Does the GDPR's "right to be forgotten" extend to Google's search results?

Question

I have recently "googled" my own full name and found out that some comments I made during my teens have been indexed by Google. Back then I have used my full name as a user-name on that website. I have deleted those comments from the indexed website successfully and they have now disappeared from the website entirely. However, they still show up on google searches, although if one accesses that website, none of my entries are there anymore, so the way I see it, the website did its job and respected my right to be forgotten. I wonder if the indexed entry will ever disappear from Google now. This is very concerning for me as I feel that my right to be forgotten is blatantly violated as that Google search entry is still there, even though that entry does not exist anymore.

Answer 1

Yes. The GDPR's right to be forgotten is even modeled after case law that was developed around Google search results. Thus, you may have a right – depending on your individual circumstances – to order Google to stop showing search results in Europe, where those results relate to you.

Note that this only affects search results in Europe, not searches from other regions. (See CJEU case C-131/12)

In your particular case, there's nothing to do but to wait. Google regularly checks and updates the pages that it has crawled and indexed. This can easily take multiple weeks. But once Google sees that the page no longer contains the information in question, the information will no longer appear in search results. Any process you'd try to accelerate this will probably take longer than just waiting.

Other sites may be keeping archives of the old version of the page, e.g. the Wayback Machine (https://web.archive.org) or https://archive.is. These will not typically be deleted automatically, and due to the way how these sites operate they might not be subject to GDPR.

---

Details on the RTBF:

• The GDPR enshrines a Right to Erasure / RTBF in Art 17.

• This right only applies under certain circumstances, for example if the personal data was collected based on a “legitimate interest” and you successfully “objected” to further processing. Such an objection would have to override the legitimate interests, and depends on your particular situation – why you want this data to be gone. Sometimes, there might be very good reason to keep the information, for example politicians should not be able to use this mechanism to censor reports of past misconduct.

• More relevant in this context is Art 17(3): when the website on which the information was published fulfilled your request to erasure, then,

  taking account of available technology and the cost of implementation, [it] shall take reasonable steps, including technical measures, to inform [other] controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

  This is legalese for: if someone removed personal data from their public website, they're supposed to tell Google that the information is gone and should be deleted from Google's indexes. This is possible e.g. by providing a sitemap.xml with accurate last-modified times, or by providing appropriate HTTP status codes like “410 Gone” when an entire URL is deleted.