THE RIGHT TO BE FORGOTTEN IN SOUTH AFRICA: CAN A PERSON ESCAPE THEIR DIGITAL PAST?

Introduction

The internet has changed the relationship between people and information.  In the past, embarrassing situation, allegations, and personal details could disappear from public view. Today content published online can be accessed for years using social media, online newspapers, and search engines. A person’s history may therefore continue to have an impact on their reputation, dignity, social relations, and career events after the circumstances associated with the information have changed. This issue has raised an important legal question of whether a person  can forget their digital history?

The right to be forgotten means the power of an individual to request information to be restricted, rectified, or removed from the internet. In Google Spain SL v Agencia Española de Protección de Datos (AEPD),[1] the Court held that search engines could be compelled to remove links of personal information searches associated with a person’s name. The European Union included the right to erase in Article 17 of the General Data Protection Regulation (GDPR).[2]

South Africa does not have the right to be forgotten. However, the Protection of Personal Information Act 4 of 2013 (POPIA) provides the right to request correction or deletion of personal information in certain circumstances. The Constitution protects privacy, dignity, and freedom of expression.

This article examines South Africa’s position within a broader international context, comparing it with the changes in the United States, the United Kingdom, India, and European Union. It argues that South Africa should not adopt the right to erase the past. Rather, it should establish a qualified right to digital redemption to protect historical records, journalism, freedom of expression, and matters of the public while allowing people to challenge continously access to information.

The Meaning and Purpose of the Right to be Forgotten

The right to be forgotten does not mean to erase anything that an individual finds embarrassing; it also refers to the continued processing and accessibility of personal information in cases where circumstances have changed or the continued availability of the information has become excessive.

The difference between deletion and de-indexing is important. Deletion involves removal of personal information, whereas de-indexing prevents information from appearing in searches associated with the person’s name. The Google Spain case established the importance of the difference by recognising that processing and presentation of information by a search engines can have consequences that are separate from the original publication of the information.

Consequently, the right address what is called digital permanence because information can be technically correct but become irrelevant, excessive, disproportionate over time. Therefore, the important question is whether the information is true and whether it’s continuous publication serves a valid purpose.

This approach is conveyed in Article 17 of the GDPR which guarantees a right to remove while providing key exceptions. Removal may be restricted where processing is necessary for freedom of expression, public interest, historical research, or defending legal claims.[3]

The European model therefore proves that the right to be forgotten is a qualified right. It protect personal freedom without providing an opportunity for a person to change history.

The South African Framework: POPIA and Constitutional Rights

POPIA is the primary statutory legislation  giving effect to the constitutional right to privacy in the context of data processing. Section 9 of POPIA requires personal information to be processed lawfully and reasonably, in a manner that does not infringe the privacy of the data subject.[4] Section 10 stipulates that personal information must be adequate, relevant and not excessive given its purpose.[5] Section 14 imposes retention limits, requiring that information not be kept longer than necessary for achieving its purpose.[6]

Section 24 is important because it allows data subject to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained.[7] This provision forms the doctrinal basis for a South African variant of the right to be forgotten.

POPIA does not, however, create an unlimited right to erasure. Section 24 is triggered only where specified statutory conditions are met. The South African framework therefore contains components of the right to be forgotten rather than a comprehensive equivalent of Article 17 GDPR.

Constitutionally, any such right must be reconciled with competing rights. Section 14 protects privacy, section 10 protects dignity, and section 16 protects freedom of expression. A request for removal of information may thus pit privacy against the public’s interest in receiving information. 

In Bernstein v Bester, the Constitutional Court held that the reasonable expectation of privacy is context-dependent and is especially concerned with the intimate and private sphere of life.[8] This contextual approach remains relevant online, as not all information that is publicly accessible is automatically stripped of privacy protection.

Public Availability and Privacy: The Significance of Botha v Smuts

The Constitutional Court’s in Botha v Smuts and Another offers important guidance on privacy in the digital age. The Court clarified that the fact that information has entered the public domain does not automatically extinguish privacy interests in all subsequent uses of that information.[9] The purpose and context of any further dissemination remain legally relevant.

This reasoning has direct implications for online publication. Information initially disclosed for a limited administrative purpose, such as a residential address, may later be republished in a different context that facilitates harassment or intrusion, thereby raising distinct privacy concerns. 

The case does not suggest that all publicly available information must be removed. Rather, it establishes that public availability does not conclude the legal enquiry. The central question becomes whether continued processing remains justified having regard to purpose, proportionality, and competing constitutional rights. This contextual assessment is central to any right to be forgotten. The issue is whether continued accessibility remains warranted.

