The Right to Be Forgotten in the Digital Age

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The right to be forgotten in the digital age challenges businesses and individuals to balance freedom of information, personal data protection, and human dignity in an environment where nothing ever seems to be truly erased.

What the Right to Be Forgotten Is and Why It Matters in the Digital Age

The right to be forgotten is a person’s ability to ask for the removal or delisting of personal information that was lawful when it was first published but has lost its public relevance over time. The concept gained traction internationally after landmark decisions by European courts. In Brazil, it has become part of fundamental debates about data protection, privacy, and human dignity.

In practice, the right to be forgotten is closely tied to the concept of data due diligence. Before keeping, sharing, or indexing personal information, public and private organizations must assess whether the data still serves a legitimate purpose, whether there is a legal basis for processing it, and whether leaving it online causes disproportionate harm to the person it concerns. Here, we look at how this duty of diligence connects with current Brazilian legislation and with the practical challenges that businesses, digital platforms, and individuals face every day.

The digital environment has radically changed how personal information circulates. Data that used to sit in physical files, printed newspapers, or notary records can now be found by anyone with an internet connection. A news story about a criminal case that ended decades ago, a debt that has already been paid, or an embarrassing personal episode can stay accessible in search engines indefinitely. The result can be real damage to a person’s reputation, job prospects, and emotional well-being.

This subject is directly related to personal data on social media, a topic we cover in a dedicated article.

This subject is directly related to cookies and online tracking, a topic we cover in a dedicated article.

Legal Foundations in Brazil: The LGPD (General Data Protection Law), the Marco Civil da Internet, and the Federal Constitution

Brazilian law has no statute specifically devoted to the right to be forgotten, but several legal provisions offer solid grounds for applying it. Article 5 of the Federal Constitution protects the inviolability of people’s privacy, private life, honor, and image, and guarantees compensation for material or moral damages resulting from a violation. These fundamental rights are the constitutional basis for claims involving digital erasure.

The General Data Protection Law (Law No. 13.709/2018) added concrete tools that reinforce this right. Article 18 of the LGPD provides that data subjects may obtain from the controller, at any time, the deletion of personal data processed with their consent. In addition, the principles of purpose, adequacy, and necessity (Article 6) require that the processing of personal data be limited to the minimum necessary to achieve its purposes, covering only data that is relevant, proportionate, and not excessive.

Note that Brazil’s Internet Civil Rights Framework (Marco Civil da Internet, Law No. 12.965/2014) also plays a significant role in this discussion. Its Article 7 guarantees users the right to permanent deletion of the personal data they provided to a particular internet application, upon request, once their relationship with the provider ends. Although this provision deals specifically with the relationship between a user and an application provider, it reinforces the principle that individuals control their personal data in the digital environment.

It is important to note that the Brazilian Supreme Federal Court, ruling on the issue in a general repercussion case (a procedure for matters of broad constitutional importance whose outcome guides lower courts), held that the right to be forgotten is incompatible with the Federal Constitution when it is used to prevent the publication of truthful information that was lawfully obtained. That decision, however, did not end the debate. What it established is that there is no general right to erase true information. It does not rule out a case-by-case analysis, especially when there is a concrete violation of dignity or privacy, or when the personal data has lost any informational relevance.

The LGPD as a Due Diligence Tool

The LGPD introduced a genuine culture of due diligence regarding personal data in Brazil. Data controllers and processors must keep records of their processing operations, prepare data protection impact assessments, and adopt technical and administrative security measures capable of protecting personal data. This duty of diligence is not limited to the moment of collection. It extends across the entire life cycle of the data, including its storage, sharing, and eventual deletion.

Data due diligence is not merely a legal obligation. It is an essential practice for ensuring that the digital environment respects the dignity and privacy of every individual.

From the standpoint of the right to be forgotten, data due diligence requires organizations to periodically assess whether the personal data they hold still serves a legitimate purpose. Data from closed court cases, information about debts barred by the statute of limitations, records of penalties already served, and other sensitive data should be reviewed constantly. Keeping this data unnecessarily can amount to irregular processing under Article 44 of the LGPD, exposing the controller to administrative sanctions and the obligation to compensate for damages.

