Can You Petition Social Media Platforms to Be Forgotten?
Introduction
Old, inaccurate, or damaging information can remain searchable long after the event that produced it has ended. Philippine law recognizes an individual’s interest in controlling the collection, use, disclosure, and continued availability of personal information, but the right to be forgotten does not automatically require every post, search result, or account to be deleted.
The principal legal basis is the Data Privacy Act of 2012, which grants data subjects the right to request the erasure or blocking of personal data in appropriate circumstances. The request must still be assessed against lawful purposes, legal obligations, legitimate claims, public interest, freedom of expression, and the rights of other persons.
What Is the Right to Be Forgotten?
The right to be forgotten generally refers to the right to prevent the continued storage, publication, indexing, or dissemination of personal information when its retention is no longer justified or when continued availability causes an unlawful or disproportionate intrusion into privacy.
The Supreme Court has recognized informational privacy as including the ability to prevent first disclosure, stop further dissemination of information already disclosed, and, in appropriate cases, prevent the continued storage of data. This discussion appears in the ruling and separate opinion materials concerning informational privacy in Cadajas v. People of the Philippines (G.R. No. 247348, 2021) and in the separate opinion materials in KAPIT, et al. v. City of Manila, et al. (G.R. Nos. 261892, 262192, and 263752, 2026).
These authorities do not establish an unlimited right to erase all information from the internet. They describe privacy interests that must be balanced with lawful processing, public interest, due process, and the rights of others.
Governing Philippine Law
The Data Privacy Act of 2012 applies to the processing of personal information by both private and government entities. Personal information includes information from which an individual’s identity is apparent or can reasonably and directly be determined, whether by the information alone or together with other information held by the entity.
The Act recognizes the data subject’s right to request the removal, blocking, or destruction of personal data that is unlawfully obtained or processed, is no longer necessary for the purpose for which it was collected, is prejudicial to the data subject, or is otherwise retained in violation of the law. These rights arise under Section 16 of Republic Act No. 10173.
The implementing rules require processing to observe transparency, legitimate purpose, and proportionality. The processing must be appropriate, relevant, and not excessive in relation to the declared purpose. These principles are stated in the IRR of Republic Act No. 10173.
When May a Person Request Removal?
A removal request may be appropriate where the continued processing or publication of personal information has no remaining lawful purpose, exceeds the purpose for which the information was collected, or creates a disproportionate intrusion into the data subject’s rights.
Typical examples include:
- an online advertisement that continues to identify a person after that person has withdrawn from the relevant business or relationship;
- outdated contact details, photographs, or account information that remain publicly accessible without a present lawful purpose;
- search results that expose personal information unrelated to public interest; and
- duplicate or inaccurate personal information that continues to be indexed or republished after correction or removal from the original source.
In NPC 20-026 (2022), the National Privacy Commission treated the continued posting of a former agent’s personal information in online advertisements after her resignation as unauthorized processing. The decision also discussed obligations relating to erasure, including informing recipients and requesting other personal information controllers, indexes, or search services to remove copies or links where the data is publicly available.
What Must Be Established?
A persuasive request should establish the following circumstances:
- The information identifies the requester. The requester should identify the data, account, page, advertisement, image, video, or search result and explain how it identifies or can reasonably identify the person.
- The respondent processes or controls the information. The request should identify the social media platform, search engine, website operator, advertiser, page administrator, or other personal information controller involved.
- The processing is no longer necessary or has become unlawful. The requester should explain why the original purpose has ended, why the information is inaccurate, or why continued publication is excessive or prejudicial.
- The requested action is proportionate. The requester should specify whether the appropriate remedy is correction, de-indexing, restriction, blocking, deletion, account deactivation, or removal from a particular audience.
The requester should preserve screenshots, URLs, dates of access, copies of correspondence, and evidence showing the effect of the continued publication. Evidence is especially important where the platform disputes ownership, control, accuracy, or the legal basis for processing.
When May the Request Be Denied?
The right to erasure is subject to exceptions. A request may be denied wholly or partly when retention is still necessary for the original purpose, compliance with a legal obligation, or the establishment, exercise, or defense of a legal claim.
The National Privacy Commission has also explained that a request for erasure must be evaluated against the purpose and legal basis of the processing. The requester’s privacy interest does not automatically prevail where the information is necessary for litigation, regulatory compliance, public accountability, or another lawful purpose.
Under the NPC Advisory on Data Subject Rights discussed in NPC 20-026 (2022), a personal information controller may deny erasure when the data remains necessary for the purpose for which it was obtained, for compliance with a legal obligation, or for the establishment, exercise, or defense of a legal claim.
