Course outline
Module 1
Module 1: Origins of the Right to Be Forgotten
Origins of the Right to Be Forgotten
Knowledge check
Q1. In which year did the Court of Justice of the European Union issue its landmark ruling in Google Spain v. AEPD and Mario Costeja González, widely regarded as the origin of the modern right to be forgotten?
- A. 2006
- B. 2010
- C. 2014 ✓
- D. 2018
Why: The CJEU ruled in May 2014 that search engine operators could be required to remove links to personal information that is inadequate, irrelevant, or no longer relevant, establishing a practical precedent for the right to be forgotten in the EU.
Q2. What was the name of the Spanish citizen whose complaint about an old newspaper notice about his property auction led to the 2014 CJEU ruling?
- A. Pablo Casado
- B. Mario Costeja González ✓
- C. Javier Solana
- D. Antonio Gutiérrez
Why: Mario Costeja González complained that Google search results linked to a 1998 La Vanguardia newspaper notice about a debt-related property auction involving him, which had long since been resolved.
Q3. Which earlier European legal instrument, adopted in 1995, contained provisions granting individuals rights to correct or delete inaccurate personal data and laid groundwork for later forgetting rights?
- A. The European Convention on Human Rights
- B. The Data Protection Directive 95/46/EC ✓
- C. The Treaty of Lisbon
- D. The Charter of Fundamental Rights of the EU
Why: The EU Data Protection Directive 95/46/EC established rights of access, rectification, and erasure of personal data, which the 2014 ruling and later the GDPR built upon.
Q4. Which regulation, which came into effect in 2018, explicitly codified a right to erasure, commonly called the right to be forgotten, in Article 17?
- A. The ePrivacy Directive
- B. The General Data Protection Regulation (GDPR) ✓
- C. The Digital Services Act
- D. The AI Act
Why: The GDPR's Article 17 gives data subjects the right to request erasure of personal data in specified circumstances, explicitly giving the concept a formal legal basis across the EU.
Q5. Which idea do many scholars cite as a philosophical precursor to the right to be forgotten, referring to the notion that people should be allowed to move on from past mistakes?
- A. The principle of double jeopardy
- B. The concept of a clean slate or second chance ✓
- C. The doctrine of res judicata
- D. The principle of presumption of innocence
Why: The clean slate idea, reflected in practices like expungement of criminal records and time-limited reporting of old debts, reflects the underlying value that individuals should not be perpetually defined by past actions.
Module 2
Module 2: Google Spain and the Landmark Ruling
Google Spain and the Landmark Ruling
Knowledge check
Q1. In the Google Spain v. AEPD and Mario Costeja González case (2014), which court delivered the landmark ruling that established a right to request delisting of certain search results?
- A. The European Court of Human Rights
- B. The Court of Justice of the European Union ✓
- C. The Spanish Constitutional Court
- D. The European Court of Auditors
Why: The Court of Justice of the European Union (CJEU) issued the ruling in May 2014. It held that search engine operators can be controlled as data controllers under the EU Data Protection Directive and may be required to remove links to personal information in certain circumstances.
Q2. What was the initial complaint that Mario Costeja González brought against Google?
- A. That Google had shared his bank account details with advertisers
- B. That searching his name returned links to a 1998 newspaper notice about a past debt auction of his property ✓
- C. That Google had refused to hire him as an engineer
- D. That Google Street View had photographed his private home
Why: Costeja González complained that searches of his name returned links to 1998 La Vanguardia newspaper pages announcing the forced sale of his property to recover social security debts. He argued the information was outdated and no longer relevant, and that the debt had been fully resolved.
Q3. Under the ruling, which of the following is a key factor in deciding whether a search result should be delisted?
- A. Whether the individual has paid for the search engine's premium services
- B. Whether the information is inadequate, irrelevant, or no longer relevant, or excessive in relation to the purposes of processing ✓
- C. Whether the website hosting the content has a registered trademark
- D. Whether the individual is a public official in their home country
Why: The CJEU stated that data subjects can request removal of links where the information appears inadequate, irrelevant, no longer relevant, or excessive in relation to the purposes for which it was processed, weighed against the public interest in access to the information.
Q4. What did the CJEU decide about the responsibility of the search engine operator relative to the original publisher?
- A. The search engine has no responsibility because it only indexes content created by others
- B. The search engine operator is responsible as a data controller, separately from the publisher of the original web page ✓
- C. Only the original publisher can be required to act, never the search engine
- D. The search engine is responsible only if the content was published in English
Why: The Court found that the search engine operator, which determines the purposes and means of processing when it indexes personal data, is a data controller in its own right. This means individuals can address delisting requests directly to the search engine without first requiring the original publisher to remove the content.
