Original Research - Evidence-Based Analysis - Transparent Methodology
How Do EU Data Protection Authorities Explain the Right to Be Forgotten for News Articles?
A 12-country review of official guidance on search-engine delisting, old news and practical complaint routes
- Publication date
- Published by
- Info Remover Research
- Author
- Milan Eedel Bloedt, Founder, Info Remover
- Report URL
- https://info-remover.com/research/eu-right-to-be-forgotten-news-report-2026
Scope note: This report studies how official data protection authorities document the Right to Be Forgotten in the context of news and search results. It does not measure legal protection, predict whether a request will succeed, or provide legal advice.
The HTML edition on this page is the version of record.
Funding and Conflict of Interest Disclosure
This research was funded and conducted by Info Remover. Info Remover provides paid online content removal, search de-indexing, privacy and reputation services, including services that may involve Right to Be Forgotten requests. There was no external sponsor.
The practical steps, official forms and complaint routes in this report are provided so readers can use them without hiring Info Remover. No paid service is required to follow the procedures described below.
The study evaluates public documentation and official procedures. Info Remover client outcomes, internal case data and commercial conversion data were not used as evidence. This report is not independent of Info Remover's commercial interests, and Info Remover is not a law firm.
Executive Summary
The Right to Be Forgotten (RTBF) is often described as if it were a single removal mechanism. In practice, the official guidance reviewed in this study describes a more limited and more procedural reality. A person may ask a search engine to stop showing specified links for a name-based search, while the underlying article can remain online at the publisher. Whether delisting is justified can depend on factors such as freedom of expression, public interest, the age and accuracy of the information, the individual's public role and the nature of the underlying event.
Info Remover reviewed official data protection authority guidance, FAQs, complaint procedures and directly relevant decisions across 12 EU countries: Germany, France, Spain, Italy, the Netherlands, Belgium, Ireland, Austria, Sweden, Croatia, Malta and Poland. The fixed study contained 96 coded country-criterion fields (12 countries x 8 criteria). The final publication dataset contains 71 Yes, 13 Partially, 0 No clear guidance found and 12 Unknown / inaccessible, giving 84/96 (87.5%) substantively assessed coverage.
The strongest recurring cross-country pattern in the coded documentation is procedural. All 12 countries have a verified complaint or escalation route in the material reviewed. Substantive balancing factors are less uniformly documented. Journalism or freedom-of-expression considerations are clearly documented in 10 of 11 assessed countries, with one additional country coded Partially. Public interest is now assessed in all 12 countries, with 10 Yes and 2 Partially. The distinction between source removal and search-engine de-indexing is clearly explained in eight of 10 assessed countries and partially explained in two.
These findings should not be read as a ranking. A country with more accessible or detailed guidance is not necessarily more protective of privacy, more favourable to delisting requests or more likely to produce a successful outcome. Documentation quality and legal outcome are different questions.
Key Findings
| Finding | Verified result |
|---|---|
| Overall documentation coverage | 84/96 (87.5%) substantively assessed |
| Complaint / escalation route | 12 Yes / 12 assessed |
| Journalism / freedom of expression | 10 Yes, 1 Partially / 11 assessed; 1 Unknown |
| Public interest | 10 Yes, 2 Partially / 12 assessed |
| Source removal vs search de-indexing | 8 Yes, 2 Partially / 10 assessed; 2 Unknown |
| Remaining unresolved fields | 12/96 (12.5%) |
A second important result is that de-indexing and source removal are not the same action. France, Spain, Belgium, Ireland, Austria, Sweden, Poland and other reviewed authorities explain in varying levels of detail that removing a result from a name search does not necessarily remove the underlying article. A publisher controls the original source; a search engine separately controls the search-result processing.
A third result is that the official material consistently treats RTBF as a balancing exercise rather than an automatic deletion right. Public-interest and freedom-of-expression considerations recur across the reviewed guidance. Age matters in several jurisdictions, but age alone is not presented as sufficient. Accuracy matters, but disagreement with an opinion is not automatically the same as factual inaccuracy. Public role and the nature of the underlying event can also affect the analysis.
