How Can You Remove Damaging Outdated Digital Records?

Introduction

Outdated or damaging online records can affect employment, business relationships, professional reputation, and personal security. Philippine law recognizes that individuals may, in appropriate circumstances, ask personal information controllers to erase, block, remove, or de-list personal data that is no longer necessary or is unlawfully processed.

This remedy is not an automatic right to erase every unfavorable search result. The request must be supported by a lawful basis under the Data Privacy Act of 2012, and it remains subject to legitimate interests, legal obligations, freedom of expression, public interest, and the preservation of evidence for legal claims.

What Laws Govern Removal Requests?

The principal statute is the Data Privacy Act of 2012 (R.A. No. 10173). It applies to the processing of personal information by government and private entities, including websites, businesses, online platforms, and other personal information controllers and processors. (R.A. No. 10173, Section 4.)

The Act requires processing to observe transparency, legitimate purpose, and proportionality. Personal information must be collected and used fairly and lawfully, for a specified purpose, and only to the extent reasonably necessary for that purpose. (R.A. No. 10173, Section 11.)

The right to erasure or blocking is implemented through the rules issued under the Act. Where online personal data has already been shared or indexed, the personal information controller may be required to communicate with recipients, other controllers, third-party indexes, and search providers to request deletion, removal, or de-listing of copies or search results. (IRR of R.A. No. 10173, Section 10.)

When May a Person Request Erasure or Blocking?

A request may be appropriate when the continued processing, publication, or indexing of personal information is no longer justified. Common circumstances include data that is outdated, inaccurate, unlawfully processed, excessive, or no longer necessary for the purpose for which it was collected.

A person should generally establish the following:

• The information identifies the person. The request should specify the name, image, account, address, contact details, employment record, or other information involved.
• The respondent controls or processes the information. The recipient may be the website operator, online platform, publisher, search engine, database operator, or another personal information controller.
• The processing is no longer necessary or has become unlawful. Mere embarrassment or disagreement with truthful content may not be enough.
• The requested remedy is proportionate. The person should identify the specific page, post, image, record, search result, or archive entry sought to be removed.
• The request does not improperly defeat another legal right. This includes rights to due process, access to evidence, lawful reporting, public information, and the prosecution or defense of legal claims.

Does Consent Have to Be Withdrawn First?

No. Consent is not the only possible lawful basis for processing personal information. Processing may also be justified by legitimate interests, compliance with a legal obligation, protection of lawful rights, or other statutory grounds, provided the processing is necessary, proportionate, and does not override the fundamental rights and freedoms of the data subject. (NPC 18-109, 2021.)

Accordingly, withdrawing consent does not automatically require removal. The person must still examine whether the platform has another lawful basis for retaining or displaying the information.

How Does the Right to Erasure Work Online?

Under the implementing rules, a personal information controller must take reasonable and appropriate measures when data subject to an erasure request is publicly available online. This may include notifying prior recipients and contacting other personal information controllers, third-party indexes, or search services to request removal or de-listing of copies, links, or search results.

These measures are assessed in light of available technology and implementation costs. A person should therefore distinguish between the following remedies:

• Deletion from the original website: removal of the article, profile, image, post, or record from the source page.
• De-indexing: removal of the page from a search engine’s results for a person’s name or other identifying search terms.
• Blocking: restricting access to or further processing of the personal information.
• Correction: modifying inaccurate or incomplete information rather than deleting it.
• Suppression or restricted access: limiting visibility while preserving the record for a legitimate legal or institutional purpose.

These remedies are not interchangeable. Removing a search result does not necessarily delete the source record, while deleting a source page does not guarantee that cached, copied, or independently published versions will immediately disappear.

What Exceptions May Defeat an Erasure Request?

A personal information controller may deny an erasure or blocking request, wholly or partly, when the information remains necessary for a lawful purpose. Relevant grounds may include compliance with a legal obligation, exercise or defense of legal claims, preservation of evidence, public interest, freedom of expression, or another statutory basis for continued processing.

The National Privacy Commission has recognized that processing personal information for the protection of lawful rights in court proceedings may be lawful even without the data subject’s consent, provided the processing is necessary and properly limited. (Azarraga v. Jalbuna, A.C. No. 13678, 2023.)

That ruling also emphasized that lawful litigation purposes do not give lawyers or other persons unrestricted authority to obtain information from government repositories. Requests remain subject to the issuing agency’s applicable release policies and to the principles of transparency, legitimate purpose, and proportionality. (Azarraga v. Jalbuna, A.C. No. 13678, 2023.)

Similarly, the National Privacy Commission has explained that processing for potential or preparatory legal claims may fall within the lawful basis relating to the establishment, exercise, or defense of legal claims. (NPC Advisory No. 2024-02, 2024.)

Can Truthful but Harmful Information Be Removed?

Not automatically. The fact that information is damaging does not, by itself, establish a violation of the Data Privacy Act. The person must show that continued processing is unlawful, unnecessary, disproportionate, inaccurate, or otherwise inconsistent with the rights and obligations recognized by the Act.