Q5. Which EU legislation was primarily interpreted by the Court in the Google Spain ruling, prior to the adoption of the GDPR?
- A. The Treaty of Lisbon
- B. The Data Protection Directive 95/46/EC ✓
- C. The E-Commerce Directive 2000/31/EC
- D. The Digital Services Act
Why: The ruling interpreted the Data Protection Directive 95/46/EC, which provided rights of access, rectification, erasure, and objection. The principles from this ruling were later carried into Article 17 of the GDPR, which codified a right to erasure, often called the right to be forgotten.
Module 3
Module 3: GDPR Article 17 Explained
GDPR Article 17 Explained
Knowledge check
Q1. What is the primary purpose of GDPR Article 17?
- A. To require companies to publish all personal data they hold
- B. To give individuals the right to have their personal data erased under certain conditions ✓
- C. To ban the processing of personal data by private companies
- D. To require individuals to pay a fee for every data access request
Why: Article 17 establishes the 'right to erasure', commonly known as the right to be forgotten, allowing individuals to request deletion of their personal data when specific conditions apply.
Q2. Which of the following is a valid ground under which a data subject can request erasure under Article 17?
- A. The data is no longer necessary for the purposes for which it was collected ✓
- B. The data subject simply dislikes the company that holds the data
- C. The controller has been profitable for more than five years
- D. The data is stored on servers located outside the EU
Why: Article 17(1)(a) allows erasure when personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
Q3. Within what time period must a data controller generally respond to an erasure request?
- A. 24 hours
- B. One month ✓
- C. Six months
- D. There is no time limit
Why: Under Article 12(3), controllers must respond to data subject requests without undue delay and in any event within one month of receipt, which may be extended by two further months for complex cases.
Q4. Which of the following is an exception where a controller may refuse an erasure request?
- A. The data subject has changed their mind about the service
- B. The processing is necessary for exercising the right of freedom of expression and information ✓
- C. The data subject is a minor who wants their data deleted
- D. The request was made by email rather than by post
Why: Article 17(3)(a) provides that the right to erasure does not apply where processing is necessary for exercising freedom of expression and information, alongside other exceptions such as legal obligations and public health reasons.
Q5. If a controller has made personal data public and must erase it, what additional obligation applies under Article 17?
- A. The controller must publish a press release about the erasure
- B. The controller must notify the data subject's family members
- C. The controller must take reasonable steps to inform other controllers processing the data that the data subject has requested erasure ✓
- D. The controller must pay compensation to the data subject
Why: Article 17(2) requires controllers who have made personal data public to take reasonable steps, including technical measures, to inform other controllers processing the data of the erasure request, including any links to or copies of that data.
Module 4
Module 4: Balancing Privacy Against Free Expression
Balancing Privacy Against Free Expression
Knowledge check
Q1. What is the core idea behind the 'right to be forgotten'?
- A. Individuals can demand that governments erase all records of their criminal history permanently.
- B. Individuals can in some circumstances ask that search engines or other platforms remove links to personal information that is outdated, inaccurate, or no longer relevant. ✓
- C. Individuals can require newspapers to delete every article ever written about them.
- D. Individuals can prevent any person from remembering or discussing their past publicly.
Why: The right to be forgotten generally refers to a right to request delisting or removal of personal data that is inadequate, irrelevant, or excessive, most famously applied to search engine results in the EU following the 2014 Google Spain case.
Q2. Which landmark case established the right to request removal of search engine results in the European Union?
- A. Schrems II
- B. Google Spain v. AEPD and Mario Costeja González ✓
- C. Digital Rights Ireland v. Minister for Communications
- D. Lindqvist v. Sweden
Why: In 2014 the Court of Justice of the European Union ruled in Google Spain v. AEPD and Mario Costeja González that search engines could be required to delist certain results linked to a person's name.
Q3. Why is the right to be forgotten often seen as being in tension with freedom of expression?
- A. It requires journalists to stop reporting on public figures entirely.
- B. Removing accurate, lawful information from search results can limit the public's access to information and the ability of others to speak about and research matters of public interest. ✓
- C. It allows governments to censor all online speech without oversight.
- D. It forces individuals to publish their personal histories publicly.
Why: Delisting can restrict access to truthful, lawfully published information, which affects the public's right to receive information and the press's ability to inform, creating a balancing challenge with expression rights.