European Union: Google Spain and Article 17 GDPR 

The EU has been at the forefront of developing this right. In Google Spain, Mario Costeja González sought de-listing of search results linking his name to a historical newspaper notice concerning a property auction. The CJEU concluded that search engine operators could be required to remove such links where the information is inadequate, irrelevant or excessive in relation to its original purpose.[10]

The judgment was significant for recognising the distinct role of search engines in shaping digital identity. While an archival article may attract little attention on its own, its prominence in name-based searches substantially amplifies its impact.

Article 17 GDPR subsequently formalised this approach, allowing erasure where personal data are no longer necessary, consent is withdrawn, processing is unlawful, or other conditions are fulfilled.[11] Yet Article 17(3) expressly preserves competing interests, excluding erasure where processing is necessary for freedom of expression and information, legal compliance, public interest, or historical, statistical and scientific research.[12]

This balanced model is instructive for South Africa. It demonstrates that data protection can be reconciled with democratic openness, protecting individuals from unjustified digital permanence without enabling suppression of legitimate criticism.

United Kingdom: A Proportionate Approach

The United Kingdom retains a similar right to erasure under the UK GDPR. The Information Commissioner’s Office emphasises that the right is not absolute and applies only in defined circumstances.[13]

The UK framework also recognises exemptions for freedom of expression and information, compliance with legal duties, performance of public functions, and historical, scientific or statistical purposes.[14]

The value of the UK experience lies in its explicit balancing exercise. A journalist reporting accurately on serious misconduct cannot ordinarily be compelled to delete that reporting merely because the subject finds it reputationally damaging. Conversely, where information is demonstrably outdated or irrelevant, continued processing may require reassessment. The UK thus supports a case-by-case proportionality analysis rather than a blanket rule favouring either erasure or perpetual retention. 

India: Privacy, Dignity and Informational Autonomy

India illustrates how constitutional privacy can underpin an emerging right to be forgotten. In Justice KS Puttaswamy (Retd) v Union of India, the Supreme Court recognised privacy as a fundamental right linked to dignity, liberty and autonomy, including informational privacy and control over personal data.[15] Subsequent High Court decisions have addressed requests to remove sensitive personal information, including information contained in court records, from online accessibility. 

India’s developing jurisprudence frames the right to be forgotten as an aspect of informational self-determination. The fact that information has entered a digital system does not automatically deprive individuals of all control over it. However, India also highlights the tension with open justice. Court judgments serve a vital public function. Requests for removal must therefore be weighed against the public interest in access to judicial information. This balancing exercise is directly relevant to South Africa.

United States: Freedom of Expression as a Constraint

The United States adopts a markedly different position. No general federal right to be forgotten comparable to Article 17 GDPR exists. The First Amendment affords robust protection to freedom of speech and of the press, creating constitutional obstacles to state-mandated removal of truthful information.[16] While state law recognises privacy torts that may offer remedies in specific cases of harmful disclosure, there is no broad erasure right.

The American model serves as a cautionary example. An expansive right to be forgotten could be misused to suppress accurate reporting on matters of public concern. A public official should not be permitted to erase credible allegations of corruption on privacy grounds.

For South Africa, this underscores the need for strong safeguards for investigative journalism and democratic accountability within any erasure framework. 

International Human Rights Context

The debate also has an international human rights dimension. Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights (ICCPR) protect against arbitrary or unlawful interference with privacy, family, home or correspondence, while Article 19 ICCPR protects freedom of expression.[17]

Digital technology has intensified the conflict between these rights, as personal data can now be stored and disseminated globally. The Office of the United Nations High Commissioner for Human Rights has acknowledged the growing significance of privacy in the digital age and the risks posed by systems capable of indefinite data retention.[18] This indicates that digital privacy should be treated as a contemporary human rights concern, not merely as a matter of data regulation. 

Criminal Records and Prolonged Digital Punishment

The issue is particularly acute in the context of criminal records. An individual who has served a sentence and seeks rehabilitation may find that historical news reports remain highly visible in search results. Prospective employers or landlords may encounter this information without context regarding rehabilitation. This effectively creates a continuing form of digital punishment beyond the formal sentence.

The appropriate response is not necessarily destruction of official records, which may need to be retained for legitimate law-enforcement purposes. Rather, a proportionate remedy may involve restricted access or de-indexing, whereby the underlying record remains available for lawful purposes while its indiscriminate public amplification is reduced.

Social Media and Enduring Human Error

Social media presents a distinct challenge, as users frequently publish content without appreciating long-term consequences. Young persons may post images or comments that later become detrimental. Even if the original post is deleted, copies may persist through redistribution. The passage of time can alter the relationship between information and its legitimate purpose. However, embarrassment alone should not justify removal. Public interest speech, evidence of wrongdoing and legitimate journalism may require continued availability. A contextual proportionality assessment is therefore required, considering factors such as the age of the individual at the time of publication, the nature and accuracy of the information, the time elapsed, and the ongoing public interest.