Privacy protection includes the ability to prevent further dissemination of illegally disclosed information and, in appropriate cases, to prevent continued storage or discoverability of information. This concept has been discussed in relation to informational privacy and the right to be forgotten. (Cadajas v. People of the Philippines, G.R. No. 247348, 2021.)

However, the right to privacy must be balanced against lawful public disclosure, freedom of expression, public interest, and the legitimate preservation of records. A request involving public officials, criminal proceedings, court records, matters of public safety, or substantial public concern will ordinarily require a more careful proportionality assessment.

What Evidence Should Accompany the Request?

A well-supported request should identify the information precisely and explain why continued processing is unlawful or no longer necessary. The following materials may be useful:

• screenshots showing the complete URL, date, account name, and visible content;
• proof that the information relates to the requesting person;
• documents showing that the information is inaccurate, outdated, withdrawn, or published without lawful basis;
• evidence of consent withdrawal, contractual termination, dismissal, acquittal, settlement, or other material change in circumstances;
• copies of prior correspondence with the website operator, platform, publisher, or search provider; and
• an explanation of the specific harm caused by continued access or indexing.

Photographs or allegations alone may be insufficient. In a residential CCTV dispute, the National Privacy Commission found that a camera did not automatically amount to unauthorized processing where the installation was justified by legitimate interests, limited in scope, and not shown by substantial evidence to override the rights of data subjects. (NPC 19-1429, 2024.)

What Should a Formal Removal Request Contain?

The request should be addressed to the platform’s privacy office, data protection officer, or designated complaints channel. It should use a factual and restrained tone, avoid unnecessary disclosure of sensitive information, and request a written decision within a reasonable period.

The request should state:

• the requester’s identity and contact information;
• the precise information, page, post, image, or search result involved;
• the legal and factual grounds for deletion, blocking, correction, or de-indexing;
• the harm caused by continued processing;
• the requested action and its proper scope; and
• the documents supporting the request.

The requester should ask the platform to preserve only what is legally necessary, while removing public access where continued public availability is no longer justified. If the platform denies the request, the requester should ask for the specific legal basis, retention period, recipient categories, and available appeal or complaint procedure.

What If the Platform Refuses?

A refusal should first be reviewed to determine whether the platform relies on a lawful retention ground, such as legal compliance, fraud prevention, public interest, or the establishment or defense of legal claims. The requester may respond with a narrower proposal, such as correction, anonymization, restricted access, removal of identifying details, or de-indexing rather than complete deletion.

If the dispute cannot be resolved, the affected person may consider filing a complaint with the National Privacy Commission, subject to its procedural requirements and jurisdiction. The complaint should include the original request, the platform’s response, the disputed material, and evidence showing why the continued processing is unlawful or disproportionate.

How Should Search Engines and Platform Archives Be Treated Differently?

A search engine and the original publisher may perform different processing operations. The publisher controls the source page, while the search engine controls indexing, ranking, snippets, and discoverability through particular search terms.

A person may therefore send separate requests:

• to the publisher for deletion, correction, anonymization, or restricted access;
• to the search engine for de-indexing or removal of a result associated with the person’s name;
• to social media platforms for removal of reposts, images, profiles, or archived content; and
• to third-party databases or aggregators for deletion or correction of copied records.

Each request should be tailored to the entity’s actual role. A search engine may not be able to correct information appearing on a source website, while the source website may not control independent copies or search indexes.

Important Limits on the Right to Be Forgotten

The right to be forgotten is not an unrestricted power to rewrite history. It does not necessarily require removal of accurate records that remain relevant to legal proceedings, public accountability, regulatory compliance, public safety, or the exercise of lawful rights.

The Supreme Court has recognized that privacy includes protection against unwanted inspection, disclosure, further dissemination, and, in appropriate circumstances, continued storage. At the same time, privacy claims must be assessed within the constitutional and statutory limits governing the particular information and its use. (Cadajas v. People of the Philippines, G.R. No. 247348, 2021.)

Where the issue involves a government database, public records, or data shared among government institutions, the processing remains subject to the Data Privacy Act. The scope of the Act includes government institutions and private entities involved in processing personal information. (KAPIT v. City of Manila, et al., G.R. Nos. 261892, 262192, and 263752, 2026.)

Practical Recommendations

Individuals seeking removal should preserve evidence before contacting the platform, identify every known copy, and avoid sending more personal information than necessary. The request should focus on a specific legal defect rather than simply asserting that the material is offensive or embarrassing.

Where complete deletion is unlikely, request less intrusive relief: correction, anonymization, removal of sensitive identifiers, restricted access, de-indexing, or a notice explaining that the information is outdated or disputed. If the record is relevant to an ongoing case, consult counsel before requesting deletion because destroying or altering potentially material evidence may create separate legal problems.

Conclusion

Philippine privacy law provides meaningful tools for addressing damaging and outdated digital records, including erasure, blocking, correction, and de-listing of search results. The strongest request identifies the precise data, establishes why continued processing is unlawful or unnecessary, proposes a proportionate remedy, and addresses any competing legal or public-interest grounds for retention.

Removal is most likely when the data is inaccurate, unlawfully disclosed, no longer necessary, or publicly indexed without a continuing lawful purpose. It is less likely when the information is needed for legal claims, regulatory duties, public accountability, or other protected purposes.

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.