Social Media Posts and the Expectation of Privacy
The privacy analysis also depends on how the information was made available. In Vivares, et al. v. St. Theresa’s College, et al. (G.R. No. 202666, 2014), the Supreme Court ruled that informational privacy in social networking sites is not absolute. A reasonable expectation of privacy depends in part on whether the user used available privacy settings to restrict access.
A publicly accessible post is not automatically free from all legal protection. However, public availability may affect the strength of the privacy claim, the proper remedy, and the assessment of whether the platform or another party processed the information unlawfully.
How to Make a Removal Request
1. Identify the exact data
List each post, image, video, profile, advertisement, search result, or account that is being challenged. Include screenshots, dates, account names, and the relevant web address in the submission to the platform.
2. State the legal and factual grounds
Explain whether the information is inaccurate, outdated, excessive, unlawfully disclosed, retained without a present purpose, or being used beyond the purpose for which it was collected. Avoid making a general demand for the deletion of all information about the requester.
3. Request a specific remedy
Depending on the circumstances, request correction, restriction of access, removal from search indexing, deletion from the platform, blocking, or destruction of the data. A narrowly tailored request is more likely to receive a meaningful response.
4. Address lawful retention
Explain why the information is not needed for a legal claim, regulatory duty, contractual obligation, public record, or other lawful purpose. If only part of the information is objectionable, request partial removal or redaction instead of complete deletion.
5. Preserve the platform’s response
Keep the request, proof of submission, automated acknowledgment, platform decision, and any subsequent correspondence. These records may be relevant if a complaint is later filed with the National Privacy Commission.
What If the Platform Refuses?
The requester may first seek review through the platform’s privacy, safety, content-moderation, or data-protection channel. The request should be directed to the entity that controls the processing, rather than relying only on a general report button.
If the platform refuses to act, provides no adequate response, or continues processing despite a valid request, the requester may consider filing a complaint with the National Privacy Commission, subject to the Commission’s procedural requirements and the need to show a sufficient factual and legal basis.
The complaint should identify the parties, describe the personal information, explain the alleged violation, attach supporting documents, and state the relief requested. A complainant should also be prepared to show ownership or control of the personal information and the steps taken to raise the matter directly with the personal information controller.
Search Engines and Social Media Platforms Are Not Identical
A social media platform may control the original post, account, or uploaded file. A search engine may only index or display a link to information hosted elsewhere. The proper remedy may therefore differ.
| Situation | Possible request |
|---|---|
| Inaccurate information on the original platform | Correction, restriction, or removal from the original account or page |
| Information lawfully removed from the original website but still appearing in search results | De-indexing, removal of cached results, or updating of the search listing |
| Former employment or business advertisement still identifying the requester | Removal of the advertisement and related copies after the original purpose has ended |
| Information needed for a pending legal claim | Limited access, redaction, or retention subject to the claim rather than immediate deletion |
Where personal data is publicly available, the personal information controller may also have to take reasonable and appropriate measures to communicate with other controllers, including third-party indexes, and request the removal or de-listing of copies or search results. The appropriate response depends on the available technology, cost, purpose of processing, and the rights affected.
Practical Limits of the Right to Be Forgotten
The right to be forgotten does not guarantee the removal of truthful information involving public proceedings, public officials, matters of public concern, or evidence necessary for legal claims. It also does not necessarily require a platform to erase an entire account when a narrower remedy can address the privacy harm.
Likewise, deletion from one platform does not prevent another person from independently processing information for a lawful purpose. The requester must identify the specific processing activity and the entity responsible for it.
A request may be stronger when it is supported by proof that the information is false, no longer relevant, unnecessarily exposed to the public, or being used for a purpose unrelated to its original collection. It may be weaker when the information is voluntarily and publicly posted, remains relevant to public interest, or is required for legal or regulatory purposes.
Recommended Approach
Individuals seeking removal should begin with a documented, targeted request to the relevant platform or website operator. The request should identify the data, explain the privacy harm, state the legal basis, propose a proportionate remedy, and address any reason the platform may have for retaining the information.
If the request is denied, the requester should evaluate whether the dispute concerns unlawful processing, inaccuracy, lack of necessity, failure to observe proportionality, or a disagreement over public interest. The available evidence should then be organized before seeking relief from the National Privacy Commission or another competent authority.
In general, the right to be forgotten is a right to seek justified removal or restriction—not an automatic power to erase every unfavorable digital record. The strongest claims connect the challenged information to a specific data-processing activity and demonstrate why continued availability is no longer lawful, necessary, or proportionate under the Data Privacy Act.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
