The Right to Be Forgotten: What UK Journalists Need to Know

What Is the Right to Be Forgotten?

The “right to be forgotten” — more formally known as the right to erasure — is enshrined in Article 17 of the UK General Data Protection Regulation (UK GDPR). It allows individuals to request the deletion of personal data held about them when certain conditions are met. The concept gained widespread attention following the 2014 European Court of Justice ruling in Google Spain v AEPD and Mario Costeja González, which established that search engines could be required to delist results containing personal data.

Since the UK's departure from the EU, the UK GDPR (retained under the Data Protection Act 2018) continues to provide this right, though its application is governed by UK courts and the Information Commissioner's Office (ICO) rather than European institutions.

When Does the Right to Erasure Apply?

Under Article 17, an individual can request erasure when:

• The personal data is no longer necessary for the purpose it was originally collected
• The individual withdraws consent and there is no other legal basis for processing
• The individual objects to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation
• The data was collected from a child in relation to an online service

However, the right is not absolute. Article 17(3) provides explicit exemptions, including where processing is necessary for exercising the right of freedom of expression and information — which is where journalism comes in.

The Journalism Exemption Under UK Law

The Data Protection Act 2018, Schedule 2, Part 5, provides a specific exemption for journalism. Where personal data is processed for the “special purposes” of journalism, academic purposes, artistic purposes, or literary purposes, many of the UK GDPR's provisions — including the right to erasure — do not apply, provided that:

• The processing is carried out with a view to publication of journalistic material
• The data controller reasonably believes that publication would be in the public interest
• Compliance with the relevant GDPR provision would be incompatible with the journalistic purpose

Key Case Law for UK Journalists

Several cases have shaped how the right to be forgotten interacts with press freedom in the UK:

• Google Spain v AEPD (2014): The foundational EU ruling that established search engines as data controllers and required them to delist results in certain circumstances. While an EU case, it set the framework that the UK initially adopted
• NT1 and NT2 v Google (2018): The first UK cases on delisting. The High Court ruled that NT2's conviction should be delisted because the information was no longer relevant, but refused NT1's request because his conviction remained relevant to his ongoing business activities. The cases demonstrated that courts will conduct a fact-specific balancing exercise
• ICO guidance: The ICO has published detailed guidance on the right to erasure and the journalism exemption, which should be your first port of call when assessing a request

The key takeaway from the case law is that context matters enormously. Factors such as the seriousness of the original conduct, the passage of time, whether the individual is a public figure, and the ongoing public interest in the information all influence the outcome. For a broader overview of data protection in journalism, see our GDPR guide for UK journalists.

Practical Impact on News Archives

One of the most contentious areas of the right to be forgotten for journalists is its impact on news archives. Online archives are an essential resource for accountability journalism, historical research, and public understanding. Removing articles from archives can create gaps in the public record and undermine the principle of open justice.

In practice, news organisations typically respond to erasure requests in one of several ways:

• Refusal with justification: Where the article serves an ongoing public interest, most publishers will refuse the request and explain why the journalism exemption applies
• Anonymisation: In some cases, removing the individual's name from an archived article can satisfy the request without destroying the journalistic value of the piece
• Noindex tags: Adding a noindex meta tag prevents search engines from surfacing the page in results, without actually deleting the article. This is sometimes used as a compromise
• Full removal: In rare cases where the article has no ongoing public interest value and the individual's privacy rights clearly outweigh press freedom, removal may be appropriate

How to Respond to an Erasure Request

When you receive a right to erasure request, follow these steps:

1. Acknowledge receipt promptly. You have one calendar month to respond under UK GDPR. Acknowledge the request in writing and explain your timeline
2. Identify the data at issue. Determine exactly what personal data the request relates to and where it is held (articles, databases, social media posts, photographs)
3. Assess the journalism exemption. Consider whether the data was processed for journalistic purposes, whether there is a public interest in retention, and whether compliance with the erasure request would be incompatible with that purpose
4. Conduct a balancing exercise. Weigh the individual's privacy rights against the public interest in the information. Consider the factors from NT1 and NT2: the nature of the information, the individual's role, the passage of time, and the ongoing relevance
5. Document your decision. Whatever you decide, record your reasoning. If challenged by the ICO, you will need to demonstrate that you conducted a proper assessment
6. Respond clearly. Inform the individual of your decision. If you are refusing, explain the basis for your refusal and inform them of their right to complain to the ICO

Search Engine Delisting: A Different Request

Erasure requests directed at your publication are often accompanied by — or confused with — requests to Google or Bing to delist the article from search results. These are legally distinct processes, and a decision by a search engine to delist an article does not require the publisher to remove it.

