Right to Be Forgotten vs. Right to Erasure: What Is the Difference?

Where the Terms Come From and Why They Are Used Interchangeably

The confusion between these two terms is understandable because they describe overlapping concepts, and journalists, lawyers, and technology commentators often use them without precision. But for anyone dealing with an actual data removal or de-indexing problem, the distinction matters practically.

The phrase "right to be forgotten" entered public consciousness in May 2014 when the Court of Justice of the European Union issued its landmark judgment in Case C-131/12, commonly called the Google Spain case. The court found that individuals could, under certain conditions, require search engines to de-index links to information about them. The ruling was immediately interpreted by media across the world as establishing a "right to be forgotten," and that phrase stuck. It is now embedded in general usage, in parliamentary debates, and in everyday conversation about online reputation and privacy.

The phrase "right to erasure" entered binding law three years later, when the General Data Protection Regulation came into force across the European Union. Article 17 of the GDPR is titled "Right to erasure (right to be forgotten)" and that title is itself a formulation that partially explains the ongoing conflation. The parenthetical acknowledges the popular phrase while establishing the formal legal term. However, Article 17 is substantially broader than what the 2014 court ruling addressed.

Understanding the history of each term makes it possible to use them correctly, invoke the right legal ground, and direct your request to the right party.

The Google Spain Case: How the Right to Be Forgotten Was Born

In 1998, a Spanish newspaper called La Vanguardia published two small notices about a property auction linked to social security debts owed by Mario Costeja Gonzalez. The notices were entirely lawful at the time. More than a decade later, Costeja Gonzalez found that searching his name on Google surfaced those old notices near the top of results. He argued the information was now outdated, irrelevant, and damaging to his reputation. He wanted the links removed.

The case eventually reached the Court of Justice of the European Union. In its 2014 ruling, the court reached two important conclusions that shaped the modern right to be forgotten.

First: Google is a data controller. By indexing and presenting search results, Google processes personal data and is therefore subject to European data protection law, regardless of the fact that the underlying content lives on a third-party website. This was a foundational finding because it established that search engines, not just original publishers, can be required to act on data subject requests.

Second: La Vanguardia, the newspaper that originally published the notices, did not have to remove anything. The court specifically held that the original publication was lawful and that the newspaper's freedom of expression and public interest in maintaining accurate historical records outweighed Costeja Gonzalez's privacy interest in having the newspaper content erased. What Costeja Gonzalez could require was that Google stop surfacing links to those notices in searches of his name.

The practical outcome is the model still in use today: de-indexing removes the search entry point to a piece of content without requiring the publisher to delete the article itself. The article continues to exist at its URL, accessible to anyone who knows the direct link or finds it through other means, but it no longer surfaces when someone searches the individual's name.

GDPR Article 17: How the Right to Erasure Actually Works

Article 17 of the GDPR created a formal, statutory right to have personal data erased under specific conditions. It applies to any data controller who processes personal data about a data subject, which is an enormously broad category: companies, apps, platforms, marketing agencies, data brokers, analytics providers, search engines, publishers, and virtually any organization that holds records about identifiable individuals.

The Six Grounds for Erasure

A data subject can invoke Article 17 on any of six grounds. Only one needs to apply for the request to be valid:

• 1
  The data is no longer necessary for the purpose for which it was originally collected or processed. A marketing database retaining contact information after a campaign has ended, for example, or a news archive indexing a person's address that was only relevant to a decades-old story.
• 2
  Consent is withdrawn and there is no other legal basis for processing. Applicable when the original data collection was based on consent and that consent is now revoked.
• 3
  The data subject objects under Article 21 and there are no overriding legitimate grounds for continued processing. This is the ground most commonly invoked for search engine de-indexing requests: the individual objects, and the data controller (Google) must demonstrate a compelling legitimate interest that outweighs the individual's privacy interest.
• 4
  The data was unlawfully processed from the outset. This covers data collected without a valid legal basis, data about protected categories collected without explicit consent, and data held in violation of data minimisation principles.
• 5
  A legal obligation requires erasure under EU or member state law.
• 6
  The data relates to a child and was collected in connection with information society services under Article 8. This ground reflects special protections for minors and is particularly relevant for content about young people published without adequate safeguards.

The Three Principal Exemptions

Article 17(3) lists circumstances in which the erasure obligation does not apply, even when a valid ground exists. These exemptions are the primary reason that requesting erasure directly from a news publisher almost always fails:

Freedom of expression and information. Where erasure would conflict with the right to freedom of expression and information, the controller can refuse. Journalism and the publication of news is protected here. A newspaper is entitled to argue that removing a true, contemporaneously accurate story conflicts with press freedom. Data protection authorities across Europe have consistently upheld this exemption for publishers maintaining factual archives.

Public interest in public health. Data processed for reasons of public health under Article 9(2)(h) and (i) is exempt. Less commonly invoked in the news article context but relevant for medical or epidemiological data.

Archiving, research, and statistical purposes. Data held for archiving in the public interest, scientific or historical research, or statistical purposes is exempt where erasure would seriously impair achievement of those objectives. Historical newspaper archives routinely invoke this exemption.

Establishment, exercise, or defence of legal claims. A controller may retain data if it is needed for litigation. This exemption is particularly relevant in cases where the article concerns ongoing legal proceedings.

Right to Erasure in Practice: Two Different Targets

When people encounter a damaging news article about themselves, they typically want one of two things: the article to disappear from Google, or the article to be removed from the publisher's website entirely. These are different objectives requiring different approaches.

Target 1: Search Engine De-Indexing (the Traditional RTBF)

This is what most people mean when they say "right to be forgotten." You submit a request to Google (or Bing, or another search engine) asking them to remove specific URLs from search results that appear when someone searches your name. Google processes these requests through a dedicated web form and evaluates each URL individually, weighing your privacy interest against the public interest in the information.

