The Right to Be Forgotten on Google: A Complete Legal Guide for Spain and Europe

A news story from years ago that no longer reflects who you are. A court case that was dismissed. A debt you paid off long ago. It doesn't matter that the situation has been resolved: if Google keeps showing it when people search your name, the damage continues every single day. The right to be forgotten exists precisely for this.

As a European citizen, you have a legally recognized right to ask Google to delist results containing personal information that is no longer relevant, is inaccurate or causes you disproportionate harm. It's one of the most powerful tools available for regaining control of your digital image, but you have to know how to use it properly.

It's essential to understand what the right to be forgotten is and what it is not:

When Google approves a right to be forgotten request, what it does is delist the result. This means the page will no longer appear in Google's search results when someone searches your name, but the page will still exist and will be accessible to anyone who knows the direct URL.

In addition, delisting applies only to the European versions of Google (google.es, google.fr, google.de, etc.). On google.com and other versions outside Europe, the result may still appear, although Google has been gradually expanding the geographic reach of delistings.

1. Legal origin: the Google Spain ruling

The right to be forgotten as we know it today was born on May 13, 2014, when the Court of Justice of the European Union (CJEU) handed down its landmark ruling in Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.

1.1. The Costeja case

Mario Costeja González was a Spanish citizen who discovered that when he searched his name on Google, a link appeared to a 1998 article in the newspaper La Vanguardia about a foreclosure auction of his property over Social Security debts.

The problem was that the debt had been paid off years earlier and the situation was no longer relevant. Yet every time someone searched his name, that negative information showed up among the top results.

Costeja asked La Vanguardia to remove the article, but the newspaper refused, arguing that it was truthful information that had been lawfully published. He then turned to the AEPD (Spain's Data Protection Agency), which partially upheld his complaint: it did not require La Vanguardia to remove the article, but it did order Google to delist the result.

Google appealed to Spain's National High Court (Audiencia Nacional), which referred a question for a preliminary ruling to the CJEU. And the CJEU sided with Costeja, establishing that:

• Search engines are responsible for the processing of personal data they carry out.
• Citizens have the right to request the delisting of results containing personal information that is inadequate, irrelevant or excessive.
• This right must be balanced against the right to information and the public interest.

1.2. The impact of the ruling

The Google Spain ruling was groundbreaking because:

2. The right to be forgotten under the GDPR

The General Data Protection Regulation (GDPR), which took effect on May 25, 2018, codified and expanded the right to be forgotten in its Article 17, under the name "right to erasure."

2.1. GDPR Article 17

Article 17 states that the data subject has the right to obtain the erasure of their personal data when:

1. Data is no longer necessary
   The data is no longer necessary for the purposes for which it was collected.
2. Consent is withdrawn
   The data subject withdraws consent and there is no other legal basis for the processing.
3. Objection to processing
   The data subject objects to the processing and there are no overriding legitimate grounds.
4. Unlawful processing
   The data has been processed unlawfully.
5. Legal obligation
   The data must be erased to comply with a legal obligation.
6. Children's data
   The data was collected in connection with the offer of information society services to children.

2.2. Exceptions

The right to erasure does not apply when the processing is necessary for:

2.3. How it applies to search engines

The GDPR, together with CJEU case law, establishes that search engines like Google are data controllers and are therefore required to handle right to be forgotten requests.

3. Requirements for exercising the right to be forgotten

Not every right to be forgotten request is approved. For your request to have a chance of success, you must meet certain requirements:

3.1. Requirements for the requester

• Be an EU citizen or resident: The right to be forgotten applies mainly to European citizens.
• Be the affected person: You can only request the delisting of information about yourself (or about a minor in your care, or a deceased person if you are their heir).
• Identify yourself properly: You must provide documentation proving your identity.

3.2. Requirements for the content

• Personal information: The content must include data that directly identifies you (name, image, etc.).
• Accessible by searching your name: The result must appear when someone searches your name.
• Inadequate, irrelevant or excessive: The information must meet at least one of these criteria.

3.3. Factors Google considers

Google evaluates each request individually, considering:

Factor	Key question	Favors approval if...
Passage of time	How much time has passed?	Several years have passed
Current relevance	Is it still relevant?	The situation has been resolved
Public interest	Does the public need to know?	There's no clear public interest
Requester's role	Public figure or private individual?	A private citizen
Nature of the info	Is it sensitive information?	Health data, sexual orientation, etc.
Impact	What harm does it cause?	Demonstrable, disproportionate harm
Context	Who published it?	Published by a third party, not by the affected person

4. Cases where it DOES work

Based on my professional experience and the guidelines published by data protection authorities, these are the types of cases most likely to succeed:

4.1. Old information about paid-off debts

As in the original Costeja case, information about foreclosures, debts or financial problems that were resolved years ago.