In practice, many individuals who wish to suppress unflattering online coverage pursue both routes simultaneously: requesting erasure from the publisher and delisting from search engines. The ICO's guidance makes clear that publishers and search engines must each conduct their own independent assessment. A successful delisting from Google does not establish that the publisher has failed in its data protection obligations — the assessments are distinct and may reasonably reach different conclusions, since search engine accessibility and direct publication raise different considerations about discoverability and the ongoing purpose of publication.

The volume of search engine delisting requests has grown substantially since 2014. Google's Transparency Report shows that UK individuals and organisations are among the most active users of the right to delist globally. News publishers are disproportionately affected: media content is frequently the subject of delisting requests precisely because it is the most publicly visible record of past events. The News Media Association has advocated for a statutory presumption against delisting journalism that has been published by a recognised news publisher, arguing that search engine delisting effectively re-writes the public record in a way that was never contemplated by the original data protection legislation.

• Search engine delisting: Under UK GDPR, Google and Bing are data controllers in their own right and must assess delisting requests independently. If a search engine delist your article, it means the search engine has concluded that the individual's privacy rights outweigh the public interest in the information appearing in search results — it does not mean the article itself is inaccurate or that you must remove it.
• Publisher vs search engine obligations: Your obligation as a publisher is assessed separately. The journalism exemption in the DPA 2018 may allow you to retain and continue publishing the article even if the search engine has delisted it. However, you should review the search engine's reasoning, as it sometimes reveals arguments you had not considered.
• Responding to search engine delistings: If you believe a delisting decision is wrong, you can submit a counter-notice to the search engine. News Media Association members have access to templates and guidance for challenging unjustified delistings. Google's Transparency Report provides statistics on media delisting decisions, which are useful for tracking patterns.
• The ICO's position: The ICO has published guidance on search engine delisting and the balance between privacy and expression. Review this guidance when assessing the implications of a delisting for your own archive policy.

Developing a Proactive Archive Policy

Rather than responding to erasure requests ad hoc, the best approach is to develop a clear, written archive policy that your organisation applies consistently. This demonstrates accountability to the ICO and provides a principled framework for decision-making:

• Define retention periods: Identify categories of content (criminal conviction coverage, minor public interest stories, long-running investigations) and establish presumptive retention periods. This does not override case-by-case assessment, but it gives structure to decision-making.
• Review mechanisms for old content: Consider whether you have a process for periodically reviewing legacy archive content to identify articles about people who have genuinely moved on and whose presence in the archive serves no ongoing public interest. Proactive review is better than reactive compliance.
• Anonymisation criteria: Set out when anonymisation (rather than removal) is an appropriate response. For example, a local court story about someone who received a community order for a minor offence 15 years ago may warrant anonymisation if the person can demonstrate rehabilitation and the story has no ongoing public interest, even if full removal would not be warranted.
• Escalation process: Clearly define who in your organisation can authorise archive modifications. Junior journalists should not be making these decisions unilaterally. Typically, editorial decisions of this kind require sign-off from a senior editor, with legal input for significant cases.
• Register of decisions: Maintain a log of erasure requests received, decisions made, and the reasoning applied. The ICO expects organisations to be able to demonstrate their decision-making process if challenged.

Balancing Privacy and Public Interest

The tension between the right to be forgotten and press freedom will only intensify as more individuals become aware of their data rights and as AI-driven search tools make personal information more discoverable. Journalists must navigate this tension thoughtfully, recognising that both privacy and press freedom are fundamental rights under the European Convention on Human Rights (Articles 8 and 10 respectively).

The best approach is to develop clear organisational policies for handling erasure requests, train staff on the relevant law, and maintain good records. For freelance journalists without institutional legal support, the NUJ's legal helpline and the ICO's published guidance are invaluable resources.