Key Terms and Legal Context
This report uses a small set of legal and procedural terms repeatedly:
| Term | Meaning in this report |
|---|---|
| GDPR | The EU General Data Protection Regulation (Regulation (EU) 2016/679). |
| Article 17 | The GDPR provision formally titled “Right to erasure (‘right to be forgotten’)”. It sets out grounds on which a person can ask a controller to erase personal data and also contains exceptions, including where processing is necessary for freedom of expression and information. |
| RTBF | Shorthand in this report for the Right to Be Forgotten. In search-engine cases, the practical remedy discussed by authorities can be delisting/de-indexing rather than deletion of the source article. |
| Delisting / de-indexing | Removing specified links from results shown when someone searches for the person's name. The underlying webpage can remain online and may still be found directly, through other queries or through another search engine. |
| Controller | The person or organisation that determines why and how personal data are processed. In this context, a search engine and a publisher can each be controllers for separate processing activities. |
| DPA | Data protection authority, used here as shorthand for a national data-protection supervisory authority. |
| Rights request | A request by an individual to exercise a GDPR data-protection right with the relevant controller. |
| Coding labels | Yes means direct, clear official support; Partially means incomplete, indirect or narrow official support; Unknown / inaccessible means the required official evidence could not be reliably established. These labels measure documentation, not the strength of the right or the chance of success. |
| Assessed | A coded field that is not Unknown / inaccessible. In the final statistics, assessed fields are Yes + Partially + No clear guidance found. |
These definitions provide EU-level legal context only. The country coding below remains based on the official national authority sources and scope rules described in the methodology.
What We Studied
The study asked one narrow question: how clearly do national data protection authorities explain the considerations and procedures relevant to Right to Be Forgotten requests involving news articles and search results? It did not test named individuals, submit live RTBF requests, measure response times in practice or assess the likelihood of removal.
The 12 countries were fixed before evidence review. Each country was assessed against eight predefined documentation criteria: journalism/freedom of expression, public interest, age/outdatedness, accuracy/inaccuracy, public role/public figure status, seriousness or nature of the underlying event, source removal versus search de-indexing, and complaint/escalation route.
Evidence was limited to official national data protection authority (DPA) material, including guidance pages, FAQs, procedures, complaint pages and directly relevant DPA decisions or case studies. Search snippets, law-firm commentary, search-engine optimization (SEO) content, Wikipedia and general media coverage were not used as evidence.
Findings by Criterion
| Documentation criterion | Yes / assessed | Partially / assessed | Unknown excluded |
|---|---|---|---|
| Journalism / freedom of expression | 10/11 | 1/11 | 1 |
| Public interest | 10/12 | 2/12 | 0 |
| Age / outdatedness | 9/11 | 2/11 | 1 |
| Accuracy / inaccuracy | 9/9 | 0/9 | 3 |
| Public role / public figure status | 8/10 | 2/10 | 2 |
| Seriousness / nature of underlying event | 5/9 | 4/9 | 3 |
| Source removal vs search de-indexing | 8/10 | 2/10 | 2 |
| Complaint / escalation route | 12/12 | 0/12 | 0 |
For each criterion, the assessed denominator counts Yes, Partially and No clear guidance found values. Unknown / inaccessible fields are excluded and shown separately. No field was coded No clear guidance found because retrieval limitations made it inappropriate to turn missing evidence into an absence claim.
Country Comparison
Y = Yes; P = Partially; U = Unknown / inaccessible. These are documentation codes, not outcome scores.
| Country | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
|---|---|---|---|---|---|---|---|---|
| Germany | Y | Y | Y | Y | Y | P | Y | Y |
| France | Y | Y | Y | Y | Y | Y | Y | Y |
| Spain | Y | Y | Y | Y | Y | P | Y | Y |
| Italy | Y | P | Y | Y | Y | Y | P | Y |
| Netherlands | U | Y | Y | Y | Y | Y | U | Y |
| Belgium | Y | Y | Y | Y | Y | Y | Y | Y |
| Ireland | Y | Y | P | Y | Y | P | Y | Y |
| Austria | Y | Y | Y | Y | U | P | Y | Y |
| Sweden | Y | Y | Y | Y | Y | Y | Y | Y |
| Croatia | P | Y | U | U | P | U | U | Y |
| Malta | Y | Y | Y | U | U | U | P | Y |
| Poland | Y | P | P | U | P | U | Y | Y |
Criteria: 1 journalism/freedom of expression; 2 public interest; 3 age/outdatedness; 4 accuracy/inaccuracy; 5 public role/public figure status; 6 seriousness/nature of underlying event; 7 source removal vs search de-indexing; 8 complaint/escalation route.
