On November 8, 2024, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) released a press release outlining decisions on the right to be forgotten under the General Data Protection Regulation (GDPR) from the Federal Court of Justice (Bundesgerichtshof) and the Court of Justice of the European Union (CJEU) in 2024.

Online registers

The HmbBfDI highlighted that:

• the Bundesgerichtshof ruled that an entry regarding an association board member must be removed after 20 years from the publicly accessible internet register and may only be made available to third parties if a legitimate interest can be demonstrated (case II ZB 10/23); and
• the CJEU decided that personal data published in an online commercial register that is not subject to commercial disclosure requirements may be deleted or published in redacted form in case of doubt (case C-200/23).

Claims against search engine operators  

The HmbBfDI explained that if the infringing content is not removed from a website itself, the individual can file a claim with the search engine operator to de-list the content from name-based searches.

In particular, the HmbBfDI confirmed that, according to the Bundesgerichtshof, a search engine operator:

• is only required to de-list if it has become aware, through a specific notification, of an obvious and clearly recognizable violation of the general right of privacy of the person concerned by the content of a search result (case VI ZR 489/16); and
• must carry out a comprehensive consideration of fundamental rights (case VI ZR 405/18).

Moreover, the HmbBfDI outlined that according to the CJEU, a search engine operator is only obliged to de-list the content if the claimant submits relevant and sufficient evidence and shows that the totality or a significant part of the information contained in the listed content is manifestly inaccurate (case C-460/20). The HmbBfDI clarified that such evidence may be provided by, for example, a court decision against the website operator.

Claims against content providers

The HmbBfDI explained that the European Court of Human Rights (ECHR) considered that dissemination and searchability of information on the internet may be particularly distressing for individuals, meaning that personal details in online press reports may subsequently have to be blacked out (case 57292/16).

Exercising the right to be forgotten

The HmbBfDI outlined that data subjects can assert their right to be forgotten via online forms provided by search engine operators. In particular, the HmbBfDI confirmed that it exercises data protection supervision over the search engine operator Google.

You can read the press release here, case C-200/23 here, case C-460/20 here, and case 57292/16 here, as well as, only available in German, case II ZB 10/23 here, case VI ZR 489/16 here, and case VI ZR 405/18 here.