A long-awaited judgment of the CJEU dated 13 May 2014 held that the giant search engine Google must give effect to a so-called "right to be forgotten". According to the CJEU, Google (and therefore every search engine operator) is responsible for the processing of personal data appearing on web pages published by third parties and referenced by Google.
As a result, if, following a search made on the basis of a person's name, the list of results in the search engine operator displays a link to a web page which contains information related to that person, the data subject may approach the operator directly, and under certain conditions (where personal data storage is no longer necessary or is irrelevant for the original purposes of the processing for which the data was collected) may obtain the removal of the link from the list of the results. If the search engine refuses the request, the data subject may ask the relevant authorities to consider their case.
In consequence, Google had to implement a standard procedure to deal with such requests. The Google transparency report affirmed that the company had received more than 200,000 requests "to be forgotten" since the ruling.
As for Luxembourg, the national data protection authority (the Commission Nationale pour la Protection des Données - "CNPD") published practical guidelines on its website on how data subjects may proceed to request the removal of links to web pages.
