The internet has a long memory. It can remember things long after everyone else has forgotten them. In some cases, this can lead to a pleasant surprise: long-lost pictures, an old witticism, a fragment of a distant conversation.

But growing numbers of people are finding that the internet’s long memory can be misleading, malicious or plain wrong. And they are taking the fight to the big repositories of personal data principally, but not only, Google and Facebook.

Take Mario Costeja. Google his name and one of the first things you find is that he had financial problems in the 1990s and was forced to sell his house to pay off a debt.

That was 15 years ago. Costeja argues that in a world where clients, employers and lovers look up people who interest them on Google, the information is misleading and the damage to his reputation as a reliable forensic handwriting expert is wholly unfair.

“I even changed a letter in my surname on my business cards,” he said. “That way people would not find me. These days everyone looks in Google.”

“The debt was paid off,” he said. “But it seems they have no obligation to publish the fact that you have paid it.”

Costeja has become a pioneer for the idea of the “right to be forgotten”, taking his case against Google to the European court of justice in Luxembourg, where a ruling is expected by the end of the year. But he is not alone.

Max Schrems, a 25-year-old Austrian law graduate, is leading a vocal campaign against what he claims are Facebook’s illegal practices of collecting and marketing users’ personal data, often without consent. Schrems complained to the Irish data protection commissioner (European Facebook users are administered by its Irish subsidiary) that the social networking site held 1,200 pages of personal data about him, despite the fact that he had deleted much of it.

“My case with Facebook is going in the right direction but Facebook will only go as far as the Irish authorities push it to go, so it’s a very slow process, but we have achieved several things, such as a new privacy policy, and changes to data retention so that certain data has to be deleted after a year. A lot of stuff has come out of our case so far, but there’s still around 80% of the law that they are not abiding by.

New EU rules on the right to be forgotten are being championed by the EU justice commissioner, Viviane Reding, heralding the prospect of serious fines for companies that refuse to honour requests from customers to erase personal data.

Respondents to a Guardian survey of readers on their experience of internet privacy threw up the following frequent complaints:

* Difficulties with erasing social media accounts and ensuring all data therein is deleted

* Problems with the Google search function which elevates outdated, tendentious or incorrect information about an individual to the top of the search results.

* Lack of control over pictures posted by other people.

* Worries with internet “tracking” software that monitors usage and builds up a picture of an individual’s internet habits.

Costeja’s case falls into the second category. When he first complained, Spain’s data protection agency ruled only partially in his favour. La Vanguardia newspaper, which published the information, was protected by freedom of speech or information rights and, so, had no obligation to remove the item. The information was true and was part of a list of properties, posted in the newspaper by law, belonging to debtors that the government was planning to forcibly sell.

Google, however, was told to remove its link. It was, in effect, deemed to be making money out of Costeja’s personal data and a further 180 Spaniards have won similar orders.

The internet giant challenged the decision and now Spain’s national court has asked European judges for guidance.

Costeja’s lawyer, Joaquin Muoz, said his client was asking for the right for data to be eradicated just as he might demand of any other company storing his personal data. Muoz said other countries who sent representatives to the court, including Italy and Austria, backed the Spanish position.

But Google claims it is defending freedom of expression and battling censorship. It argued that as a company operating from the US European data directives did not apply to its search engines and that these did not process or control personal data. The company told the court it was simply an intermediary that indexed already published data.

“There are clear societal reasons why this kind of information should be publicly available,” William Echikson of Google, wrote in a web post. “People shouldn’t be prevented from learning that a politician was convicted of taking a bribe, or that a doctor was convicted of malpractice.

“Search engines point to information that is published online and in this case to information that had to be made public, by law. In our view, only the original publisher can take the decision to remove such content.”

Complaints

With its instinctive sense of privacy, France has seen a sharp rise in internet-users demanding the “right to be forgotten” online, as more people lodge formal complaints with the national data protection agency asking blogs and websites to delete items such as compromising or out-of-date personal information or embarrassing photographs.

The French data protection watchdog, La Commission nationale de l’informatique et des liberts, or CNIL, which has joined other European bodies in backing new European commissionmoves for data protection, is dealing with growing requests for information to be removed from French sites and in most cases has successfully negotiated for data to be deleted.

Formal complaints to the watchdog include parents who want photographs of their children to be deleted, the removal of incorrect data or people demanding that online references to historic court decisions not mention their name but be made anonymous a legal right in certain cases in France after a sentence has been served. Many right to be forgotten cases concerned people who had created a profile on an online community which years later they had forgotten existed, had lost their log-in details and worried about a profile that “no longer reflected reality or could damage their search for work”. These cases were often easily resolved with sites agreeing to remove defunct profiles.

The right to be forgotten online has long been a political debate in France, with the former rightwing minister for digital development, Nathalie Kosciusko-Morizet, setting up a charter in 2010 aimed at protecting personal information. “The internet must not be demonised, there are numerous types of content posted online that we want to keep, but in certain cases we would like to be able to delete them,” she said. Her ideas included a centralised online complaints mechanism for requests for accounts to be deleted. Some companies, including Microsoft France, signed up to the non-binding charter, but other major players, such as Facebook and Google, did not.

Guardian News and Media 2013