ICO Enforcement Against Media Organisations

The Information Commissioner's Office has enforcement powers against media organisations, and the journalism exemption does not provide blanket immunity. Understanding the limits of ICO enforcement and how complaints are handled is essential for any publisher:

• Complaint handling: If an individual complains to the ICO about your handling of an erasure request, the ICO will typically ask you to provide your reasoning and documentation. The ICO assesses whether you correctly applied the journalism exemption and conducted a proper balancing exercise. If satisfied, no further action is taken. If not, the ICO may issue an Information Notice requiring you to respond more fully.
• Assessment notices and enforcement notices: In more serious cases, the ICO can issue an Assessment Notice (requiring a formal audit of your data practices) or an Enforcement Notice (requiring specific action within a set timeframe). Failure to comply with an Enforcement Notice can result in fines and, ultimately, criminal prosecution of the organisation's senior management.
• Monetary penalties: The ICO can impose fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for the most serious data protection failures. While fines at this level have not been imposed on traditional news publishers, the power exists and should not be taken lightly.
• The journalism exemption tribunal: The First-tier Tribunal (Information Rights) has jurisdiction over ICO decisions affecting publishers. If the ICO rules against your handling of an erasure request, you can appeal to the Tribunal, which will assess the case afresh. Tribunal decisions build the body of case law on how the journalism exemption applies in practice.
• Special purposes determination: The DPA 2018 provides a mechanism for the ICO to issue a “special purposes” determination — a formal decision on whether specific processing constitutes journalism for the purpose of the exemption. These determinations are relatively rare but provide clear guidance on the exemption's limits.

Practical Checklist

When you receive an erasure request about published content:

• Acknowledge the request in writing within 5 working days and confirm your one-month response deadline
• Identify all locations where the personal data appears (articles, databases, images, social media posts)
• Assess whether the journalism exemption (DPA 2018, Schedule 2, Part 5) applies
• Apply the NT1 and NT2 balancing factors: nature of information, public/private figure status, time elapsed, ongoing relevance
• Document your decision and reasoning in writing before responding
• Escalate to your editor and legal team before modifying or removing any archived content
• If refusing, inform the individual of their right to complain to the ICO
• Keep a log of all erasure requests received and decisions made for ICO purposes
• Check whether the request comes from a third party (lawyer, PR firm, reputation management company) and verify their authority to act for the data subject before engaging with their arguments
• Register as a data controller with the ICO if you are a sole trader or independent publisher who processes personal data — this is a legal requirement distinct from handling the erasure request itself
• If the subject of the article holds a spent conviction under the Rehabilitation of Offenders Act, factor this into your balancing exercise — it strengthens their case but does not automatically require erasure of journalism

Common Mistakes

• Treating the journalism exemption as an absolute defence: You must be able to document a genuine journalistic purpose and public interest assessment. An unsupported assertion that content is journalism will not satisfy the ICO.
• Responding to erasure requests ad hoc: Individual journalists making unilateral decisions about archive content can create inconsistent precedents and expose the publisher to further claims.
• Ignoring the one-month deadline: You must respond within one calendar month, even if your response is simply to acknowledge receipt and state that you need more time (you can extend by two months for complex requests).
• Not documenting the balancing exercise: If challenged by the ICO, you must demonstrate that you weighed privacy rights against the public interest. No documentation means you cannot demonstrate compliance.
• Conflating search delisting with content removal: A search engine delisting (addressed to Google or Bing) is separate from an erasure request addressed to your publication. Both require separate assessments.
• Assuming that old articles are automatically less justified: The passage of time is one factor in the balancing exercise, not a determinative one. An article about a politician's conduct in office may remain fully justified twenty years later if the public interest in that conduct is ongoing; an article about a private individual's minor criminal matter may become unjustifiable after a much shorter period.
• Not considering anonymisation as an alternative: Many erasure requests can be satisfied by removing the individual's name from an article rather than deleting it. Anonymisation preserves the journalistic record while addressing the individual's most significant concern. Publishers who offer anonymisation as a first response often find that requestors accept it, avoiding the need for a contested refusal.

Red Flags

• An erasure request accompanied by a solicitor's letter threatening ICO complaint or legal action — escalate immediately to your publication's legal team
• A request about content involving allegations that were never legally tested (an allegation that was not prosecuted or adjudicated) — requires careful public interest assessment
• Multiple erasure requests received about the same content from different legal representatives — may signal an organised takedown campaign
• A request relating to content about a convicted person who has served their sentence and has a reasonable argument that the information is no longer relevant
• Your publication has no documented erasure request policy — the ICO expects organisations to have one
• A request that cites GDPR but does not specify which right is being exercised — the right to erasure, right to rectification, and right to object are distinct; identify which applies before responding
• An erasure request received from a person who is simultaneously subject to ongoing criminal proceedings — the interaction between GDPR and open justice principles is particularly complex in this scenario
• A request for removal of content that was itself the subject of an IPSO or IMPRESS adjudication — the regulatory record of the adjudication is itself a public interest document that should normally be retained even if other content is modified
• A third-party reputation management firm that claims to have authority to make an erasure request on behalf of a public figure without providing written confirmation of that authority signed by the data subject — verify before engaging with the substance of any request

Third-Party Erasure Requests: Lawyers, PRs, and Reputation Management Firms

A significant proportion of erasure requests received by news publishers come not directly from the data subject, but through lawyers, public relations consultants, or specialist reputation management firms acting on their behalf. This is entirely lawful — the data subject is entitled to appoint a representative — but it changes the dynamic of the request in ways that journalists should be aware of.