What the Guidance Actually Says
Journalism and freedom of expression
Article 17 is not an absolute right. Several authorities expressly connect erasure or delisting with freedom of expression and information, while others apply the same balance through decisions or search-engine guidance. The result is not a simple rule that old or damaging news should disappear. The public's continuing interest in access to the information can remain relevant.
Public interest
Public interest is one of the most consistently documented substantive considerations in the reviewed material. Authorities describe the relevance of the information to internet users, the context of the publication and, in some cases, whether the person remains active in the same professional or public sphere. In Poland, media-specific material from the data protection authority (UODO) discusses balancing media information interests against privacy; because it does not provide a full request-specific delisting test, Poland is coded Partially for this criterion.
Age, accuracy and later developments
Age is frequently relevant, but it is not equivalent to irrelevance. Some official material considers whether information has become outdated, whether later developments changed the context, or whether the information remains relevant to the person's current professional activity. In Austria, the data protection authority (DSB) published an explanation discussing outdated procedural information and context in a delisting judgment. Accuracy is likewise treated carefully: demonstrably inaccurate information can strengthen a request, while disagreement with commentary or opinion may not.
Public role and the underlying event
Several authorities consider whether the individual plays a role in public life and whether the information relates to that role. The nature of the underlying event can also matter. Official examples include distinctions involving professional conduct, political activity, disciplinary matters and criminal proceedings. Austria is coded Partially for the nature of the underlying event, and Poland is coded Partially for public role, because the recovered official material addresses those factors only within a narrower scope. These factors are not universal outcome rules.
Source removal and search de-indexing
This is the distinction most likely to be misunderstood by users. A publisher or website controls the original article. A search engine separately processes links in its search results. A successful name-based delisting request can therefore reduce visibility in search while leaving the source page online and reachable directly, through another query or through another search engine.
A Practical RTBF Framework
For someone dealing with an old news result, the practical sequence is usually more useful than the legal label. The first question is what outcome is actually wanted. If the goal is to stop a result appearing for a name search, the relevant first request is generally directed to the search engine. If the goal is to change, correct or remove the original article, the publisher or source controller is a separate route.
Before submitting a request, preserve the exact result URLs, the source-article URLs, screenshots and the search query used. Where relevant, document later developments, factual inaccuracies, changes in professional role or other context that explains why the result should be reassessed. Keep the original request and every response. Those records are commonly needed if the matter later goes to a DPA.
Under the GDPR, a controller generally has one month to tell an individual what action it has taken on a request to exercise rights under Articles 15-22, subject to a possible extension of up to two further months where the GDPR conditions are met. A DPA complaint is a separate process and should not be described as having the same one-month decision period unless the authority itself says so.
Practical Pathways by Country
The country summaries below are procedural guides derived from official authority pages and, where noted, limited historical material. They are not predictions of outcome. The listed forms, complaint routes and preparation steps are public procedures that readers can use directly; using Info Remover is not required.
EU legal context
- General Data Protection Regulation (GDPR), Article 4 - definitions including "controller": https://eur-lex.europa.eu/eli/reg/2016/679/art_4/oj
- General Data Protection Regulation (GDPR), Article 17 - Right to erasure ("right to be forgotten"): https://eur-lex.europa.eu/eli/reg/2016/679/
Germany
- Authority
- German supervisory authorities; the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) publishes the Google-specific complaint route used here
- Where to start
- For name-based Google delisting, submit the request to Google first. Contact the publisher/controller separately if the goal is to change or remove the source article.
- Search-engine route
- HmbBfDI directs people objecting to Google results for their name to Google's RTBF form. Each result URL must be identified and the personal circumstances and relevant context explained. If Google refuses, HmbBfDI can review the refusal.