Q4. Which factor is typically considered when deciding whether a request to delist personal information should be granted?
- A. Whether the individual has a large social media following.
- B. Whether the information is inaccurate, outdated, or irrelevant, weighed against the public interest in accessing it. ✓
- C. Whether the individual paid for the original publication.
- D. Whether the website hosting the content is located in the United States.
Why: Decisions generally weigh the accuracy, relevance, and age of the information against the public interest, with special attention to whether the data subject plays a role in public life.
Q5. How does the right to be forgotten differ from the deletion of content at its source?
- A. It requires the original publisher to destroy all copies of the content.
- B. It typically removes links from search results while the underlying content may remain available on the original website. ✓
- C. It only applies to government databases and never to private websites.
- D. It deletes the content from the internet worldwide in every case.
Why: Many delisting rulings only remove search engine links to the content, so the original page stays online, which is why the right is distinguished from full erasure at the source.
Module 5
Module 5: Search Engine Delisting Obligations
Search Engine Delisting Obligations
Knowledge check
Q1. In the landmark case Google Spain v AEPD and Mario Costeja Gonzalez (2014), what did the Court of Justice of the European Union establish regarding search engines?
- A. Search engines are exempt from data protection law because they only index publicly available information.
- B. Search engine operators are data controllers and may be required to delist links to personal information from search results for a name-based query, even if the source page remains online. ✓
- C. Search engines must delete the original source web pages hosting the personal information.
- D. Search engines are only responsible for content they actively host on their own servers.
Why: The CJEU held that the search engine operator processes personal data and is a data controller, so it can be required to remove links from name-based search results. The underlying publication could remain online, which distinguishes delisting from erasure at the source.
Q2. Which legal provision in the EU General Data Protection Regulation (GDPR) is most commonly cited as the basis for the right to be forgotten?
- A. Article 5, the principles relating to processing of personal data
- B. Article 17, the right to erasure ('right to be forgotten') ✓
- C. Article 22, automated individual decision-making
- D. Article 35, data protection impact assessment
Why: Article 17 GDPR provides the right to erasure, popularly known as the right to be forgotten, allowing individuals to request deletion of their personal data in specified circumstances.
Q3. Under the 2014 Google Spain ruling, which factor is NOT typically considered when assessing a delisting request from an individual?
- A. Whether the information is inaccurate, inadequate, irrelevant, or excessive
- B. The time elapsed since the information was published
- C. The role the individual plays in public life
- D. The number of times the individual has posted about the topic on social media ✓
Why: Delisting assessments weigh factors such as accuracy, relevance, the passage of time, and the public interest in the information, including the individual's public role. Frequency of the individual's own posting is not a standard factor.
Q4. What is the general territorial scope of search engine delisting obligations following the CJEU's 2019 ruling in Google v CNIL?
- A. Delisting must be applied worldwide to all search engine domains.
- B. Delisting is required only on the search engine's domain for the country of the requester.
- C. Delisting must be applied to the EU versions of the search engine, with geo-blocking measures to discourage access from within the EU, but there is no obligation to delist globally. ✓
- D. Delisting is not required at all once the source content is removed.
Why: In Google v CNIL (C-507/17), the CJEU held that EU law does not currently require global delisting. Operators must delist across relevant EU domains and take measures to discourage EU users from accessing de-listed results from outside the EU.
Q5. Which of the following best describes the relationship between a delisting request and the original publisher of the content?
- A. Delisting automatically requires the original publisher to remove the content.
- B. Delisting removes the link from search results for name-based queries, but the original content may remain accessible on the publisher's website. ✓
- C. Delisting is only available if the original publisher consents to the request.
- D. Delisting deletes the content permanently from the internet.
Why: Delisting affects only search engine results for queries based on a person's name. The source publication is not automatically altered, which is why individuals may also need to pursue erasure from the publisher separately.
Module 6
Module 6: Global Variations and Jurisdictional Conflicts
Global Variations and Jurisdictional Conflicts
Knowledge check
Q1. Which jurisdiction is most commonly associated with the origin of the modern 'right to be forgotten' through the 2014 Google Spain ruling?
- A. United States
- B. European Union ✓
- C. Japan
- D. Australia
Why: The Court of Justice of the European Union's 2014 Google Spain decision established a right for individuals to request removal of certain search results linked to their name, making the EU the primary origin of the modern right to be forgotten.
Q2. Why does the United States generally resist a broad right to be forgotten?
