GDPR right to be forgotten procedure
Right to be forgotten GDPR Notice
How to serve a GDPR right to be forgotten Notice in 4 steps
If you wish to file a GDPR right to be forgotten Notice on a search engine, bear in mind that there isn't a GDPR right to be forgotten procedure that you must follow, as such. It means that you can start the process of applying to have links removed from search results in whichever way you choose, provided that you comply with the minimum notification requirements. There are, however, different steps that you can take.
Step 1: submit a right to be forgotten request
Step 2: Prepare your GDPR right to be forgotten Notice
Step 3: Consider your GDPR Notice as an appeal to a right to be forgotten refusal
Step 4: Appeal a GDPR Notice refusal
Step 1: submit a right to be forgotten request
The origin of the right to be forgotten was with a European court's decision that an individual had a right to have links to search results delisted from Google searches in relation to his or her name. When GDPR came into force, in May 2018, the right to be forgotten was formalised by local laws in each European country state and the scope of the right to be forgotten started to become clearer. Your first step should be to submit a right to be forgotten request and to make sure that all the links and search phrases that you have asked to be removed are valid and clickable. What you want, before you move to the next step, is to have a valid legal reason for any refusal of your right to be forgotten request. If the refusal is, for example, because the search engine say that they could not find the links or the web pages you were referring to, try first to rectify this.
When you submit a right to be forgotten request, which is denied by the search engine provider, you can (and should) serve the search engine with a formal right to be forgotten GDPR Notice. The GDPR Notice is a legal document which gives the search engine 1 month to respond to the link removal request. The legal effect of a right to be forgotten GDPR Notice is similar to that of a letter before legal action that you are required to send to your opponent before filing a claim against them in the the courts. There is no requirement to send a right to be forgotten standard form to Google before serving Google with a GDPR Notice. If you want to skip the step of Google's standard right to be forgotten form and move straight to a GDPR Notice, you can do so without being penalised by Google or by the courts. However, it is advisable, if you apply yourself, to start the right to be forgotten procedure with a simple right to be forgotten form as this is likely to be a cheaper and quicker option to have links removed from Google searches.
Step 2: Prepare your GDPR right to be forgotten Notice
It is wise, when following any right to be forgotten procedure, to follow an order that will maximise your investment of resources. Depending on the nature of the links that you are aiming to remove from Google searches, you can decide which route to follow first. If the matter is not as urgent for you, you might choose to complete a simple online form and then only escalate matters if and as required. For individuals that are applying to search engine providers, such as Google and Bing, to have links removed from search results, the easiest method to notify the search engine of your demand is by filling out the search engine's right to be forgotten online form. This, however, is not a requirement. If the matter is urgent for you, you might decide to serve the search engine with a GDPR Notice as soon as possible as this will save you time later.
The main search engines have deliberately limited the number of words that you can put in their online right to be forgotten form. This might be to your disadvantage because it is unlikely that you will be able to tell your full story and make your full legal arguments in less than 1000 characters, which translates to around 850 words maximum.
You will be pleading your case in the legal sense for your legal right to have links to the offending articles removed from the internet searches with very little physical space to do so. What we suggest you do, is give brief details of facts, followed by very detailed possible legal reasons, citing facts and how the law applies to them. Try to only include relevant information, even if you do not think that it will be helpful to your case. We suggest that you first type up your right to be forgotten submission on a word document to make sure that you have covered the right number of characters, otherwise the form will not be sent.
If your case is a little complicated, you will be able to take matters further but by this point, you have already scored your first refusal. If your right to be forgotten request has been refused, your next steps will be to choose from one of two options.
Step 3: Consider your GDPR Notice as an appeal to a right to be forgotten refusal
When you appeal a right to be forgotten refusal, you have to ensure that you deal with every possible objection (defence) you think the search engine might bring up. If, for example, in response to your right to be forgotten request, Google told you that it believed there was a public interest in continuing to process the offending links, you will have to ensure that within your right to be forgotten GDPR Notice, you are fully addressing the objection.
You can either serve the search engine provider with a formal GDPR Notice or appeal its right to be forgotten decision to refuse you to the ICO. Both tasks will take you a while and will require you to prepare good quality legal submissions. You could use both appeal routes at the same time but this might not be the best use of your resources. It is usually best to submit your GDPR Notice to the search engine and only if it is refused, consider taking the matter up with the ICO
Step 4: Appeal a GDPR Notice refusal
If after serving it with a GDPR Notice, the search engine provider is still refusing your right to be forgotten request, you will need to consider escalating matters and take the search engine provider to court for breaching your personal data.
If the appeal to the ICO about your right to be forgotten is refused by the ICO, you can ask for it to be reviewed within 30 days of receiving the refusal. If after the review, the ICO is still not on your side, you can either get a judicial review to look at the decision to refuse your representation or you can file a GDPR Notice with the search engine provided, if you haven't done so yet. There is clearly a lot to think about in terms of practical steps and strategy.
The GDPR right to be forgotten procedure offers you plenty of options. What is beyond any doubt, is that provided you have a reasonably good case, the personal character which is required and the means to persist, along with the evidence, then eventually you will succeed.
