Right to Be Forgotten: How to Delete Your Data from Google in Spain

🇪🇸 Read the original in Spanish

In the digital age, our private, professional, and financial lives leave a digital footprint that does not always disappear over time. A past mistake, a long-settled debt that still appears in an official gazette, or obsolete news about a judicial process in which you were fully acquitted can ruin anyone's reputation with a simple Google search. The right to be forgotten emerges precisely as the fundamental legal tool to regain control over our digital identity and demand the deletion or de-indexing of data that is no longer relevant, accurate, or of public interest.

What is the Right to Be Forgotten and What is its Legal Framework in Spain?

The right to be forgotten is not an absolute right to erase the past at our whim, but rather the right to prevent the dissemination of personal information on the internet when its location lacks public interest, is obsolete, or causes disproportionate harm to the privacy of the affected individual. Legally, it translates into two main actions: the deletion of data by the hosting website and the de-indexing by search engines (such as Google or Bing) so that they do not link your first and last names to specific search results.

Although the right to be forgotten is deeply rooted in the field of personal data protection (regulated by the EU General Data Protection Regulation and the Ley Orgánica 3/2018 [Organic Law on Data Protection]), its exercise and any claims for damages arising from its violation fall fully within Civil Law and the defense of fundamental rights.

The Anchor in Civil Law and the Civil Procedure Act

When the right to be forgotten is violated, causing moral or financial damage to a person's reputation, the Código Civil (Civil Code) and the Ley de Enjuiciamiento Civil (Civil Procedure Act, hereinafter "LEC") provide the substantive and procedural avenues to demand accountability:

1. Non-contractual civil liability (Article 1902 of the Civil Code): This article is the fundamental pillar for claiming compensation in Spain. It establishes that "he who by action or omission causes damage to another, involving fault or negligence, is obliged to repair the damage caused". If a search engine or database refuses to remove obsolete or harmful information after being formally requested to do so, it incurs negligence, generating the obligation to compensate for the moral and economic damages caused.
2. Civil judicial protection (Civil Procedure Act - Law 1/2000): To channel these claims, the LEC establishes in its Article 249.1.2º that lawsuits seeking protection of the right to honor, personal and family privacy, and self-image will be decided in an ordinary trial (juicio ordinario). Furthermore, the LEC allows for the request of injunctions (Articles 721 et seq. of the LEC) to demand the provisional removal of links or internet content while the main judicial proceeding is being resolved, thus preventing the reputational damage from continuing to multiply daily.

Requirements to Exercise the Right to Be Forgotten

For a right to be forgotten request to succeed, Spanish and EU jurisprudence require certain conditions to be met. It is not enough that you simply dislike the information; there must be a balancing test between the right to information and personality rights. The key criteria are:

• Passage of time: The information must have become obsolete. An administrative sanction from 10 years ago no longer holds current news relevance.
• Lack of public interest: If the affected person is not a public figure (politician, celebrity, public official) and the events are not of current social relevance, the right to privacy prevails.
• Inaccuracy or falsehood: If the published data is incorrect, incomplete, or has been superseded by reality (for example, appearing on a defaulters' list for a debt that was already declared non-existent by a court).
• Nature of the data: Maximum protection is granted to highly sensitive data (health, sexual orientation, ideology) or to events affecting minors.

Practical Step-by-Step Procedure to Delete Your Data from the Internet

If you have detected harmful or outdated information on the internet, you should follow an orderly protocol to ensure effective deletion and prepare the legal path in case of a refusal.

Step 1: Identification and Location of URLs

You must compile the exact web addresses (URLs) where the information you wish to delete appears, as well as screenshots of the Google search results where your name appears associated with those links.

Step 2: Direct Claim to the Website Publisher (Right to Erasure)

Before approaching search engines, it is advisable to contact the person responsible for the website hosting the information (newspaper, blog, official gazette, forum). You must send a formal request exercising your right to erasure (derecho de supresión). The website owner has a maximum period of 1 month to respond and execute the deletion.

Step 3: De-indexing Request to Search Engines

If the website publisher does not respond or refuses, claiming freedom of expression, you must contact the search engines (Google, Bing, Yahoo). Google has a specific online form for the "Removal of search results under European data protection law". In this request, you must provide:

• Your identity document (DNI, NIE [foreigner identification number], or Passport).
• The exact URLs you wish to de-index.
• The legal justification of why maintaining that link violates your rights (explaining the obsolescence, lack of public interest, or harm caused).

The search engine has a period of 1 month (extendable to 2 months in complex cases) to reply.

Step 4: Complaint to the Spanish Data Protection Agency (AEPD)

If the search engine or website rejects your request, you can file a free rights-protection complaint (reclamación de tutela de derechos) before the Agencia Española de Protección de Datos (Spanish Data Protection Agency, or AEPD). This public body will analyze the case and, if it rules in your favor, will issue a binding resolution forcing the search engine to remove the links under threat of heavy financial penalties.

Step 5: Civil Judicial Route for Removal and Damages

If the administrative route is insufficient, or if the reputational damage has been severe and quantifiable, a civil lawsuit under the LEC (juicio ordinario) must be filed, asking the judge for:

1. The permanent removal of the contents and links from the internet.
2. Financial compensation for moral and material damages based on Article 1902 of the Civil Code.

