Gdpr

Search engines' right to be forgotten, EU privacy guarantors' guidelines

Three critical issues remain: the difference between deletion and erasure; the burden of proof; and the conflict between freedom of expression and privacy protection

of Regulations and Taxes

5 June 2026

Cyber internet security concept. GDPR and cybersecurity. Protection of private personal data. A person using internet on laptop on the background. Michael Traitov - stock.adobe.com

2' min read

Translated by AI

Versione italiana

2' min read

Translated by AI

Versione italiana

Providers of search engines play a crucial role in the online dissemination of personal data. According to the Gdpr (General Data Protection Regulation), individuals have the right to exercise the so-called right to be forgotten, i.e. they can request the removal of search results associated with their name. Removal does not mean removing the original content from the internet, but removing the link to that content from the search results associated with a person's name.

European Guidelines

The guidelines of the Edpb (European data protection board) on the right to be forgotten in search engine cases, according to the GDPR, clarify the criteria to be followed when search engines handle such removal requests. The right to be forgotten is not absolute: it can only be exercised if one of the six grounds listed in Article 17 of the GDPR applies, namely:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal basis for the processing;
the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for processing, or objects to the processing pursuant to Article 21(2);
the personal data have been processed unlawfully;
the personal data must be erased in order to comply with a legal obligation laid down by Union or Member State law to which the controller is subject; (1)
the personal data have been collected in connection with the provision of information society services referred to in Article 8(1).

Moreover, it should be remembered that there arefive exceptions under which a request for removal could be rejected, namely:

(a) for the exercise of the right to freedom of expression and information;

(b) for the performance of a legal obligation requiring the processing in accordance with Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) for reasons of public interest in the field ofpublic health in accordance with Article 9(2)(h) and (i) and Article 9(3);

(d) for archiving purposes in the public interest, for scientific or historical research or for statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the purposes of such processing;

(e) for the establishment, exercise or defence of aright in legal proceedings.

Three critical issues

Orienting oneself in the right to be forgotten means balancing conflicting fundamental rights and interests. The guidelines highlight three critical aspects:

Deletion vs. deletion: As a provider of a search engine, if a request for the right to be forgotten is granted, the URL will have to be removed from the list of results displayed when searching for the person's name. However, the content referred to in the list of results is not deleted, it remains available on the original publisher's website and may still appear in the search engine if a user performs a search usingkeywords other than the person's name;
Burden of Proof: According to the Gdpr's 'Right to object' (Article 21), the burden of proof falls on search engines. If an individual objects to the display of his data in search results on the basis of his specific situation, the presumption is in his favour. The result must be removed unless the search engine can actively demonstrate that it has legitimate and compelling reasons to object. This would be the case if the search engine could avail itself of one of the five exceptions listed by the Gdpr for the right to be forgotten (Article 17.3);
Freedom of Expression and Access to Information vs privacy: The most common exception to the right to be forgotten occurs when data processing is necessary for freedom of expression and information. Search engines should weigh the public interest in accessing information against the severity of the interference with the privacy of the individual, e.g. in terms of reputation. A key factor is the individual's role inpublic life (e.g. politicians versus private citizens).

Practical examples

The Edpb guidelines also show some concrete cases and how to deal with requests for the right to be forgotten, e.g. an adult asking to remove content from when he or she was a minor or an employee asking to remove references from when he or she worked at a company he or she left years ago.