Introduction

With the current popularity and increasingly important role of the world wide web in western society, many media controllers of previously offline information collections have chosen to follow this public shift towards the online information realm and uploaded their collection(s) on the web. However, this uploading of information collections on the web is not without consequences for individuals if the collection contains personal information. This became clear in what is taken to be the first big ‘right to be forgotten’ (RTBF) case, which evolved around two articles from 1998 in the online archive of the Spanish newspaper La Vanguardia (CJEU, 2014). The two articles consisted of just a few sentences and referred to a forced sale of property of a citizen – let's call him ‘G’ – due to a social security debt. G was disturbed by the online availability of these articles because the issue was long resolved. When his attempts to have the articles removed from La Vanguardia's website failed, he focused his wish ‘to be forgotten’ on Google Search, which displayed the articles as top results for a search on his full name. In the end, the Court of Justice of the European Union (CJEU) decided the case in G's favour and ordered Google Search to remove the URLs linking the 1998 articles to G's name from the search results. The CJEU held the opinion that an individual can have the right to have certain information removed (in this case the search results) – even if it is truthful information – if the information ‘at this point in time … appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing’ (CJEU, 2014).

The Google Spain case is a foretaste of the ‘official’ RTBF, which is formulated in Article 17 of the General Data Protection Regulation (GDPR), which came into force in May 2018. It gives individuals under certain conditions the right to ‘obtain from the controller the erasure of personal data concerning him or her’ (GDPR, Article 17). (In this chapter I take the GDPR as given, now implemented, and will not spend time arguing about all its problematic aspects and weaknesses.