Direito ao Esquecimento: Jurisprudência em Evolução em Contextos Digitais

The “Right to Be Forgotten” (RTBF) has become one of the most high-profile e debated aspects of EU data protection law, particularly in the context of search engines, online reputation, e freedom of expression. Rooted in the General Data Protection Regulation (GDPR) e first articulated by the Court of Justice of the European Union (CJEU) in 2014, the right has since evolved through both lemark jurisprudence e national court enforcement.

This article focuses on the CJEU’s decision in Google v CNIL (C-507/17)—a pivotal case that defined the geographic scope of RTBF—e explores how national courts e regulators are interpreting e applying the right in digital e cross-border contexts.

Origins: Google Spain (C-131/12)

The modern RTBF emerged from the Google Spain case, where the CJEU ruled that search engines are data controllers under EU law e must consider requests from individuals to de-index links to outdated, irrelevant, or excessive personal information, even if the original content remains online.

This case established that:

• Individuals have a right to request de-referencing of search results under certain conditions.
• Search engines must balance the right to privacy with freedom of information e public interest.

Google v CNIL (C-507/17): Territorial Limits of De-Referencing

In Google v Commission nationale de l’informatique et des libertés (CNIL), the CJEU considered whether Google was required to remove links globally, or only within the EU/EEA when responding to RTBF requests.

Facts:

• The French data protection authority (CNIL) fined Google for failing to remove links from all domain versions (e.g., google.com) after agreeing to de-index them from EU domains (e.g., google.fr, google.de).
• CNIL argued that limiting delisting to EU domains made the right ineffective.

CJEU Ruling:

• The Court held that global de-referencing is not required under EU law.
• However, EU law does allow Member States’ authorities to require broader de-referencing, depending on the circumstances e local legal balancing tests.

Implications:

• The RTBF is territorially limited to the EU/EEA—but must be effective within that scope, including through geo-blocking measures to prevent circumvention.
• National regulators retain the power to deme more expansive de-referencing, subject to proportionality e international law.

National Follow-Up e Judicial Trends

France

Following the CJEU ruling, CNIL revised its enforcement practices:

• Google e other platforms now use geo-fencing techniques to limit visibility of de-referenced content to EU users.
• French courts have continued to enforce RTBF requests with an emphasis on balancing with press freedom, particularly when dealing with public figures or judicial records.

Germany

German courts e the Federal Commissioner for Data Protection (BfDI) have supported de-referencing for outdated media reports that disproportionately harm individuals’ reputations.

• In one high-profile case, a businessperson succeeded in having search results about a long-ago conviction de-indexed under Article 17 GDPR.
• German courts often weigh freedom of expression heavily, but lean toward de-referencing where rehabilitation or personal reintegration is at stake.

Spain

Spain, the birthplace of RTBF jurisprudence, continues to see high volumes of requests.

• The Spanish Data Protection Agency (AEPD) regularly orders search engines to de-reference content that is not of public interest, especially in the case of private individuals or minor offenses.
• Courts support AEPD’s discretion, but stress the need for case-by-case balancing with the media’s right to report.

Current Legal Considerations for ISS Providers

1. Scope of Obligations
   Search engines e platforms must be able to implement de-referencing across all EU domains e apply geo-blocking where technically feasible.
2. Balancing Rights
   Decisions must weigh privacy rights against public interest, the nature of the content, the role of the individual, e the passage of time.
3. Accountability
   Controllers must document their legal reasoning for accepting or rejecting RTBF requests e be prepared to justify decisions to regulators.
4. Transparency e Appeal Rights
   Data subjects must be informed of the outcomes of their requests e have access to appeal mechanisms before national courts or data protection authorities.

Looking Ahead: The Role of the Digital Services Act (DSA)

While the GDPR remains the cornerstone for RTBF, the Digital Services Act (DSA) introduces complementary obligations for platforms around content moderation, transparency, e user rights, including appeal mechanisms e clearer procedures for the removal of illegal content. Though not a substitute for GDPR-based RTBF rights, the DSA strengthens the framework for heling e documenting takedown decisions.

Conclusão

The Right to Be Forgotten continues to evolve in digital contexts, especially as courts refine its scope e applicability. The Google v CNIL ruling brought important clarity on the territorial limits of de-referencing, but also affirmed that Member States may impose broader obligations where justified.

For digital platforms, search engines, e ISS providers, the challenge lies in navigating a complex patchwork of national approaches—balancing privacy, legal compliance, e freedom of information in every jurisdiction where they operate.

Need advice on how to hele RTBF requests, balance competing rights, or prepare your compliance strategy?

Our data protection e digital services team can help you build policies, train your moderation teams, e respond to regulator inquiries with confidence.