{"id":28763,"date":"2026-04-20T15:39:09","date_gmt":"2026-04-20T20:39:09","guid":{"rendered":"https:\/\/www.jasminedirectory.com\/blog\/?p=28763"},"modified":"2026-04-20T15:42:30","modified_gmt":"2026-04-20T20:42:30","slug":"right-to-be-forgotten-how-business-directories-handle-delisting-requests-under-eu-law","status":"publish","type":"post","link":"https:\/\/www.jasminedirectory.com\/blog\/right-to-be-forgotten-how-business-directories-handle-delisting-requests-under-eu-law\/","title":{"rendered":"Right to Be Forgotten: How Business Directories Handle Delisting Requests Under EU Law"},"content":{"rendered":"

A German consultant rang me last spring, furious. He’d won a “right to be forgotten” case against Google \u2014 link scrubbed, URL gone \u2014 and yet his name still appeared on three business directories<\/a> when anyone typed it into Bing. He’d assumed, quite reasonably, that the 2014 Costeja judgment had handed him a universal delete button. It hadn’t. It hadn’t even come close.<\/p>\n

That assumption \u2014 that one ruling fixed everything \u2014 is the founding myth of this entire subject. It persists because it’s emotionally satisfying and because most news coverage stopped paying attention around 2015. Meanwhile, the directory ecosystem kept doing what it always did: replicating, syndicating, and occasionally ignoring polite requests from lawyers.<\/p>\n

I’ve spent the last decade watching businesses, founders, and the occasional disgruntled ex-director try to work through delisting requests across everything from Yell and Europages to smaller niche directories that barely have a compliance officer, let alone a data protection team. What follows is a myth-by-myth walkthrough of what people get wrong \u2014 and what actually works when you need a listing<\/a> gone.<\/p>\n

The “Google Ruling Fixed Everything” Fallacy<\/h2>\n

Why Costeja still dominates the conversation<\/h3>\n

Mario Costeja Gonz\u00e1lez wanted a 1998 newspaper notice about his repossessed property off Google. He got it. The EBSCO overview<\/a> became shorthand for “right to be forgotten” because it was genuinely consequential \u2014 and because journalists love a named plaintiff.<\/p>\n

But Costeja was a search engine case. It wasn’t a directory case, it wasn’t a publisher case, and it wasn’t a “delete this from the internet<\/a>” case. The newspaper’s original archive stayed up. Google just couldn’t surface it against his name.<\/p>\n

This distinction gets lost constantly. I’ve had clients quote Costeja at me as if it were a wand.<\/p>\n

What the 2014 decision actually mandated<\/h3>\n

The ruling required search engines<\/a>, under the old Data Protection Directive, to evaluate delisting requests where information was “inadequate, irrelevant or no longer relevant.” That’s it. Four years later the GDPR codified and broadened this into Article 17 \u2014 but crucially, Article 17 applies to data controllers generally, not just Google.<\/p>\n

Business directories are<\/em> data<\/a> controllers. Which means they have obligations Costeja never spelled out, and which most directory operators worked out by trial and error over the following years.<\/p>\n

The directory-shaped gap in public understanding<\/h3>\n
\n

Did you know?<\/strong> The EBSCO overview<\/a> asserted that search engines could be “compelled to remove links to potentially harmful or irrelevant personal information” \u2014 but said nothing about the underlying sources. Your directory listing is the source, not the link.<\/p>\n<\/div>\n

When I ask new clients where they think their data lives, they usually name two or three directories. The reality is closer to thirty, because \u2014 as Birdeye’s research into the listings ecosystem notes \u2014 Birdeye’s analysis of directory ecosystems<\/a>, meaning your information propagates in ways you never authorised. Costeja addresses none of this. GDPR sort of does. Enforcement, as we’ll see, is another matter.<\/p>\n

Myth: Delisting Equals Data Deletion<\/h2>\n

The search index vs. source record distinction<\/h3>\n

A successful delisting request against Google removes a URL from search results for specific query terms (usually someone’s name). The page still exists. The directory still holds the record. Any other search engine \u2014 Bing, DuckDuckGo, Yandex, Ecosia \u2014 may still surface it, depending on whether and how each handles parallel requests.<\/p>\n

Erasure under Article 17, by contrast, obliges the controller to actually delete the personal data from their records. These are distinctly different remedies and they require distinctly different requests.<\/p>\n

\n

Myth:<\/strong> Getting Google to delist a result means the data is “gone.” Reality:<\/strong> The source record is untouched. Delisting is index-level; erasure is record-level. Requesters routinely conflate the two and then wonder why the listing reappears on competitor search<\/a> engines the following week.<\/p>\n<\/div>\n

A client case: the Companies House confusion<\/h3>\n

I worked with a founder in 2021 \u2014 I’ll call him Tomas \u2014 who’d been a director of a company that went into administration. His name appeared on roughly a dozen business directories that scraped Companies House. He sent GDPR erasure requests to all of them, citing the right to be forgotten.<\/p>\n

Three refused outright. Four deleted his entry within a fortnight. Five ignored him entirely. The problem was that the underlying Companies House record \u2014 which is a statutory register under UK law<\/a> \u2014 remained. Within four months, two of the directories that had deleted his entry had re-scraped it. Whack-a-mole, at industrial scale.<\/p>\n

The lesson: if the source is a public register with a legal basis for processing, delisting from secondary directories<\/a> buys you time, not permanence.<\/p>\n

Why your business listing survives the takedown<\/h3>\n

Most business directory listings<\/a> contain a mix of personal data (director names, perhaps a personal mobile) and commercial information (trading address, services, reviews). Article 17 gives you rights over the personal data. It gives you almost nothing over the commercial record of a registered entity, because legitimate interest and \u2014 often \u2014 legal obligation sit on the directory’s side of the scale.<\/p>\n

This is why “please delete my company’s listing” requests fail more often than they succeed.<\/p>\n

Myth: Every EU Citizen Gets Automatic Removal<\/h2>\n

The public figure and commercial activity exceptions<\/h3>\n

The right to be forgotten is not absolute. It never was. Article 17 itself lists exceptions: freedom of expression, compliance with legal obligations, public interest, and \u2014 the one most relevant here \u2014 the establishment, exercise or defence of legal claims.<\/p>\n

More importantly, the right is heavily qualified for people acting in a commercial or public capacity. A sole trader listed as “Baker Ltd, 14 High Street, proprietor Jane Baker” is operating commercially. Her name in that context isn’t protected the way her home address would be.<\/p>\n

Critics have long flagged the abuse potential here. As the EBSCO overview<\/a> puts it bluntly, “the vagueness of the law and its potential for abuse” allow “individuals, including politicians and criminals, to erase negative aspects of their histories.” Directory operators know this. They’ve become warier.<\/p>\n

Balancing tests directories actually run<\/h3>\n

The good operators run something close to a documented balancing test. The questions look roughly like this:<\/p>\n