4.2. Dismissed court cases or acquittals

News about arrests, charges or trials that ended in acquittal, dismissal or a stay of proceedings. The principle of the presumption of innocence strengthens these cases.

4.3. Information about minors

The GDPR gives special protection to children's data. Information published when you were a minor is more likely to be delisted.

4.4. Medical or health information

Data about illnesses, treatments or health conditions is considered especially sensitive.

4.5. Information about your private life

Data about personal relationships, sexual orientation, religious beliefs or other aspects of private life that have no public relevance.

4.6. Outdated professional information

Information about previous jobs, old workplace disputes or professional situations that are no longer relevant.

4.7. Private citizens vs. public figures

If you're not a public figure (a politician, well-known businessperson or celebrity), your requests are more likely to succeed because the public interest in your information is lower.

• Debts paid off more than 2 years ago
• Court cases that were dismissed or ended in acquittal
• Information published when you were a minor
• Medical or health data disclosed without consent
• Information about your private life with no public relevance
• Outdated professional information (more than 5 years old)
• You're a private citizen, not a public figure

5. Cases where Google says no

Google denies roughly 55% of the URLs submitted. These are the most common reasons for denial:

5.1. Public figures

Politicians, prominent businesspeople, celebrities and other public figures face a higher bar. The public has a legitimate interest in knowing information about people who wield power or influence.

5.2. Information in the public interest

Information about serious crimes, corruption, fraud or conduct that affects the general interest usually remains indexed.

5.3. Accurate, current information

If the information is accurate and still relevant, Google will most likely deny the request.

5.4. Professional content

Information about your professional activity (customer reviews, information about your company) is usually considered to be in the public interest.

5.5. Recent criminal convictions

Information about criminal convictions, especially recent or serious ones, usually stays up because of the public interest.

5.6. Information the requester published

If you published the information yourself (on social media, for example), it's harder to argue that it should be delisted.

6. Step-by-step process for filing a request

If you've determined that your case meets the requirements, this is the process for submitting a right to be forgotten request to Google:

1. Document everything
   Gather the exact URLs you want delisted, screenshots of each page, the search terms that bring up these results and the reason each URL should be delisted.
2. Access Google's form
   Google has a specific form for right to be forgotten requests. You can reach it through the AEPD's page on the right to be forgotten or directly through Google Support.
3. Fill out the form
   Complete every field with accurate, complete information. I'll explain how to do this properly further down.
4. Attach documentation
   Include a copy of your ID and any additional documentation that supports your request.
5. Submit and wait
   Once you've submitted the request, Google will send you an acknowledgment of receipt and begin evaluating your case.
6. Google's response
   Google will respond by approving it, denying it or asking for more information. The usual timeframe is 4-6 weeks.

7. How to fill out Google's form

Google's right to be forgotten form has several sections. Here's how to complete each one:

7.1. Personal information

• Full name: Exactly as it appears on your ID.
• Country of residence: It must be an EU country.
• Email address: Where you'll receive communications from Google.

7.2. URLs to delist

For each URL, you must provide:

• Full URL: Copy the exact URL from the address bar.
• Search terms: What you search on Google that brings up this result.
• Reason for the request: Explain why this URL should be delisted.

7.3. Your arguments

This is the most important part. You must clearly explain:

• Why the information is inadequate, irrelevant or excessive
• What harm it causes you
• Why the public interest doesn't justify keeping it indexed
• Any relevant circumstances (passage of time, resolution of the situation, etc.)

7.4. Tips for making an effective case

8. Required documentation

8.1. Mandatory documentation

• Proof of identity: A national ID card (DNI), passport or equivalent document proving your identity and EU citizenship/residency.

8.2. Recommended documentation by case type

Case type	Recommended documentation
Court cases	Acquittal judgment or dismissal order. Criminal record certificate (if clean).
Paid-off debts	Debt cancellation certificate. Proof of payment or settlement letter.
Medical information	Medical documentation proving the sensitive nature of the information.
Minors	Documentation proving you were a minor at the time of publication.

