The "right to be forgotten" may be the law of the land in the EU under the bloc's General Data Protection Regulation. But effectively responding to right to be forgotten requests may be more easily said than done in today's digital era. 

Last week, the European Court of Justice ruled that Google didn't need to de-reference all global search engines to fulfil a right to be forgotten request. Instead, the de-reference would apply to EU member states.

Specifically, the CJEU ruled that search engine operators must implement measures to  "effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the member states on the basis of a data subject's name from gaining access… to the links which are the subject" of a right to be forgotten request. But popular privacy tools might make it difficult for search engines to truly prevent an EU citizen from accessing blocked content.

Although it was a victory for Google and other search engine companies, ensuring a website is blocking all required citizens could run into tech challenges, as people use VPNs and other proxies to disguise their IP address.

"For the time being, while the VPN is working correctly, it's impossible to ascertain the user's IP address unless you go to the VPN provider and get the IP address," said Ray Walsh, a VPN expert at ProPrivacy.com, a digital freedom advocacy group.

Walsh added that many VPN providers, in an effort to safeguard their users' privacy, don't store their users' IP address. 

Still, Francoise Gilbert, CEO of legal and cybersecurity consultancy DataMinding, noted that the European Court of Justice's wording in last week's Google decision hints regulators may take into consideration how financially difficult it is to block EU citizens' access.

"The supervisory authorities might look at situations on a case-by-case basis, and take into account the availability, cost and reliability of technologies that might help implement the mandate defined by the CJEU," Gilbert said.

Gilbert said the case-specific analysis would align with decades-long data protection authorities' decisions and the newly implemented GDPR.

"Based on my observation of how data protection authorities have operated for the past 20 years, I observe a trend at attempting to balance the protection of individuals against the constraints that would hamper business," she said. "This concept is found, for example, in the 'legitimate interest' provisions of the GDPR."

To thwart VPNs and other proxies, companies could obtain more website visitors' data to confirm their true IP address, a process that wouldn't automatically run afoul of the GDPR's data minimisation principle if it's needed to comply with the regulation.

"The principle of data minimisation [says] you only need to collect the information that you need to fulfil the purpose for which it was collected," said Odia Kagan, partner and chair of Fox Rothschild's GDPR compliance and international privacy group. "If the purpose for which it is collected is – I need to identify the person's location in order to carry out what will be a legally binding decision – they need to do this to comply with a legally binding decision."

If the data collected is pertinent to identifying an IP address and the data isn't stored beyond answering the IP question, "maybe the balance is tipped in compliance", Kagan said.