Right to be forgotten

AI and the right to be forgotten

AI is significantly influencing the right to be forgotten. The right to be forgotten is a legal principle that permits people to request that specific personal information be removed from internet platforms. AI technologies are being used to speed up and automate responses to these requests.

Harnessing AI to empower the right to be forgotten

AI helps platforms efficiently process removal requests by analysing large amounts of data, making it easier to identify and remove specific information. This scalability improves the handling of requests. AI considers factors such as public interest, historical value, and individual circumstances when evaluating requests, making it possible to strike a balance between privacy rights and freedom of expression. By learning from past judgments and feedback, AI improves decision-making over time, adapting to different situations and increasing accuracy and fairness in future requests.

How can AI inhibit the exercise of the right to be forgotten?

AI inherits biases from training data, which can lead to unfair outcomes that disproportionately affect certain individuals or groups. Diverse and updated training data and strategies to reduce bias are necessary to address this. AI struggles with understanding nuanced context and complex personal data, making it difficult to accurately determine whether something should be removed or forgotten. This can result in incorrect conclusions. The lack of transparency in AI algorithms and decision-making undermines accountability and trust, making it challenging for individuals to understand why removal requests are accepted or denied. AI also faces challenges in identifying and removing inappropriate content across platforms, highlighting the need for cooperation and collaboration in the continuous improvement of algorithms.

AI provides a powerful tool for protecting children online, but it is also being misused by criminals to harm and exploit children online.

Learn more on AI Governance.

The right to be forgotten is a relatively recent and emerging legal concept with great implications for internet policies, freedom of expression, and privacy. If you live in a country that applies the right to be forgotten, you have the right to request the removal of certain web addresses from search engine results (also called delisting) or the deletion of certain personal data that you do not want search engines to process anymore.

Interpretation and implementation of the right to be forgotten

The right to be forgotten is still very much debated at the global level, partly due to conflicts in its interpretation, as well as to practical issues regarding its implementation.

The right to be forgotten first derives from the right to erasure, a long-standing principle in European data protection laws. Since the 1995 EU Directive on Data Protection, individuals have been granted the right to have all personal data related to them deleted when they leave a service or close an account. But the interpretation of the right to be forgotten has been extended in the wake of a landmark ruling by the Court of Justice of the European Union (CJEU) in 2014. In the Google Spain case, the CJEU ruled that, deriving from their right to erasure, individuals have a right to delisting. This means that they can request that the search engines delist certain links from their search index, if the results contain personal information that is ‘inadequate, irrelevant, or no longer relevant, or excessive’.

This ruling has raised a number of concerns, in particular regarding its practical implementation by search engines. In 2015, Google had set up an advisory council on the right to be forgotten to develop recommendations for ‘performing the balancing act between an individual’s right to privacy and the public’s interest in access to information’. In February 2018, Google announced that it had received 2.4 million requests for delisting URLs from Google searches since 2014, illustrating the great challenges faced by the company in order to comply with the CJEU ruling.

The right to be forgotten at the global level

Following the 2014 ruling of the CJEU, the right to be forgotten has been incorporated in the newly adopted EU General Data Protection Regulation (GDPR), and has increasingly been gaining ground worldwide.
From India to Brazil, and from Japan to Canada, the right to be forgotten has raised both significant interest and concern from courts, policymakers, companies, and civil society, as differing global positions regarding this emerging right remain.

Critics of the right to be forgotten argue that it could lead to the widespread removal of online content, and thus harm the freedom of expression and other human rights. For instance, though it supports the right to erasure, Access Now strongly opposes establishing a right to delist or a right to obscurity, because ‘if misinterpreted or implemented the wrong way â€” particularly in the absence of a comprehensive data protection law and with inadequate transparency â€” it poses a significant threat to human rights’.

Proponents of the right to be forgotten, and in particular of the right to delist, instead argue that the continuing availability of certain personal information can cause serious injustice to individuals, without any public interest in having such information available. The French data protection authority (CNIL) for instance, has been among the leading voices in favour of a global right to delist.

In 2019, in a landmark ruling, the CJEU decided as part of the Google v CNIL case that the territorial scope of the right to be forgotten and the obligation to delist under EU law (GDPR) only applies to the territory of the EU.

The map below shows which countries have implemented the right to be forgotten. This visualisation is based on data from several sources, such as the CJEU, government websites, and various online media sources.