Reputation management firms, in particular, operate commercial businesses that make money by removing online content about their clients. Some of these firms use threatening legal language, misstate the applicable law, and imply consequences for non-compliance that are not supported by the actual legal position. A threatening letter from a reputation management firm is not a substitute for a legal opinion from a specialist media lawyer; if you are unsure about the legal merits of a request framed in threatening terms, consult the NUJ, the News Media Association, or a specialist media solicitor before responding. A legal threat that is not legally well-founded does not become more valid because it is expressed forcefully.

• Verify the authorisation: A lawyer or representative must be able to produce written authorisation from the data subject confirming they are acting on their behalf. Without this, you are under no obligation to engage with the representative at all.
• Document everything: Keep a complete record of all communications related to an erasure request, including emails, letters, and phone calls. If the matter later escalates to the ICO or to litigation, this documentation will be essential.
• Respond in writing: Even if a request arrives by phone, confirm your response in writing. Written records prevent later disputes about what was agreed or communicated.

Data Protection by Design: Building Good Practices Into Your Journalism Operation

UK GDPR requires data controllers — including news publishers — to implement data protection by design and by default. This means building privacy protections into the way personal data is collected, stored, and used, rather than treating data protection as an afterthought. For news publishers, this has practical implications for how you manage source information, how long you retain notes and recordings, and how you store and process sensitive information obtained during the course of journalism.

One practical application of data protection by design is a retention policy for journalistic source materials. Notes, recordings, documents, and communications with sources should be retained only for as long as necessary for the journalistic purpose — typically the period during which a story might realistically be challenged or litigated. After this period, materials containing personal data about private individuals who were not subjects of the published story should be securely deleted. Where materials relate to public interest investigations that remain ongoing, or to legal proceedings that have not yet concluded, retention for a longer period may be justified — but this should be a deliberate decision, not simple inertia.

• Encrypt sensitive materials: Source communications, documents obtained through confidential channels, and sensitive personal data should be encrypted at rest and in transit. The NUJ and Committee to Protect Journalists publish guidance on digital security practices for journalists that covers encrypted communication tools (Signal, ProtonMail) and secure storage (VeraCrypt).
• Register as a data controller: If you process personal data as part of your journalistic activities, you are required to register as a data controller with the ICO (unless you are an employee of an already-registered organisation). Sole trader journalists and hyperlocal publishers frequently overlook this requirement. Registration costs £40 per year for sole traders and small organisations.
• Privacy notices for sources: If you collect personal data about individuals in the course of journalism (for example, correspondence details for interviewees, or data from reader surveys), you must provide a privacy notice explaining how the data will be used. The ICO's privacy notice template is a practical starting point.

Handling Erasure Requests: A Step-by-Step Process

Having a documented, consistent process for handling erasure requests is both good legal practice and evidence of organisational accountability. If an erasure request escalates to an ICO complaint or First-tier Tribunal appeal, a publisher that can demonstrate a thoughtful, consistent process is in a significantly better position than one handling requests on an ad hoc basis. The ICO's published guidance on data subject rights provides the procedural framework; the journalism exemption determines the substantive outcome in most cases.

• Step 1 — Acknowledge within one month: Under UK GDPR, controllers must respond to data subject rights requests within one calendar month, with a possible extension of two further months for complex cases (the requester must be notified of the extension within the first month). Failing to acknowledge a request at all is itself a breach.
• Step 2 — Verify identity: You are only required to process a request if you can verify the identity of the requester. For published articles, this usually means confirming that the person requesting removal is the individual named in the article. In cases of doubt, ask for identifying information — but do not ask for more than is necessary.
• Step 3 — Assess whether the journalism exemption applies: Does the article concern a matter of genuine public interest? Is the information accurate? Is the data processing necessary for the journalistic purpose? Is the subject a public figure, a private individual, or somewhere in between? Document your analysis at this stage.
• Step 4 — Consider alternatives to erasure: Before refusing a request outright, consider whether a contextual note, correction, or anonymisation of the article would address the individual's concern without full erasure. These alternatives may be editorially appropriate where the article is accurate but context has changed.
• Step 5 — Communicate the decision in writing: Whether you comply with or refuse the request, communicate your decision in writing, explaining the legal basis. If refusing, inform the individual of their right to complain to the ICO and to seek a judicial remedy in the courts.

