States: no erasure right

There is no general right to erasure in United States law and no equivalent de-listing process; Google states its delistings are not applied outside the EU, so a demand built on GDPR Article 17 has no force against a US publisher. The nearest deletion right is the California Consumer Privacy Act, which reaches personal information a business collected from you, not a publication.

The realistic options therefore differ in kind: operator negotiation, a documented approach to the publisher asking for deletion, a correction or de-indexing of the page; the narrow Google policies; and suppression, working on what ranks above a page that stays online.

SARAZIM LLC handles the administrative side of all three routes: the evidence record, the filings, the deadlines, escalation of a refusal, and monitoring for re-indexing. It does not practise law.