Towards a South African Right to Digital Redemption

Comparative analysis suggests South Africa should articulate a coherent framework for digital redemption based on the following principles:

First, accessible procedures should exist for correction or deletion of information that is inaccurate, misleading, irrelevant, excessive, outdated or unlawfully processed under section 24 of POPIA.

Second, de-indexing should be recognised as a distinct remedy. Where retention of source data is legitimate but its linkage to a name-based search causes disproportionate harm, de-indexing offers a balanced alternative to full deletion.

Third, information of genuine public interest – including matters relating to corruption, serious crime, public officials, significant historical events and democratic accountability – should enjoy strong protection against erasure.

Fourth, the passage of time should be a relevant factor. The interest in moving on may intensify as information becomes less relevant.

Fifth, particular consideration should be afforded to children and vulnerable persons who may not have understood the long-term implications of digital disclosure.

Finally, the Information Regulator and the courts should develop consistent criteria for balancing privacy, dignity, expression and public interest. Therefore, the objective should not be to enable historical revisionism, but to prevent unjustified perpetual visibility. 

Conclusion

Whether individuals can escape their digital past represents one of the most complex challenges posed by modern technology. The internet enables information to persist indefinitely, irrespective of its current accuracy, relevance or proportionality, with significant implications for employment, reputation and dignity.

Jurisdictions have responded divergently. The EU has developed the most comprehensive regime through Article 17 GDPR, building on _Google Spain_. The UK has retained a similar but qualified right to erasure. India has approached the issue through constitutional privacy and informational autonomy, while the United States prioritises freedom of expression.

South Africa does not provide a general, standalone right to be forgotten, but POPIA’s provisions on correction, deletion, relevance and retention, interpreted alongside constitutional rights to privacy and dignity, provide a foundation. The challenge is to balance these rights against freedom of expression and access to information.

The appropriate solution is not an absolute right to erase the past, which would risk censorship and enable powerful actors to suppress legitimate scrutiny. Nor is it a system that offers no protection against perpetual digital exposure. South Africa should develop a qualified right to digital redemption – recognising that individuals, circumstances and the relevance of information change over time, and providing remedies such as correction, deletion, restriction and de-indexing where continued accessibility is unjustified, while preserving information whose retention serves a legitimate public purpose.

Ultimately, the right to be forgotten should not require society to forget. It should require the law to distinguish between information that society has a legitimate interest in remembering and information whose continued prominence has become disproportionately harmful. In an era where technology remembers everything, justice may sometimes demand recognition of the human need to move forward.

Bibliography

Rosen Jeffrey, ‘The Right to Be Forgotten’ (2012) 64 Stanford Law Review Online 88.

Solove Daniel, Understanding Privacy (Harvard University Press 2008).

 Toriqul Islam, ‘An Introduction to the Right to Privacy – An International Legal Perspective’   2022) www.nyulawglobal.org/globalex/right_to_privacy_international_perspective.html accessed on 05 September 2026

Cases

Bernstein and Others v Bester and Others 1996 (2) SA 751 (CC)

Botha v Smuts and Another [2024] ZACC 22; 2025 (1) SA 581 (CC)

Google Spain SL, Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12, EU:C:2014:317

Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1

[1] Google Spain SL, Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12, EU:C:2014:317.

[2] Regulation (EU) 2016/679 (General Data Protection Regulation) art 17.

[3] GDPR (n 2) art 17(3)

[4] Protection of Personal Information Act 4 of 2013, s 9

[5] Ibid s 10

[6] Ibid s 14

[7] Ibid s 24

[8] Bernstein and Others v Bester and Others 1996 (2) SA 751 (CC)

[9] Botha v Smuts and Another [2024] ZACC 22; 2025 (1) SA 581 (CC)

[10] Google Spain (n 1)

[11] GDPR (n 2) art 17(1)

[12] Ibid art 17(3)

[13] Information Commissioner’s Office, ‘Right to erasure’ (UK GDPR Guidance)

[14] Ibid

[15] Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1

[16] US Constitution, First Amendment

[17] MD Toriqul Islam, ‘An Introduction to the Right to Privacy – An International Legal Perspective’  (MD Toriqul Islam 2022) https://www.nyulawglobal.org/globalex/right_to_privacy_international_perspective.html accessed on 05 September 2026

[18] Office of the United Nations High Commissioner for Human Rights, The Right to Privacy in the Digital Age