When must search engines concede the “right to be forgotten”?

One of the most important new concepts to emerge in the world of privacy in recent years is the European Union's "right to be forgotten." Although the idea was first proposed during the revision of the EU's data protection rules in 2012, it was a judgment handed down in May 2014 by Europe's highest court, the Court of Justice of the European Union (CJEU), that gave it legal force. According to that ruling, the results of search engines operating in the EU are subject to the data protection laws there, since they frequently contain personal data. One consequence is that people have a right to demand that certain kinds of information should be deleted from those search results -- but not necessarily from the sites they link to. Strictly speaking, then, the "right to be forgotten" is more a "right to be remembered correctly."

However, that right is not absolute: it has to be weighed against the public interest. Links to outdated material that the person concerned believes is no longer relevant do not need to be removed if "there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made." That places a considerable burden on search engines, which are required to weigh the competing interests of the data subject and the public when requests to remove links are made. Given that the CJEU decision is less than a year old, it is not surprising that all parties affected by it -- EU data protection authorities, Internet companies, privacy lawyers, and individuals -- are still trying to understand exactly what it means in practice.