Google considers factors including: whether the information is about a public figure (higher bar for removal), whether the information is still current and relevant, whether the article concerns a matter of genuine public interest, and whether the information is accurate. For private individuals and for articles describing events that are now outdated and no longer relevant, de-indexing requests succeed at meaningful rates.

The request is made to Google as a data controller. You are invoking GDPR Article 17, typically relying on the Article 21 objection ground. The process applies to the European version of Google search results but can also affect other regions depending on your location and the nature of the request. Our detailed guide on how to file a Google right to be forgotten request walks through the mechanics step by step.

Target 2: Data Erasure from a Company's Systems

This is the broader Article 17 right in action. If a company holds your personal data in its database, marketing lists, CRM, backup systems, or internal records, and you have a valid ground under Article 17, you can require them to delete it. This applies to e-commerce platforms that retain purchase history, data brokers that sell personal profiles, marketing agencies that hold email addresses, analytics providers, and any other data controller processing personal data about you.

You send a formal erasure request to the data controller's privacy or data protection team, citing Article 17 and the applicable ground. The controller must respond within one month under Article 12 and must either confirm erasure, explain a legitimate exemption, or escalate for a further two-month extension with notice. If they refuse without valid justification, you can escalate to your national data protection authority.

For our clients at RemoveNews.ai, the relevant data erasure requests outside of search engines typically involve data aggregator sites and people-search platforms that republish news article excerpts alongside personal information in database form. These sites are often more responsive to direct Article 17 requests than major news publishers, since they do not benefit from the journalism exemption to the same degree. See our GDPR right to be forgotten for news articles guide for a deeper treatment of this distinction.

The Third Option: Right to Rectification Under Article 16

Most people dealing with a damaging news article focus entirely on erasure or de-indexing. They overlook a third right that is often more powerful in the specific context of factually inaccurate news coverage: the right to rectification under GDPR Article 16.

Article 16 gives any data subject the right to have inaccurate personal data corrected without undue delay, and incomplete personal data completed. The right does not require deletion. It requires correction. Where a news article contains false statements of fact about a specific individual, those false statements constitute inaccurate personal data processed by the publisher (and by search engines indexing the article).

The critical distinction from Article 17 is the exemption landscape. The freedom of expression exemption in Article 17(3)(a) is a broad defense for publishers maintaining accurate historical records. It does not, however, protect the continued publication of factually false information. A publisher cannot invoke press freedom to justify maintaining demonstrably incorrect facts about an individual. Article 16 rectification requests are therefore considerably harder for publishers to refuse when the factual inaccuracy is clearly documented.

Practical use cases for Article 16:

• 1
  Factual errors in a news article. The article states you were convicted; you were acquitted. The article states you were a company director; you were an employee. The article describes you as the subject of an investigation; you were a witness. These are inaccurate personal data claims, and Article 16 gives you a legal basis to request correction directly from the publisher.
• 2
  Outdated information presented as current. An article from five years ago describes you as facing charges that were subsequently dropped. The original article was accurate when published but is now misleading by omission. A rectification request can seek an update note or correction appended to the article.
• 3
  Incorrect quotes or misattributed statements. If an article attributes statements to you that you did not make, or quotes you inaccurately, Article 16 provides a formal ground for a correction request independent of any defamation claim.
• 4
  Search engine results displaying inaccurate snippets. Google and Bing can also receive Article 16 requests where the snippet or cached data shown in search results is factually incorrect, even if the underlying article has since been updated.

For a full treatment of how to pursue factual corrections and updates to news articles, see our guide on news article corrections and retractions, and our article covering what to do when a news article contains false information about you.

Comparison: Right to Be Forgotten, Right to Erasure, Right to Rectification

The following table shows the three rights side by side. This is the clearest way to see how they differ in practice and which one to reach for in a given situation.

Which Right to Invoke: A Practical Decision Framework

The correct right to invoke depends on three variables: whether the information is accurate, who holds it, and what outcome you want. The framework below walks through the key decision points.

Why Publishers Are Protected and Search Engines Are Not

The most common frustration people experience when trying to invoke their rights is that the news publisher will refuse any erasure request by citing freedom of expression. This is a legitimate defense that has been consistently upheld by data protection authorities and courts across Europe. Understanding why the exemption applies to publishers but not search engines is essential context for setting realistic expectations.

A news organisation's core function is the exercise of journalistic freedom. Article 85 of GDPR requires member states to provide exemptions for journalism, academic, artistic, and literary expression. National implementations of GDPR across EU member states have generally given broad protections to publishers. The argument is that requiring publishers to delete true, historically accurate articles from their archives at the request of the subjects of those articles would fundamentally undermine press freedom and the public record.

A search engine's function is categorically different. Google does not author content. It aggregates and surfaces links to third-party content based on algorithms. When Google indexes a page about an individual, it is acting as a secondary distributor of that person's personal data. The court in the Google Spain case reasoned that de-indexing links from name-specific searches does not prevent the underlying article from being accessed; it merely makes it harder to find via the search engine. The article remains part of the public record. The search engine's role as an intermediary allows it to remove the link without infringing press freedom.

This is why practitioners consistently direct clients toward de-indexing requests as the primary route when dealing with news articles. A request to the publisher citing GDPR Article 17 will almost always be refused. A well-prepared request to Google has a meaningfully higher success rate for private individuals who can demonstrate that the information is outdated, irrelevant, or disproportionate to current purposes.

For the specific mechanics of what Google evaluates and how to frame a request effectively, see our detailed walkthrough: how to file a Google right to be forgotten request.

Questions About the Right to Be Forgotten and Right to Erasure