The Right to Be Forgotten in the Context of Search Engines 19 May 2025

The right to be forgotten refers to the ability of individuals to request the removal of information published about them in the past - even if it is accurate - or to prevent it from being brought back into public attention.

The Right to Be Forgotten in International and National Legislation

In the European Union, the right to be forgotten was first recognized through judicial decisions and later incorporated into legislation. Indeed, the Court of Justice of the European Union (CJEU) gave this right a concrete framework for the first time in its 2014 decision in Costeja González v. Google Spain. In this case, the CJEU ruled that individuals could object to the listing of personal data in search engines if the data were "inaccurate, inadequate, irrelevant, or excessive" and thus recognized the right to be forgotten. Following the Costeja González v. Google Spain ruling, the European Union strengthened its data protection framework by enacting the General Data Protection Regulation (GDPR) in 2018. Article 17 of the GDPR, titled "Right to erasure ('right to be forgotten')", explicitly regulates this right and the conditions under which it applies.

In Turkish law, the right to be forgotten first came to the forefront in the Constitutional Court's decision on application no. 2013/5653 (N.B.B). In this case, the applicant had sent a formal notice to a media outlet requesting the removal of three online news articles from 1998 and 1999 in a national newspaper's digital archive, which reported that the applicant had been fined for drug use. Despite the request, the content was not removed. The Constitutional Court ruled that these reports should be evaluated within the scope of the right to be forgotten. The decision emphasized that, considering the accessibility provided by the internet, access to such news should be restricted in order to protect the applicant's honor and reputation. It was stated that rejecting the request for access restriction failed to strike a fair balance between freedom of expression and press and the right to protection of personal honor and integrity.

Although the term "Right to Be Forgotten" is not explicitly mentioned in the Personal Data Protection Law (Law No. 6698 - "PDPL"), this right is indirectly recognized under the general provisions of the KVKK, particularly within the obligations related to the deletion, destruction, or anonymization of personal data. In other words, although this right is not addressed as a comprehensive concept in Turkish domestic law, it is regarded as an overarching right encompassing several specific rights. Its implementation and requirements are shaped by the specifics of each case and may involve actions such as "deletion," "destruction or anonymization," and "de-indexing."
 

The Right to Be Forgotten in the Context of Search Engines
 

As a right indirectly regulated under the Turkish Personal Data Protection Law (PDPL), the right to be forgotten aims to prevent the indexing of search results that appear through search engines when individuals are searched by their name and surname. The Personal Data Protection Board ("the Board"), in its Decision dated 23/06/2020 and numbered 2020/481, established certain procedures and principles specific to the right to be forgotten in the context of search engines. This decision stipulates that applications should be evaluated within the framework of Article 20 of the Constitution, relevant provisions of the KVKK, and Article 8 of the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
 

Search engines are obliged to consider requests for de-indexing within the scope of the right to request that results related to a person do not appear in searches made with their name and surname. The Board has stated that search engines will be considered "data controllers" due to their data processing activities and that they are engaged in personal data processing.
 

Individuals must first submit their de-indexing requests directly to the search engines. If these requests are rejected or go unanswered, they may then file a complaint with the Board. The format of applications and the required documentation are determined by the search engines.
 

When evaluating applications, the Board conducts a balancing test between the individual's fundamental rights and freedoms and the public's right to access information. This assessment may vary depending on the specifics of each case and may involve additional criteria.
 

Finally, individuals also have the right to directly seek judicial remedy. The decision was communicated to the operating companies of search engines, and they were instructed to provide the necessary communication channels to allow citizens to exercise their right to be forgotten online.
 

Criteria for the Application of the Right to Be Forgotten
 

The following are the key criteria considered in the application of the right to be forgotten:
 

1. Whether the individual concerned plays a significant role in public life
2. Whether the subject of the search results is a child
3. The accuracy of the information
4. The currency or timeliness of the information
5. Whether the information is defamatory, offensive, or insulting to the individual
6. Whether the information is related to the individual's professional life
7. Whether the information qualifies as sensitive personal data
8. Whether the information causes prejudice against the individual
9. Whether the information poses a risk to the individual
10. Whether the information was published by the individual themselves
11. Whether there is a legal obligation for the processing of the information
12. Whether the information is related to a criminal offense
13. Whether the information falls within the scope of journalistic activity
     

Exercising the Right to Be Forgotten
 

To exercise the right to be forgotten and request the de-indexing of search results containing their name and surname, data subjects must follow the procedure outlined in Articles 13 and 14 of the Personal Data Protection Law (PDPL). According to this procedure, the individual must first apply to the data controller. Only if no satisfactory outcome is achieved at this stage does the right to file a complaint with the Personal Data Protection Board (the "Board") arise. In the initial stage, the data controller may be the operator of the search engine or the platform hosting the relevant content. The application can be submitted in writing or through other methods specified by the Board. The application must clearly include the individual's full name, contact information, and the URLs of the content they wish to have removed.
 

The data controller must respond to the request as soon as possible and no later than thirty (30) days. As a general rule, the data controller cannot charge a fee for processing the application; however, if the process incurs additional costs, a fee may be requested. If the application is accepted, the relevant content will be removed from the index or platform. If the request is denied, if the response is inadequate, or if no response is provided within thirty (30) days, the individual may file a complaint with the Board under Article 14 of the PDPL. The complaint must be submitted within thirty (30) days of receiving the response from the data controller and, in any case, within sixty (60) days of the initial application.
 

The Board will review the complaint and decide whether the content should be removed. The decision will be communicated to the data controller for implementation. As a result of the complaint, the Board may order the deletion of the content, the prevention of its indexing, or reject the complaint altogether. Following the Board's decision, the individual also has the right to appeal through administrative judicial channels. For the application process to be conducted effectively, requests must be submitted clearly and with supporting documentation.
 

Conclusion and Evaluation
 

The Right to Be Forgotten stands out as an important right that enables individuals to live freely in the digital world, independent of past negative experiences, while protecting their privacy. It is considered a significant step in safeguarding digital privacy.

Both in international law and in Türkiye, this right has been legally secured to protect personal data and prevent damage to individuals' reputations. In the implementation of the right to be forgotten, it is essential to consider specific criteria and ensure that individuals submit their applications in accordance with the relevant legislation and current decisions of the Board. This is crucial for individuals to effectively exercise their legal rights.