Right to be forgotten: when are default Google refusals insufficient?

Want to have outdated or unjustified information about yourself removed from Google's search results, but catch a bone with a standard email? A ruling of the Brussels Market Court on November 12, 2025, confirms that Google should not hide behind vague default rejections. Search engines should clearly justify why your specific request is denied, and in the case of old, unproven allegations, your privacy often outweighs the public interest.

The facts

The case involves a higher education teacher (psychology) who in 2008 was the subject of a sexual harassment complaint by a student.

• Legal history: As a result of this complaint, the teacher was preventively suspended in 2009. He challenged these administrative suspensions before the Council of State. Importantly, the criminal investigation into the alleged harassment was dismissed by the prosecutor's office in August 2009. Thus, there was never a criminal conviction.
• The problem: More than 15 years later, in 2023, the State Council's rulings on his suspension were still prominently searchable via Google when searching his name. The links referred to the vLex legal database.
• Google's refusal: The man requested that Google remove these links. Google refused with standard texts. For the first URL, Google stated that the information “related to his professional life” and was of “significant public interest.” For the second URL, Google vaguely referred to the “balance of interests” and the nature of the source (an administrative government).
• Complaint to the DPA: The man went to the Data Protection Authority. The Litigation Chamber ruled on April 24, 2025 (No. 77/2025) that Google has violated the General Data Protection Regulation (GDPR) and imposed reprimands and a warning. Google appealed this to the Market Court.

Market Court decision

The Court of Appeal broadly affirmed the DPA's decision. The ruling falls into two pillars: the substantive right to data erasure and the procedural duty of transparency.

1. The right to be forgotten (Article 17 GDPR).

The Court found that Google's refusal was unjustified. The processing of the personal data was no longer necessary and even unlawful given the time period and nature of the data. Here, the Court applies the criteria of the Google Spain and Google/CNIL rulings of the European Court of Justice.

• Not a public figure: The Court confirmed that a teacher or psychologist is not automatically a “public figure.” The man played no role in public life and did not seek out the media.
• No criminal relevance: Because the criminal complaint had been dismissed and no disciplinary sanctions had followed for the acts themselves, the search results gave a “distorted and incomplete picture” that caused him disproportionate harm.
• No current public interest: The Court ruled that linking the man's name to these old rulings did not add any value to the current social debate on sexual harassment.

2. The obligation of transparency (Article 12 GDPR).

Perhaps the most important aspect of this ruling is the condemnation of Google's methods.

• Standard answers are insufficient: The court found that Google's responses were “vague,” “abstract” and “standardized.” Google used blocks of text that did not specifically address the plaintiff's situation.
• Understanding: A data subject must be able to understand why a refusal follows in his specific case. The justification “important public interest” without further explanation is not sufficient.

3. The sanction: nuance in enforcement

Google was proven right on one point: the warning was overturned. The court clarified that a warning (under Art. 100 DPA Act and Art. 58 GDPR) can only be given for intended (future) processing operations that are likely to violate the law. It cannot be used as punishment for a violation that has already occurred; for that, the reprimand and fine serve. However, the reprimands for violation of articles 12 and 17 GDPR remained in place.

Legal analysis and interpretation

This ruling provides guidance for legal practice around reputation management and GDPR compliance.

The limits of automation in legal decision-making Large tech companies process thousands of requests a year and, understandably, use partially automated systems and templates to do so. However, the Market Court sets a hard limit: efficiency should not lead to opacity. The Court explicitly states: “The decision [...] must be adapted to some extent to the specific situation of the person concerned, by referring to the concrete circumstances of the refusal.”. This is an extension of the duty to state reasons. It is not enough to make a consideration internally; the outcome of that consideration must be communicated comprehensibly to the citizen. This touches the core of Article 12.1 GDPR (transparent communication) in conjunction with Article 12.4 GDPR (justification of non-sequitur).

Article 10 GDPR and ‘suspected’ criminal offenses What is interesting is the Court's confirmation that data relating to a complaint or administrative proceeding that mentions criminal offenses fall under the strict protection of Article 10 GDPR (criminal data), even if there is not yet a conviction - or in this case, even if the case has been dismissed. This significantly raises the threshold for search engines to be allowed to index such information. As a result, the balancing of interests falls much faster in favor of the privacy of the data subject.

The role in public life (public figure) The Court applies a strict interpretation of the term ‘public figure. Merely practicing a regulated profession (such as psychologist or teacher) does not make someone a public figure. This is important for professionals who fear that their professional status makes them outlaws to online criticism. As long as one is not seeking media fame or playing a political role, privacy protection remains robust.

What this specifically means

For the victim of online content

• Better weapon against refusals: If you receive a standard ‘no’ from Google, this ruling is your ammunition. You can demand that Google specifically explain which “public interest” outweighs your privacy, especially if the facts are old.
• Old hat: Information about old legal disputes (especially without convictions) should disappear online if they no longer have current news value. The ‘time’ factor (in this case, 15 years) is decisive.
• Proof of damage: The Court settled for the plausibility of “moral damages” and “anxiety” due to constant findability. You don't always have to prove hard financial damages to prove your case.

For lawyers and DPOs

• Review of standard letters: Organizations that process data subjects“ rights should review their templates. A generic reference to ”legitimate interest“ or ”legal obligation" without context is risky.
• Strategy at the DPA: The distinction between warning (ex ante) and reprimand/fine (ex post) is important in defense proceedings. Challenging a warning that is actually a punishment for the past is likely.

Frequently asked questions (FAQ)

Does this ruling apply only to Google or to other websites as well?
Although this ruling was made specifically against Google, the principles in the GDPR apply to all data controllers. Any organization that refuses a data erasure request must provide transparent and specific justification. However, search engines do have a specific responsibility because they aggregate and access information from a variety of sources.

Do I have to wait 15 years before I can have something removed?
No, 15 years was the deadline in this particular case. The criterion is whether the information is still ‘relevant’ and ‘current. For criminal data on non-public figures, the balance may tip in favor of privacy much earlier, such as once a dismissal or acquittal is final.

Google says the information is ‘of legal significance'. Is there anything I can do about that?
Yes. In this case, the rulings were in a legal database. The Court ruled that the legal interest of that database (access to case law) can be achieved without the person's name being findable through a general search engine like Google. The source may remain (anonymization is the norm there), but the link in Google by the person's name must go away.

Conclusion

The Market Court's Nov. 12, 2025 ruling sends a powerful message: data protection law is not a dead letter and tech giants are not above the law. The ruling compels search engines to customize. Anyone who wants to preserve someone's digital past must put good and understandable reasons in writing. For citizens, this means: don't settle for a standard rejection.