- Source article
- Contact the publisher or other controller of the source content directly if you want source erasure, correction or another source-side change. A complaint about that controller should go to the competent German supervisory authority.
- What to prepare
- For the Google request: each exact result URL, a detailed explanation of the individual's particular situation and relevant circumstances, and supporting evidence where useful. For the HmbBfDI complaint: Google correspondence, the original request and Google reference number.
- If refused or ignored
- For a refused Google name-search delisting request, submit the refusal and full request record to HmbBfDI. For a publisher refusal, use the competent supervisory authority for that controller or another available remedy.
- DPA complaint route
- https://datenschutz-hamburg.de/service-information/beschwerde-oder-hinweis-einreichen/beschwerde-einreichen-google
- Important limitation
- Germany has decentralised data-protection supervision. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is not the sole authority for private-sector/search-engine complaints. This pathway uses a relevant German state-level (Land) authority's Google procedure and preserves that limited scope.
France
- Authority
- Commission nationale de l'informatique et des libertés (CNIL)
- Where to start
- Submit a delisting request to the search engine. Contact the website/publisher separately if you want the source content erased.
- Search-engine route
- Use the search engine's delisting form or contact route. CNIL links current forms for major engines and instructs the requester to identify the exact URL and explain why delisting is sought.
- Source article
- For deletion of the information on the source website, make a separate erasure request to the person or organisation responsible for the source site.
- What to prepare
- Exact result URL and reasons for the delisting request. Keep a copy/screenshot of the request and the response for escalation.
- If refused or ignored
- Complain to CNIL online or by post, or use the judicial route identified by CNIL. A refusal challenge does not guarantee delisting.
- DPA complaint route
- https://www.cnil.fr/fr/plainte/internet/contester-le-refus-dun-moteur-de-recherche-de-dereferencer-un-contenu-web-associe
- Important limitation
- CNIL provides dedicated national delisting guidance that sets out the search-engine request and escalation route.
Spain
- Authority
- Agencia Española de Protección de Datos (AEPD)
- Where to start
- For search delisting, contact the search engine first. You do not have to contact the original source before doing so.
- Search-engine route
- AEPD says the right must first be exercised against the search engine and links forms for major search engines such as Google, Bing and Yahoo.
- Source article
- Contact the publisher/controller separately if you want the source article itself corrected, erased or otherwise changed.
- What to prepare
- Use the search engine's form and identify the links/data at issue and the grounds for the request. Preserve the request and any response for a later AEPD complaint.
- If refused or ignored
- If the search engine does not respond or the response is inadequate, submit a complaint to AEPD. AEPD's decision can itself be challenged before the courts.
- DPA complaint route
- https://www.aepd.es/derechos-y-deberes/ejerce-tus-derechos
- Important limitation
- The AEPD pathway expressly confirms that a publisher request is not a prerequisite to search-engine delisting.
Italy
- Authority
- Garante per la protezione dei dati personali
- Where to start
- Exercise the relevant individual right under the GDPR directly with the controller. For a Right to Be Forgotten request, Article 17 is the main erasure provision discussed in this report. For search delisting, the search engine is the relevant controller; for source deletion, contact the publisher/source controller separately.
- Search-engine route
- Use the search engine's rights/delisting channel. Garante's RTBF page confirms that search-engine operators are controllers for the processing at issue, while the general rights page explains how to address a controller.
- Source article
- Submit a separate erasure/correction request to the publisher or site controller if the goal is to change the original publication.
- What to prepare
- Identify the specific personal data, categories or processing at issue and the requested action. The Garante complaint model asks for detailed facts, controller identification, prior requests where made, alleged infringements and requested measures.
- If refused or ignored
- The person may complain to Garante or use the judicial route. Filing the Garante complaint is free.
- DPA complaint route
- https://www.garanteprivacy.it/diritti/come-agire-per-tutelare-i-tuoi-dati-personali/reclamo
- Important limitation
- Garante's thematic RTBF page focuses partly on decisions and case law; the procedural steps are set out more directly on the general exercise-of-rights and complaint pages.