9. Response times

9.1. Google's timeline

Google doesn't have a specific statutory deadline, but under the GDPR, data controllers must respond to data subject requests within a maximum of one month, which can be extended to three months in complex cases.

In practice, Google usually responds within 4-6 weeks.

9.2. Possible responses

Response	What it means	Next step
Full approval	All URLs will be delisted	Verify within 24-72h
Partial approval	Some URLs approved, others not	Rework the denied ones
Request for info	Google needs more information	Respond with documentation
Denial	The public interest prevails	Appeal to the AEPD or the courts

9.3. Time until delisting takes effect

If Google approves your request, delisting usually takes effect within 24-72 hours.

10. What to do if Google denies your request

If Google denies your request, all is not lost. You have several options:

10.1. Rework the request

Sometimes a denial is due to insufficient arguments. You can file a new request with:

• Stronger arguments
• Additional documentation
• New circumstances (more time elapsed, a change in your situation, etc.)

10.2. File a complaint with the AEPD

You can file a complaint with the Spanish Data Protection Agency (AEPD). The AEPD can order Google to delist the content.

10.3. Go to court

You can sue Google directly in the Spanish courts.

10.4. Alternative strategies

If the right to be forgotten doesn't work, consider other strategies such as reverse SEO or contacting the publisher of the content directly.

11. Filing a complaint with the AEPD

The Spanish Data Protection Agency is the competent body for resolving right to be forgotten complaints in Spain.

11.1. The complaint process

1. Prerequisite
   You must first have submitted a right to be forgotten request to Google and been denied (or not received a response within the deadline).
2. Filing
   You can file the complaint online through the AEPD's e-office portal or in person.
3. Documentation
   Include your original request to Google, Google's response (if any) and all relevant documentation.
4. Processing
   The AEPD will investigate the case and issue a decision.

11.2. Timelines

Proceedings before the AEPD can take anywhere from 6 months to 1 year, depending on the complexity of the case.

11.3. Decision

The AEPD can:

11.4. Appeals

If the AEPD dismisses your complaint, you can appeal to Spain's National High Court (Audiencia Nacional).

12. Going to court

You can go directly to court without going through the AEPD, or after exhausting the administrative route.

12.1. Jurisdiction

Spanish courts have jurisdiction to hear claims against Google relating to the right to be forgotten of Spanish citizens.

12.2. Types of proceedings

12.3. Costs

Going to court involves fees for a lawyer and a court representative (procurador). Consider whether the case justifies the investment.

12.4. Timelines

Court proceedings can take anywhere from 1 to 3 years, depending on the court level and any appeals.

13. The right to be forgotten on other search engines

Although Google dominates the market, the right to be forgotten also applies to other search engines:

13.1. Bing (Microsoft)

Microsoft has its own right to be forgotten request form for Bing.

13.2. Yahoo

Yahoo also accepts right to be forgotten requests from European citizens.

13.3. DuckDuckGo

Although DuckDuckGo markets itself as privacy-friendly, it must also comply with the GDPR.

13.4. Recommendation

If you file a right to be forgotten request, do it with every relevant search engine, not just Google.

14. Limitations of the right to be forgotten

It's important to understand the limitations of the right to be forgotten:

14.1. It doesn't remove the original content

The content still exists on the original website. It's only delisted from search engines.

14.2. Limited geographic scope

Delisting applies mainly in Europe. In other regions, the content may still appear.

14.3. It's not absolute

The right to be forgotten must be balanced against other rights, such as freedom of information.

14.4. It may be temporary

If circumstances change (for example, you're in the news again), Google could reindex the content.

14.5. The Streisand effect

In some cases, filing a right to be forgotten request can draw more attention to the information you want to hide.

15. Conclusions

The right to be forgotten is a powerful tool for protecting your privacy and online reputation, but it's not a magic fix. It requires meeting certain requirements, arguing your case properly and sometimes persisting through several levels of appeal.

Key points to remember:

• The right to be forgotten delists search results; it doesn't remove the original content.
• It works best for private citizens with old or irrelevant information.
• Public figures and information in the public interest face greater hurdles.
• If Google denies your request, you can turn to the AEPD or the courts.
• Combine the right to be forgotten with other strategies such as reverse SEO.

If you need professional help exercising your right to be forgotten or removing negative content from Google, Élite Reputación has a team that specializes in exercising the right to be forgotten and getting results delisted from Google and can guide you through the entire process.

16. Frequently asked questions about the right to be forgotten