Following the Costeja judgement on May 13, 2014, the former Article 29 Working Group was formed to establish new guidelines regarding privacy on the web and, specifically, the right of a user to request the removal of personal information from the web and search engines. Referred to as the right to be forgotten, this is nowadays a fundamental right that, however, still is not always easy to determine and, despite the alignment of the rules throughout Europe, the final decision of whether or not a request is valid is assigned to the local guarantor authorities. However, if someone wants to know how to exercise the right to be forgotten on European search engines, he/she has to follow the Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR
GDPR Guidelines on the right to be forgotten on search engines
According to these guidelines, a request for de-indexing is based on the right to rectification/deletion and the right to object according to the general principles established by art. 17 of the GDPR. According to this article, we can list a number of criteria of the right to be forgotten established by the GDPR. The first reason why a user can invoke the right to be forgotten concerns the relevance of the data: in fact (according to art.17, paragraph 1, letter a) if personal information is no longer necessary in relation to the purposes for which it was initially collected or otherwise processed, the data subject may request a search engine provider to remove content linked to his or her name from the list of search results. In addition to that (according to the article 17 of the GDPR, paragraph 1, letter b), the data subject may obtain the erasure of personal data concerning him or her when he or she withdraws consent to the processing, although in this case it is the web publisher and not the search engine operator that indexes the data. According to letter c of the same paragraph, moreover, the data subject may also proceed in case of objection to the processing of his data and where there is no overriding legitimate reason to proceed with the processing by the controller. Examples of such cases are situations in which the personal information in question is not relevant to the professional life of the data subject but affects his or her private life, or in which it constitutes incitement to hatred, slander, defamation or similar crimes of opinion against the data subject, when the data is inaccurate or when it refers to crimes of relatively minor gravity committed long ago and therefore no longer of interest to the public, but constitutes a single source of prejudice to the data subject. Finally, a user can request the de-indexing of content on three other grounds: when personal data have been unlawfully processed (Article 17(1)(d)), when the said personal information has already been deleted from the source to comply with a legal obligation and therefore must also be de-indexed from the search engine (Article 17(1)(e)), or when personal data have been collected in connection with the offering of information society services to children (Article 17(1)(f)).