- A. Its courts have no authority over search engines
- B. Strong First Amendment protections for free speech and press limit government-compelled removal of lawfully published information ✓
- C. It has already fully adopted the GDPR
- D. Privacy law in the US does not address personal data at all
Why: US constitutional free speech protections, especially under the First Amendment, make it difficult to compel removal of truthful, lawfully obtained information, which conflicts with a broad right to be forgotten.
Q3. What jurisdictional conflict arises when an EU court orders a search engine to delist results?
- A. Whether the EU can enforce removal only within its own domains or require global delisting ✓
- B. Whether search engines must store data in paper form
- C. Whether individuals can sue in any language
- D. Whether copyright law applies to search snippets
Why: A central conflict is territorial scope: EU authorities may demand delisting across all versions of a search engine, including non-EU domains, which raises questions about extraterritorial reach and sovereignty over information access elsewhere.
Q4. Which country has a legal framework that explicitly recognizes a right to erasure but balances it differently from the EU, placing heavy weight on press freedom and public interest?
- A. Canada
- B. Brazil ✓
- C. Russia
- D. Norway
Why: Brazil's courts, including the Supreme Federal Court in 2021, rejected a broad right to be forgotten that would suppress information, reflecting a different balance favoring freedom of expression and public interest than the EU approach.
Q5. What is a common mechanism that helps resolve conflicts between right-to-be-forgotten requests and freedom of information across jurisdictions?
- A. Automatic deletion of all archived news
- B. Case-by-case balancing tests weighing privacy against public interest, such as the role of the person in public life ✓
- C. Abolishing all search engines in affected countries
- D. Requiring individuals to pay a fee to every publisher
Why: Courts and regulators typically apply case-by-case balancing, considering factors like the data subject's public role, the age and relevance of the information, and its public interest value, to reconcile competing rights.
Module 7
Module 7: Practical Steps for Requesting Erasure
Practical Steps for Requesting Erasure
Knowledge check
Q1. Which legal framework in the European Union first gave individuals a clear right to request the erasure of their personal data, commonly called the 'right to be forgotten'?
- A. The Data Protection Directive 95/46/EC only
- B. The General Data Protection Regulation (GDPR), which took effect in 2018 ✓
- C. The e-Privacy Directive of 2002
- D. The Charter of Fundamental Rights of the European Union, adopted in 1990
Why: The GDPR, effective 25 May 2018, codified the right to erasure in Article 17. Earlier the Court of Justice's 2014 Google Spain ruling recognized a similar right under the 1995 Directive, but the GDPR made it an explicit, enforceable right.
Q2. When making an erasure request to an organization, what is the first practical step you should take?
- A. File a complaint with a court immediately
- B. Identify the data controller and send a written request to their designated contact, such as a Data Protection Officer or privacy contact ✓
- C. Delete your account and assume the data is removed
- D. Post a public notice on social media demanding deletion
Why: Erasure requests should be sent to the data controller, usually via the privacy policy's contact details or the Data Protection Officer. A clear written request creates a record and starts the statutory response clock.
Q3. Under the GDPR, within what general timeframe must a controller respond to an erasure request?
- A. Within 90 days with no possibility of extension
- B. Within 24 hours of receiving the request
- C. Within one month of receipt, extendable by two further months for complex or numerous requests ✓
- D. Within five years of the request
Why: Article 12(3) GDPR requires a response within one month, which can be extended by up to two additional months where requests are complex or numerous. The controller must inform you of any extension within the first month.
Q4. Which of the following is a valid reason a controller may refuse an erasure request even when it is properly submitted?
- A. The data is embarrassing to you
- B. The company would prefer to keep the data for marketing
- C. The data is needed to exercise freedom of expression or to comply with a legal obligation ✓
- D. You did not include a copy of your passport with the request
Why: Article 17(3) lists exemptions, including freedom of expression and information, compliance with legal obligations, public health interests, archiving in the public interest, and legal claims. Commercial preference or embarrassment alone are not valid grounds for refusal.
Q5. If a controller refuses your erasure request or fails to respond, what is an appropriate next step?
- A. Accept the refusal permanently with no further options
- B. Pay a fee to the controller to reverse the decision
- C. Lodge a complaint with your national data protection authority or seek a judicial remedy ✓
- D. Ask a friend who works at the company to delete the data informally
Why: Individuals can complain to their national supervisory authority (such as the ICO in the UK or a national DPA in the EU) and can pursue a court remedy. Controllers must inform you of these options when they refuse a request.