A decade-old news story about a dropped lawsuit or a closed insolvency can still sit on page one when someone searches a founder’s or executive’s name, and right to be forgotten requests are often the only formal way to push it down. This article explains how these requests work under EU and UK data protection law, what they can and cannot do for reputation management, and how to prepare a request that has a realistic chance of success.
The main benefit is that a request goes through a legal process rather than a PR tactic. A successful request removes a specific result from name-based searches in Europe, and the search engine does it for free.
What the Right to Erasure Actually Covers
The right comes from the Court of Justice of the EU’s Google Spain v AEPD ruling (C-131/12) of 13 May 2014. It is now codified as Article 17 of the GDPR. The UK kept it after Brexit under the UK GDPR, and the High Court applied it in NT1 and NT2 v Google in 2018. In that case, one businessman won delisting and the other lost.
In practice, most requests are delisting requests sent to search engines. Google and Microsoft Bing both run dedicated web forms. If a request succeeds, the URL stops appearing when someone searches the person’s name. The article itself stays online and can still be found through other queries.
Geography matters too. In Google v CNIL (C-507/17, September 2019), the court ruled that EU law does not require delisting worldwide. Google applies removals to European search versions and uses geolocation to limit what EU-based users see. A searcher in New York will usually still find the result.
The Biggest Myth: Companies Can Use It to Erase Bad Press
Many business owners assume the right to be forgotten can remove negative reviews or critical coverage of their company. It cannot. The GDPR protects personal data of natural persons, so a limited company has no right to erasure over articles about the company.
An exception arises when content about a business is really about an identifiable individual, such as a sole trader or a named director. Even then, the request is made by that person about their personal data. It is not a brand protection tool. Reviews that are false or defamatory go through platform policies or defamation law instead. The guide on when to involve lawyers in online defamation covers that route.
Another myth is that requests are rubber-stamped. Google’s transparency report has shown for years that the company delists roughly half of the URLs it evaluates. Requests about politicians, senior executives and recent professional misconduct are rejected far more often.
How Search Engines Weigh a Request
Search engines balance the individual’s privacy against the public’s interest in access. The criteria come from the Article 29 Working Party guidelines (2014) and later case law. The factors that usually decide the outcome are:
– Role in public life – a CEO of a listed company gets less protection than a junior employee.
– Age of the information – a 2013 article is treated very differently from one published in 2024.
– Accuracy – since TU and RE v Google (C-460/20, December 2022), the requester must provide relevant evidence of manifest inaccuracy, but no court ruling is required.
– Sensitivity – health, sexual orientation and criminal data get extra weight under GC and Others v CNIL (C-136/17).
– Connection to current professional activity – old fraud allegations against someone still running a finance company will usually stay indexed.
Article 17(3) also lists exemptions, including freedom of expression and journalism, legal obligations, public health, archiving and legal claims. Publishers rely heavily on the journalism exemption.
A Practical Request Process, Step by Step
Take a typical case. The managing director of a mid-sized logistics firm in Germany finds a 2016 regional news article about a fraud investigation as the third result for their name. The investigation was dropped in 2017 and no follow-up was ever published. Two enterprise clients have mentioned the article during procurement checks.
An experienced reputation manager starts by documenting the evidence, not by filling in the form. The process usually runs like this.
First, capture the exact URLs and the search queries that surface them, with dated screenshots from an EU location. Second, collect proof of the outcome, such as the prosecutor’s closure notice. Third, write a short and factual explanation of why the information is outdated or incomplete and how it causes ongoing harm. Fourth, submit through Google’s and Bing’s forms separately, because they do not share decisions. Fifth, contact the publisher and ask for an update or a follow-up note. A corrected article often helps more than delisting.
Under GDPR Article 12(3), controllers must respond within one month, which can be extended by two more months for complex cases. Google typically answers simple requests in 2-6 weeks. If a request is rejected, the person can complain to their national data protection authority, such as the BfDI or a state DPA in Germany, the ICO in the UK, or the CNIL in France. They can also go to court.
Common Mistakes That Sink Requests
The most common mistake is bundling 30 URLs into one emotional request. Reviewers decide URL by URL. A request that mixes a legitimate case for delisting with mildly unflattering but accurate coverage weakens the whole submission.
The second is ignoring the Streisand effect. Some publishers write about delisting notices they receive, and requests can end up in the Lumen database. A clumsy request against a well-known outlet can create a new and fresher story. Before filing against a major title, an experienced practitioner asks whether the publisher has a history of covering takedown attempts.
The third is treating delisting as the end of the job. The same content often gets scraped onto aggregator sites, archived copies, or forum threads within months. Without ongoing monitoring, the problem quietly comes back. This matters especially for personal brands and executives, whose name searches carry commercial weight.
Where the Standard Advice Doesn’t Apply
The US has no general equivalent. California’s SB 568 lets minors remove content they posted themselves, but it does not reach third-party journalism. Section 230 also makes platform takedowns harder. For a US-based executive, suppression through stronger positive content is usually the only practical route.
Regulated industries face a different calculation. Financial services professionals listed in regulator registers, such as the FCA in the UK or BaFin in Germany, will rarely get disciplinary records delisted while they are still practicing. Organizations that run their own monitoring should also remember that they process personal data. The overview of GDPR compliance for reputation monitoring tools explains the obligations that apply.
FAQ
Can a business file a right to be forgotten request about negative reviews?
No. The right applies only to individuals’ personal data. Businesses must use platform review policies, defamation law, or consumer protection rules instead.
Does delisting remove the original article?
No. It only removes the URL from name-based search results in European search versions. Removing the source requires a separate request to the publisher, and publishers often refuse under the journalism exemption.
How long does a delisting request take?
The legal deadline is one month, extendable by two months. Most straightforward requests to Google are decided in 2-6 weeks.
Summary
Right to be forgotten requests work best for individuals with outdated, inaccurate, or disproportionately harmful search results. They do not work for companies trying to clean up their brand reputation. Building an evidence file before submitting improves the odds considerably. Each URL should be argued on its own merits, and the publisher should be contacted in parallel. After a successful delisting, keep monitoring the name, because copies of the same story tend to reappear somewhere else.