Netherlands
- Authority
- Autoriteit Persoonsgegevens (AP)
- Where to start
- Contact the relevant controller first. For search delisting this means the search engine; for changing/removing the source, contact the publisher or website controller separately.
- Search-engine route
- Use the search engine's own privacy/RTBF rights channel. The current AP complaint guidance recovered in this pass is general and does not provide a dedicated search-engine RTBF form.
- Source article
- Contact the publisher/site controller directly if you want the original article or source information corrected or removed.
- What to prepare
- For AP escalation, prepare screenshots and a copy of your contact with the organisation, including its response if any, and explain clearly what the complaint concerns and what outcome you seek. Search-specific request fields are not stated on the AP page recovered.
- If refused or ignored
- Contact the organisation again if useful, then submit an AP complaint with evidence. AP also states that for privacy-rights disputes a civil petition can sometimes be faster.
- DPA complaint route
- https://autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap
- Important limitation
- A current AP search-engine-specific request page or form was not reliably recovered. The general AP complaint route is verified, so this is a documentation gap rather than evidence that no RTBF route exists.
Belgium
- Authority
- Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD)
- Where to start
- Contact the original source/editor if you want source content removed and/or contact the search engine separately for delisting.
- Search-engine route
- GBA's dedicated desindexering page links online forms for Bing, Google, Yahoo, Ecosia, Qwant, Startpage and Lilo.
- Source article
- GBA recommends first contacting the web editor and/or original source when the goal is to make personal data disappear from the website itself.
- What to prepare
- Be complete and accurate and provide the documents needed to substantiate the request without unnecessary personal data. For complaints, preserve and attach all communications with the controller.
- If refused or ignored
- Request mediation from GBA or file a formal complaint if the publisher/search engine does not respond or refuses.
- DPA complaint route
- https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen
- Important limitation
- Dedicated GBA desindexering guidance directly documents the source/search distinction, search-engine request routes and public-role balancing.
Ireland
- Authority
- Data Protection Commission (DPC)
- Where to start
- Contact the relevant organisation/controller first. For delisting, this is the search engine; for source removal/correction, contact the publisher/controller separately.
- Search-engine route
- Submit a delisting/erasure request through the search engine's rights channel. DPC case-study material confirms search-engine delisting as a distinct process, while the procedural pages require prior controller contact before escalating to DPC.
- Source article
- Contact the source publisher/controller directly for erasure, correction or other source-side changes.
- What to prepare
- For DPC escalation: details of the specific data-protection issue, documentary evidence supporting the allegation, relevant correspondence with the controller, and signed authority if a representative acts.
- If refused or ignored
- If you have contacted the organisation and are unhappy with the outcome, raise the matter with DPC through its online form.
- DPA complaint route
- https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-commission
- Important limitation
- DPC's practical route is split across rights, timing, evidence and case-study pages rather than a single dedicated national RTBF procedure page.
Austria
- Authority
- Österreichische Datenschutzbehörde (DSB)
- Where to start
- DSB recommends checking the original site and first trying the website owner for source deletion. A separate delisting request can also be made to each search-engine operator.
- Search-engine route
- DSB links GDPR/EU-law removal forms for Google and Bing and explains that each search engine must be addressed separately.
- Source article
- Contact the website owner/controller and request erasure under Article 17 if the goal is to remove the information from the source.
- What to prepare
- Document the page and data with printouts/screenshots before action. For a DSB complaint based on a request-dependent right, include a copy of the prior request and, where available, the controller's response.
- If refused or ignored
- File a complaint with DSB for infringement of the right to erasure. The complaint can target a search-engine operator or source controller according to the processing complained of.
- DPA complaint route
- https://dsb.gv.at/eingabe-an-die-dsb/beschwerde
- Important limitation
- The authority recommends source-side action first, but also recognises a separate search-engine complaint and links Google/Bing delisting routes.
Sweden
- Authority
- Integritetsskyddsmyndigheten (IMY)
- Where to start
- Contact the search engine directly for removal of name-based search results. Contact the source controller separately if you want the underlying information erased or corrected.
- Search-engine route
- IMY says to contact the search engine by its form, email or letter and links Google and Bing forms. The requester must identify the search hits and explain why they should be removed.
