Input on the notion of « the right to be forgotten »: WP29 adopts common guidelines


Following the ruling rendered by the Court of Justice of the European Union (CJEU) on May 13th, 2014 in relation to the “right to be forgotten”, the European data protection authorities adopted common guidelines within the framework of the WP29.

The CJEU indeed consecrated the right for individuals to request from a search engine that their personal data be de-listed, i.e. that the information relating to them personally be no longer made available to the general public in a list of results following a query in the search engine. However, these requests should be assessed on a case-by-case basis, in the light of the economic interests of the search engine operator and the preponderant interest of the public in having access to the information concerned by the request for removal.

Several complaints filed with the data protection authorities, following a rejection of de-listing requests by search engines, enabled the establishment of a list of criteria, which, according to the CNIL, should be considered as non-exhaustive and evolving over time.

The table below is a summary of the factors to be taken into account – no single criterion being in itself decisive - by search engines and data protection authorities for the assessment of the legal basis of a de-listing request.


De-listing appropriate

De-listing non-appropriate

Public figure

Information concerning a public figure which relates to his/her family or health

Information concerning a public figure which relates to his/her professional life or facts which may contribute to a debate in a democratic society

The complainant is a minor

If the complainant is a minor, the child’s best interests must be a primary consideration


Accuracy and relevance of the data

Information which is inaccurate, which creates a misleading impression about the data subject, which may be qualified under criminal law as defamation, slander or libel, or which is excessive in relation to the context

Information which relates to the data subject’s professional life, depending on the profession and the public’s interest to have access to the information

Sensitive data

The CNIL is more likely to be favorable to the de-listing of data relative to the data subject’s racial or ethnic origins, political convictions or religious and philosophical beliefs, trade union membership, health or sexuality


Context of release of the information

Contents put online by the complainant, who wishes to have them de-listed

Contents that the complainant could reasonably have expected to be made public

Up-to-date data

Out-of-date information with regard to the initial context of the online release


Information which relates to a criminal offense

Information which relates to an offence covered by amnesty or to a minor offence, the publicity of which may have a disproportionate impact on the subject’s private life and is not overridden by the public’s interest in having access to that particular information


Other elements

Information causing a prejudice to the data subject or a risk such as identity theft or stalking


Information made public for journalistic or legal purposes


When de-listing is assessed to be appropriate, it should according to the CNIL’s document be effective on all relevant domain extensions (.fr, .com, etc.).

Furthermore, according to the same document, the practice of posting a notice informing the search engines’ users that some results have been removed would only be acceptable if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for de-listing of results. In this respect, Google opted for a universal notice posted under all name researches, regardless of content de-listing1.

1 “When you search for a name, you may see a notice that says that results may have been modified in accordance with data protection law in Europe. We’re showing this notice in Europe when a user searches for most names, not just pages that have been affected by a removal” (FAQ Privacy & Terms Google)