Practical Challenges: Delisting, Digital Platforms, and the Limits of Being Forgotten

One of the biggest practical challenges of the right to be forgotten in the digital age is what is known as delisting. When someone asks for information to be removed, they may mean deleting the original content (from a website, blog, or social network) or removing the links to that content in search engines. These are different situations, involving different responsible parties and separate legal procedures.

With search engines, delisting keeps a given result from appearing when someone searches for the person’s name, but the original content stays available at its web address. Removing the content at the source, on the other hand, depends on the cooperation of whoever runs the site or platform where it was published. In practice, many people have to take legal action against both the search engine and the party responsible for the content to get effective protection.

Digital platforms, for their part, face the challenge of balancing freedom of expression and the right to information against the privacy of individuals. Social networks, news portals, forums, and complaint sites have their own content removal policies, but those policies are not always enough to meet the legitimate demands of data subjects. The lack of a standardized administrative procedure for digital erasure requests makes the process more complex and often slower.

Due Diligence in How Companies Collect and Keep Data

Companies that collect and keep personal data about customers, suppliers, employees, and business partners need to build data due diligence into their internal processes. That means putting clear retention and disposal policies in place, setting maximum storage periods for each category of information, and making sure unnecessary data is actually deleted.

In the context of the right to be forgotten, this diligence matters even more. A company that keeps in its databases information about customers’ rehabilitated criminal records, closed court cases, or debts barred by the statute of limitations may be violating fundamental rights without realizing it, and exposing itself to significant legal risk. Regular review of stored data, combined with efficient ways to respond to data subjects’ requests, is the foundation of a responsible personal data management policy.

Note that sectors such as finance, health care, and human resources are especially sensitive in this respect. Old medical information, outdated credit records, and data from closed labor cases are examples of data that call for extra attention when it comes to retention and eventual deletion. Brazil’s National Data Protection Authority (ANPD) has the power to oversee compliance with these obligations and to impose sanctions for violations.

The Right to Be Forgotten and the Public Interest: Where to Draw the Line

One of the most sensitive points in the debate over the right to be forgotten is defining the boundary between protecting individual privacy and the legitimate public interest in keeping certain information available. Not all personal information online can (or should) be erased. Historical records, newsworthy information, data about public officials performing their duties, and information relevant to public safety are examples of content that, as a rule, cannot be removed on the basis of the right to be forgotten.

The fundamental criterion we use for this analysis is proportionality. In each specific case, you have to assess whether the harm the information causes the individual outweighs the benefit society gets from continued access to it. This balancing takes into account factors such as how much time has passed since publication, the information’s current relevance, whether the person involved is a public or private figure, and whether there is a legitimate journalistic or historical interest.

Within data due diligence, this balancing should happen not only when a data subject asks for their information to be removed, but also preventively. Organizations that handle large volumes of personal data should set objective criteria for deciding whether to keep each category of information, documenting their decisions and the reasons behind them. Besides meeting the LGPD’s requirements, this practice shows good faith and diligence on the part of the data controller.

Paths to Protection: How to Exercise the Right to Be Forgotten

If you want to exercise the right to be forgotten or ask for your personal data to be removed from the digital environment, both administrative and judicial routes are available. The first step is to identify clearly which information you want removed and where it is published. Next, we recommend contacting the party responsible for the content (the site, platform, or social network) and the search engine directly, and submitting a formal request for removal or delisting.

If the administrative request is not granted, you can turn to the ANPD, which has the authority to mediate conflicts between data subjects and personal data controllers. You can also go to court. The judge will assess the specific case and may order the content removed or the search results delisted.

For companies and organizations, the path involves implementing robust data governance programs that include retention and disposal policies, efficient channels for responding to data subjects, staff training, and periodic audits. Data due diligence is not a one-time event. It is an ongoing process that should follow personal information throughout its entire useful life under the organization’s responsibility.

The trend in both legislation and case law, in Brazil and internationally, points toward a gradual strengthening of personal data protection mechanisms and, as a result, of the right to be forgotten in its various forms. Organizations that get ahead of this trend by adopting sound due diligence practices will be better positioned to meet regulatory challenges and to protect both data subjects’ rights and their own interests.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.