- Source article
- For source erasure, contact the controller that publishes/processes the source information directly.
- What to prepare
- Specify the search results concerned and explain the reasons for removal. A complaint must identify the processing/controller and the complainant; retain the prior request and relevant materials.
- If refused or ignored
- File a complaint with IMY. IMY assesses whether there is reason to begin supervision of the search engine. A private action in general court is also identified.
- DPA complaint route
- https://www.imy.se/privatperson/utfora-arenden/lamna-ett-klagomal/
- Important limitation
- Current dedicated search-result guidance was updated 15 June 2026.
Croatia
- Authority
- Agencija za zaštitu osobnih podataka (AZOP)
- Where to start
- For Google name-search results, AZOP provides a direct Google RTBF pathway. For source-side rights, contact the relevant controller in writing.
- Search-engine route
- AZOP instructs users to open Google's RTBF form, complete all requested information, provide additional information where useful, confirm the declarations, date/sign and submit.
- Source article
- Contact the publisher/source controller in writing to exercise GDPR rights where the goal is source erasure or correction.
- What to prepare
- Google form fields and supporting context. For AZOP: name and address details, detailed description of the violation, and copies of relevant documents/correspondence supporting the claim.
- If refused or ignored
- Submit a request to AZOP for determination of a rights violation.
- DPA complaint route
- https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava/
- Important limitation
- Do not use this pathway to upgrade the original source-vs-search criterion without separate criterion-specific evidence; the dedicated route is strong for Google procedure, not for the full conceptual distinction.
Malta
- Authority
- Office of the Information and Data Protection Commissioner (IDPC)
- Where to start
- Exercise the right directly with the relevant controller or its Data Protection Officer (DPO). For search delisting, that means the search-engine controller; for source erasure/correction, contact the publisher/controller.
- Search-engine route
- No dedicated Malta search-engine RTBF form was recovered from IDPC. Use the search engine's own GDPR/RTBF rights channel as the controller, then use the IDPC complaint route if the response is absent or unsatisfactory.
- Source article
- Request erasure or correction directly from the publisher/site controller where the desired outcome concerns the original publication.
- What to prepare
- Make the rights request in writing where possible and explain the concern with supporting evidence. For the IDPC complaint, include supporting documentation and full details of both complainant and controller.
- If refused or ignored
- Submit a formal complaint to IDPC through its dedicated online form.
- DPA complaint route
- https://idpc.org.mt/file-a-complaint/
- Important limitation
- Practical escalation is verified, but search-specific national instructions remain partial.
Poland
- Authority
- Urząd Ochrony Danych Osobowych / President of UODO
- Where to start
- Choose the controller based on the outcome you want: contact the website/publisher for source-side deletion, or the search-engine controller for removal of name-based search-result links.
- Search-engine route
- UODO's 2026 guide says to contact the search-engine controller and links Google, Bing, Brave Search, Yahoo and DuckDuckGo removal routes.
- Source article
- Use the source-controller route described earlier in UODO's guide if you want the original website/portal data erased.
- What to prepare
- For search delisting, include the exact URLs containing the disputed personal data and show that the request concerns your own data. Preserve the request and response. A written complaint must identify the complainant/controller, describe the breach and include evidence.
- If refused or ignored
- Complain to the President of UODO if the controller refuses or fails to answer in time.
- DPA complaint route
- https://uodo.gov.pl/pl/493/4098
- Important limitation
- The current UODO guide was published 10 March 2026 and directly documents timing, search-engine forms, source/search distinction and the UODO escalation route.
Methodology
The country list and eight criteria were fixed before final coding. Discovery combined official-domain searches, DPA navigation, rights pages, FAQs, complaint procedures, official PDFs and directly relevant decisions or case studies. Evidence was accepted only where the authority itself explained the relevant point. Party submissions quoted in decisions were not automatically treated as authority reasoning.
Each country-criterion pair was coded Yes, Partially, No clear guidance found or Unknown / inaccessible. Yes required direct and sufficiently clear official support. Partially was used where the authority addressed the point only incompletely, indirectly or in a narrow example. Unknown / inaccessible was used where official evidence could not be reliably recovered. Unknown was never treated as No.