Rehabilitation of Offenders and Spent Convictions: A Special Case

The Rehabilitation of Offenders Act 1974 (ROA) creates a significant overlap with the right to erasure that journalists covering criminal matters must understand. Under the ROA, certain criminal convictions become “spent” after a specified rehabilitation period — meaning that in most civil and employment contexts, the convicted person can lawfully deny the conviction. However, the ROA includes a specific exception for newspapers and broadcast media: spent convictions can be published “for the purpose of journalism.”

Despite this exemption, the ICO has indicated that the existence of a spent conviction is relevant to whether a newspaper should retain and publish archive material about a private individual. A person whose minor criminal conviction is spent has a stronger argument for erasure of historical reporting about that conviction than a person whose serious conviction remains unspent — particularly if the individual was a private person rather than a public figure, and particularly if the passage of time means that the information is no longer of current public interest. Publishers should take the spent status of convictions into account when deciding erasure requests, while recognising that the ROA does not automatically require removal.

• Know your rehabilitation periods: Under the ROA (as amended by the Legal Aid, Sentencing and Punishment of Offenders Act 2012), rehabilitation periods range from none (for custodial sentences of more than four years) to zero years for cautions. A conditional discharge becomes spent immediately. Understanding these periods is essential for assessing erasure requests.
• Children in the criminal justice system: The Youth Justice and Criminal Evidence Act 1999 and associated reporting restrictions provide particularly strong protection for under-18s convicted of offences. Reporting restrictions under Section 49 of the Children and Young Persons Act 1933 may mean that even articles published at the time of the offence were in breach of legal restrictions — in which case the public interest basis for retaining the content is particularly weak.
• The public interest test still applies: Even where a conviction is spent, a publisher who can demonstrate that reporting about it serves a genuine public interest (historical record, ongoing relevance to the individual's public role) retains a basis for refusing erasure. The weaker this public interest, the stronger the case for removal.

Applying the Balancing Test in Practice

When a publisher receives an erasure request that engages the journalism exemption, applying the exemption is not automatic — the publisher must carry out a genuine balancing exercise between the individual's right to privacy and the public interest in the material remaining available. This is not a theoretical exercise: the ICO expects evidence of genuine engagement, and the First-tier Tribunal will scrutinise decisions on appeal.

The factors that weigh in favour of the journalism exemption being engaged include: the nature of the individual (politician, public official, company director, or others who have voluntarily entered public life); the character of the information (matters of public record, court proceedings, verified facts about the exercise of public power); the continuing relevance of the information (does the historical event have ongoing public significance?); and the extent to which removing the information would distort the historical record. The more clearly these factors are met, the stronger the public interest case for refusing erasure.

Factors that weigh against the exemption include: substantial passage of time since a minor or non-public role; evidence that the information is causing disproportionate ongoing harm (particularly relevant for spent convictions under the Rehabilitation of Offenders Act 1974); changed circumstances that make historical information misleading; and cases where the individual concerned was a private individual who was peripherally involved in a newsworthy event through no choice of their own, rather than a public figure whose conduct was itself newsworthy.

• Document the decision: Record who reviewed the request, what factors were considered, what the outcome was, and why. This documentation is essential if the decision is challenged.
• Consider contextualisation as an alternative: If the original article is accurate but could be misleading without context (for example, a conviction that was later quashed), adding a contextual note or correction may address the individual's legitimate concern without full erasure.
• Check your retention policy: Some publishers now have policies under which archived articles about private individuals involved in minor incidents are removed after a set period. This is a legitimate editorial choice, provided it is applied consistently and not as a result of improper pressure.
• The NUJ and NMA can help: Both organisations have specialist resources on data protection for publishers, and the NUJ can refer members to specialist lawyers for complex cases.

Primary Sources

• ICO: Right to Erasure Guidance — Official ICO guidance on handling erasure requests
• Data Protection Act 2018, Schedule 2, Part 5 — The journalism exemption in full
• ICO: Special Purposes Exemption — Journalism, academic, artistic and literary exemptions
• NUJ: Data Protection Guidance — Union resources on data protection for journalists
• GDPR for UK Journalists — Comprehensive data protection guide for the newsroom
• Defamation Law for UK Journalists — Understanding libel and the available defences