Deadlines, Amounts, and Key Figures You Must Know

Success in claiming the right to be forgotten depends heavily on strict compliance with legal deadlines and the correct financial valuation of damages:

• Search engine/website response deadline: 30 calendar days from receipt of the request.
• Statute of limitations for claiming civil damages: 1 year from the moment the affected party became aware of the damage and who caused it, in accordance with Article 1968.2º of the Civil Code.
• Cost of the administrative procedure: 0 €. Submitting requests to search engines and complaints to the AEPD is a free administrative process.
• AEPD sanctions for non-compliant companies: Can reach up to 20 million euros or 4% of the global annual turnover of the infringing company in very serious cases.
• Compensation for moral damages in civil courts: These vary depending on the severity and dissemination, but Spanish courts typically award compensation ranging between 3,000 € and 30,000 € for wrongful inclusion in defaulters' registries or the dissemination of obsolete personal data affecting professional honor.

Practical Examples of the Right to Be Forgotten in Action

To better understand how these rules operate in the reality of Spanish legal practice, we analyze two common scenarios:

Example 1: The Case of the Old Debt and the Defaulters' Registry

Carlos, a resident of Madrid, discovers that an internet search engine still links his name to an official gazette from 8 years ago, which published an enforcement order (providencia de apremio) for a traffic debt of 150 € that he had already paid at the time. This public indexing is preventing him from securing a mortgage to buy a home worth 180,000 €, as bank risk departments see the publication when searching his name online.

Carlos exercises his right to be forgotten before Google, providing proof of payment of the fine. Google de-indexes the link within 25 days, removing the digital trace of the old debt and allowing Carlos to clear his financial history to access credit.

Example 2: The Dismissal and the Obsolete Press News

María was investigated in 2016 in a case of suspected labor fraud at her company. A local newspaper published a digital news story with her full name and photo. In 2018, the investigating court decreed the dismissal and archiving of the case (sobreseimiento libre y archivo) regarding María, declaring her completely innocent. However, in 2024, when searching "María [Surnames]" on the internet, the first result is still the news of her indictment from 2016. Because of this, María has been rejected in 3 recruitment processes for executive positions with annual salaries of 45,000 €.

María requests de-indexing from Google and an update of the news article from the newspaper. Receiving no response within 30 days, she files a civil lawsuit under the LEC. The judge orders the newspaper to update the digital news piece to visibly indicate her acquittal and orders Google to de-index the link, additionally awarding María 12,000 € in compensation for moral damages and loss of professional opportunities, applying Article 1902 of the Civil Code.

Mistakes You Must Avoid

When trying to erase your digital footprint from the internet, making certain mistakes can invalidate your claim or delay the process unnecessarily:

• Not preserving evidence of the original publication: Taking simple screenshots is not always sufficient in a trial. It is vital to digitally certify the URLs (using content certification tools or a notary certificate, acta notarial) before the infringer can delete or modify the page upon receiving your complaint, which would cause you to lose proof of the damage.
• Directing the initial request only to the search engine: If the content is illegal or false, the first step should always be to try to get the original publisher to delete it. If you only ask Google for de-indexing, the information will still exist on the source website and can be found through other search engines or direct links.
• Arguing purely personal or subjective motives: Saying that information "bothers you" or "embarrasses you" is not a valid legal argument. You must base your request on objective criteria: inaccuracy, obsolescence, disproportion, lack of public interest, or violation of fundamental rights protected by the Civil Code.
• Letting the civil claim deadlines pass: If you intend to claim financial compensation for the damages caused by the dissemination of that information, remember that the statute of limitations is only 1 year. If you let that period pass from the moment you became aware of the publication and its impact, you will lose the right to demand financial compensation in court.

Frequently Asked Questions (FAQ)

Can the right to be forgotten be applied to news published in official gazettes (BOE, BOJA, BOP)?

Yes. Although publications in official gazettes are mandatory by law at the time, the Supreme Court and the AEPD have ruled that there is no public interest in search engines continuing to index sanctions, fines, or seizures of private citizens for life. The official gazette will keep the document in its historical archive, but search engines like Google must de-index the link so it does not appear when searching the citizen's name.

Can I demand the deletion of negative comments or reviews about my business?

The right to be forgotten protects natural persons, not legal entities or commercial brands. Negative reviews or opinions about a business on platforms like Google Reviews or TripAdvisor are protected by freedom of expression, provided they do not contain insults, slander, threats, or the owner's personal data. If there is provable defamation, you must resort to ordinary civil proceedings for unlawful interference with the right to honor (derecho al honor).

How long does Google take to delete a link once the request is accepted?

Once Google accepts the de-indexing request (either voluntarily or by order of the AEPD), the removal of the link from search results is usually almost immediate, becoming effective within 24 to 48 hours. However, resolving the initial request can take up to 30 days.

What happens if the information I want to delete is true but happened many years ago?

The truthfulness of the information does not prevent the exercise of the right to be forgotten. If the events occurred many years ago (for example, a criminal record that has already been expunged or a past bankruptcy that has been resolved), lack public relevance today, and cause you daily harm, you have the right to have them de-indexed from search engines so you can rebuild your life without the burden of your digital past.

Summary

• The right to be forgotten allows you to demand the removal of obsolete, inaccurate, or non-public interest personal data from source websites and search engines.
• The civil route (Civil Code and Civil Procedure Act) is the ideal tool to legally demand the removal of information and claim financial compensation for moral damages.
• The deadline for search engines and web publishers to respond to your deletion request is 30 days.
• Claims for compensation under non-contractual civil liability have a strict statute of limitations of 1 year.
• The administrative procedure before search engines and the Spanish Data Protection Agency (AEPD) is entirely free of charge for the citizen.

General legal information, not personalised legal advice. For your specific situation, ask your question for free at AbogadoAI — answers grounded in Spanish law (BOE), in English.

This is general information, not legal advice. Verify on the BOE or consult a lawyer for your specific case.