Right to Be Forgotten Enforcement Powers

Under the UK GDPR, the Right to Be Forgotten (Article 17) allows individuals to request the removal of personal data from search results — including those on Google and Bing — where the data is inaccurate, outdated, irrelevant, or excessive.

But what happens when those requests are rejected?

Is the ICO Enforcing RTBF?

Although the law gives the UK’s Information Commissioner (ICO) significant enforcement powers, there are no recent public examples of those powers being used to force Google or other search engines to delist content — even when complaints are upheld.

That raises critical transparency concerns. Is the ICO declining to act? Or are actions being taken quietly, without public accountability?

What the Law Requires

The ICO’s legal powers to enforce RTBF are set out in the UK GDPR and the Data Protection Act 2018:

• Article 58(2)(d) UK GDPR — empowers the ICO to:
  “order the controller or the processor to bring processing operations into compliance…”
  This includes ordering search engine delisting under Article 17.
• Article 57(1)(a) UK GDPR — mandates the ICO to:
  “monitor and enforce the application of this Regulation.”
• Section 149(2)(b), Data Protection Act 2018 — allows the Commissioner to issue enforcement notices when a controller fails to comply.

These powers are not symbolic. They are statutory obligations — especially when platforms like Google refuse valid RTBF requests.

What the Courts Have Said

The CJEU’s landmark ruling in Google Spain (C-131/12) remains central:

“Supervisory authorities must ensure the effective and complete protection of data subjects’ rights…”

While the UK no longer follows EU law directly, the UK GDPR is derived from the same principles. The ICO has not disavowed the Google Spain precedent in its current guidance.

The ruling reinforces that regulators must act where rights are denied.

Our Freedom of Information Investigations

Internet Erasure is actively challenging the ICO’s apparent inaction:

• View our FOI asking whether RTBF enforcement powers have been withdrawn under the UK GDPR:
  Read the full request
• Explore our second FOI on transparency and removal of enforcement notices, including the delisting order issued to Google in 2015:
  Read the full request

We believe the public has a right to know whether search engine delisting is still actively enforced — or whether the ICO is standing by without using its powers.

What You Can Do

If your RTBF complaint has been rejected or ignored:

• Submit a formal complaint to the ICO, referencing the powers listed above.
• If unsatisfied, escalate to the Parliamentary and Health Service Ombudsman (PHSO) — especially if the ICO has failed to act transparently, meet legal deadlines, or explain its refusal to enforce.

Internet Erasure can help with every stage of the process — from the initial RTBF request to ICO complaint, and PHSO escalation if needed.

Need help enforcing your Right to Be Forgotten?
Contact Internet Erasure — we specialise in RTBF complaints, appeals, and other strategic submissions.