Every newly used source supporting a Yes or Partially value was reopened and checked in a second pass. The final data table, evidence table and country matrix were cross-checked for consistency. This was an AI-assisted research and verification process, not independent human legal review.
Germany required a methodological exception because data-protection supervision is decentralised. The study therefore uses relevant German state-level (Land) and joint supervisory material with explicit attribution rather than treating the federal BfDI as the sole national authority for private-sector search-engine complaints.
The Netherlands also requires a scope note. Five balancing criteria are supported by an official May 2017 AP search-delisting mediation report issued under the former Dutch Data Protection Act (Wet bescherming persoonsgegevens, Wbp), before the GDPR became applicable. Those findings are evidence that the Dutch authority documented those factors historically; they are not presented as a complete current Dutch Article 17 test. The current AP complaint route is separately verified from the present AP website.
After the main coding and pathway audit, a final targeted recovery pass re-examined only the 18 then-unresolved fields. Six were recovered: Austria age/outdatedness and accuracy as Yes, Austria event nature/seriousness as Partially, and Poland public interest, age/outdatedness and public role as Partially. Twelve remained Unknown. The Austrian evidence is a DSB-published explanation of Court of Justice of the European Union (CJEU) judgment C-136/17 rather than a new Austrian DPA decision on an individual complaint. The Polish evidence is the President of UODO's media-conference conclusions and recommendations, so the three recovered fields remain Partially rather than Yes.
Limitations
The study covers 12 selected EU countries and is not representative of the entire EU. 12 of 96 fields remain Unknown / inaccessible. Missingness is now concentrated in the Netherlands (2), Austria (1), Croatia (4), Malta (3) and Poland (2). This remaining uncertainty does not invalidate the assessed evidence, but it limits broad cross-country claims.
Guidance pages, FAQs, complaint procedures, annual reports and individual decisions are different forms of evidence. A country with a complete or near-complete row may rely on a mixture of these source types. Complete coding therefore does not mean the country has a single comprehensive RTBF guide.
The report measures documentation, not enforcement or legal effectiveness. It does not test complaint outcomes, response quality, actual publisher behaviour, search-engine acceptance rates or the strength of privacy protection. No success rates, country rankings or causal claims should be inferred.
Website content and forms can change. Publication dates and update dates were recorded where visible, but some official pages do not display a clear update date. The report reflects sources checked through 11 September 2026.
Data Availability and Supporting Files
The underlying research files are listed alongside the report so readers can see which coding, evidence and procedural records support the narrative.
country_coding_final_publication.csv- final 12-country coding matrixevidence_table_final_publication.csv- field-level evidence, source URLs and scope notesrecovery_log_final_publication.csv- recovery historyrtbf_country_pathways_publication.csv- practical country-by-country procedural pathway datasetrtbf_pathway_evidence.csv- pathway evidence registersource_register_final_publication.csv- consolidated official-source registerremaining_unknowns_final_publication.md- final unresolved fields and scope note
The HTML report at https://info-remover.com/research/eu-right-to-be-forgotten-news-report-2026 is the version of record. The supporting files above are referenced by name; they are not yet published as downloads on this page.
Dataset License
Dataset license: © 2026 Info Remover. All rights reserved. No open-data license is granted. Redistribution or republication of the curated dataset requires prior written permission from Info Remover.
Selected Official Sources
The full claim-level mapping is available in the evidence CSVs. The source register accompanying this report contains all official URLs used for analytical coding and practical pathways. Selected key sources are listed below.
