Right to be forgotten

What it is

In short: you have the right to be digitally “forgotten”, by having information about you removed from websites, databases, social platforms and digital archives.

Key features

• It is not an absolute right: it must be balanced against other fundamental rights.
• It has 6 specific grounds of application.
• It applies retroactively, even to old data.
• It applies to all data controllers: Big Tech, SMEs and public administrations (within the limits set by law).

The 6 grounds (Art. 17.1 GDPR)

You can request erasure when:

• a) The data is no longer necessary (Art. 17.1.a) — The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• b) You withdraw consent (Art. 17.1.b) — You withdraw the consent on which the processing is based and there is no other legal ground.
• c) You object to the processing (Art. 17.1.c) — You object to the processing (Art. 21) and there are no overriding legitimate grounds to continue.
• d) Unlawful processing (Art. 17.1.d) — The personal data has been processed unlawfully, in breach of the GDPR.
• e) Legal obligation to erase (Art. 17.1.e) — The data must be erased to comply with a legal obligation under EU or national law.
• f) Children’s data collected for online services (Art. 17.1.f) — The data was collected in relation to an offer of information society services to children (Art. 8 GDPR).

The 3 exceptions

The controller may refuse erasure if the processing is necessary for:

1. Freedom of expression and information (Art. 17.3.a)

This covers the right to report the news and freedom of the press.

Typical conflict: you want the data erased → the newspaper invokes the right to report.

The balancing test of the Italian Supreme Court. The right to report prevails if three cumulative conditions are met:

• Truth of the facts (or correct attribution to the source);
• Public interest in the information (social relevance);
• Restraint in how it is presented (measured language, no gratuitous harm).

✓ The right to be forgotten wins

• A 15-year-old article about a minor offence (shoplifting) with a conviction that has since been extinguished.
• An ordinary, non-public person involved in an event that is no longer current.
• News that has lost its context: it is no longer clear what happened next.

✕ The right to report wins

• A politician convicted of corruption: the public interest is permanent.
• A relevant historical event (for example the Tangentopoli scandal).
• A recent article about ongoing proceedings.

The time factor: the more time passes, the more the right to be forgotten tends to prevail. It is the right “to be forgotten” after a sentence has been served or after rehabilitation.

2. Legal obligation or public interest (Art. 17.3.b-c)

• Compliance with legal obligations (for example retention of tax data, anti-money-laundering rules).
• Reasons of public interest (for example public health, historical archives).

Example: a bank must keep documents for 10 years under anti-money-laundering law → it cannot erase them even if you ask.

3. Establishing, exercising or defending legal claims (Art. 17.3.e)

This applies when the controller (or you yourself) needs the data as evidence in legal proceedings.

Example: you have a pending lawsuit against a company. The company cannot erase the contract data, because it is needed as evidence.

The Class Action against Google

The Court of Milan has upheld the collective injunction action brought by some members of Algopolio, together with other applicants, against Google LLC, Google Ireland Limited and Google Italy S.r.l. (press release of 5 October 2026, in Italian). The decision concerns how Google handles requests to exercise the right to be forgotten under Arts. 17 and 21 GDPR, and recognises that its current procedures in practice prevent people from exercising it.

Google must allow users to attach documentation supporting their delisting requests and give reasons for any refusal, based on an assessment of the documents submitted. The procedures and forms must be changed by 15 November 2026, with a substantial financial penalty for each day of delay.

The case, the documents and the stages of the proceedings are on the Class Action against Google page.