Germany
- 25. Tätigkeitsbericht Datenschutz 2014/2015: https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Taetigkeitsberichte_Datenschutz/Taetigkeitsberichte_PDF/25.TB_2014-2015.pdf
- 31. Tätigkeitsbericht Datenschutz 2022: https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Taetigkeitsberichte_Datenschutz/Taetigkeitsberichte_PDF/Hamburg_Datenschutz_2022_web.pdf
- Aufgaben: https://www.datenschutz-berlin.de/ueber-uns/aufgaben/
- Beschwerde einreichen Google: https://datenschutz-hamburg.de/service-information/beschwerde-oder-hinweis-einreichen/beschwerde-einreichen-google
France
- Contester le refus d'un moteur de recherche: https://www.cnil.fr/fr/plainte/internet/contester-le-refus-dun-moteur-de-recherche-de-dereferencer-un-contenu-web-associe
- Le droit au déréférencement en questions: https://www.cnil.fr/fr/le-droit-au-dereferencement-en-questions
- Le déréférencement d'un contenu dans un moteur de recherche: https://www.cnil.fr/fr/le-dereferencement-dun-contenu-dans-un-moteur-de-recherche
Spain
- Derecho de supresión ("al olvido"): buscadores de internet: https://www.aepd.es/areas-de-actuacion/internet-y-redes-sociales/derecho-al-olvido
- Ejerce tus derechos: https://www.aepd.es/derechos-y-deberes/ejerce-tus-derechos
- Memoria anual 2023: https://www.aepd.es/memorias/memoria-aepd-2023.pdf
Italy
- Diritto all'oblio: https://www.garanteprivacy.it/i-miei-diritti/diritti/oblio
- Esercizio dei diritti: https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-tuoi-dati-personali
- Provvedimento del 17 aprile 2026 [10254840]: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10254840
- Provvedimento del 28 maggio 2026 [10265476]: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10265476
Netherlands
- Een tip of klacht indienen bij de AP: https://autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap
- Overzicht bemiddeling Autoriteit Persoonsgegevens bij verwijdering resultaten zoekmachines (May 2017): https://autoriteitpersoonsgegevens.nl/uploads/imported/01_overzicht_bemiddeling_ap_bij_verwijdering_resultaten_zoekmachines_mei_2017.pdf
Belgium
- Beslissing ten gronde nr. 134/2024: https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-134-2024.pdf
- Beslissing ten gronde nr. 59/2024: https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-59-2024.pdf
- Desindexering: https://www.gegevensbeschermingsautoriteit.be/burger/desindexering
- Klacht indienen: https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen
Ireland
- Delisting request made to internet search engine: https://www.dataprotection.ie/en/dpc-guidance/case-studies/erasure/delisting-request-made-internet-search-engine
- How long will it take?: https://www.dataprotection.ie/en/individuals/exercising-your-rights/how-long-will-it-take
- Raising a concern - evidence that may be required by the DPC: https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-evidence-may-be-required-dpc
- Raising a concern with the commission: https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-commission
Austria
- Beschwerde: https://dsb.gv.at/eingabe-an-die-dsb/beschwerde
- Datenschutzbericht 2019: https://dsb.gv.at/sites/site0344/media/downloads/datenschutzbericht_2019.pdf
- FAQs - Internet: https://dsb.gv.at/faqs/internet
- Fragen & Antworten (FAQs) - Betroffenenrechte: https://dsb.gv.at/faqs/faq
Sweden
- Klaga på en felaktig behandling: https://www.imy.se/privatperson/utfora-arenden/lamna-ett-klagomal/
- Rätten att få sökresultat borttagna: https://www.imy.se/privatperson/dataskydd/vi-guidar-dig/soktraffar/
Croatia
- Pravo na zaborav - Google: https://azop.hr/pravo-na-zaborav-google/
- Zahtjev za utvrđivanje povrede prava: https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava/
- Često postavljana pitanja: https://azop.hr/najcesce-postavljena-pitanja/
Malta
- Decisions - official case summaries: https://idpc.org.mt/decisions/
- File a Complaint: https://idpc.org.mt/file-a-complaint/
- Your Rights: https://idpc.org.mt/for-individuals/your-rights/
Poland
- DLA OBYWATELA - complaint filing guidance: https://uodo.gov.pl/pl/504/2247
- Jakie prawa daje Ci RODO?: https://uodo.gov.pl/pl/493/4098
- Realizacji swoich praw żądaj najpierw od administratora: https://uodo.gov.pl/pl/493/2262
- Wnioski Prezesa UODO z konferencji: Dane osobowe na antenie - standardy i granice ochrony prywatności w mediach: https://uodo.gov.pl/pl/file/7775