This thesis aims to contribute to the general debate on the meaning, conditions and modalities of exercising privacy and control over personal data in the digital environment. Firstly, the concept of the right to be forgotten is presented, which has been considered in legal practice and professional circles even before its official codification in Article 17 of the General Data Protection Regulation (GDPR). The applicable legal framework is analyzed, with a special emphasis on the relevant cases of the Court of Justice of the European Union (CJEU) that established “the right to be forgotten” as a right of an individual to demand and obtain from search engines delisting of certain search results, but also limited its application to EU-specific domain extensions and imposed specific obligations on search engines. Then, significant decisions of national data protection authorities (DPAs) against Google are examined, as well as the issue of balancing the rights to privacy and data protection with the freedom of expression and information. The procedure of submitting a delisting request to Google and the criteria for its assessment are analyzed, in addition to the other possibilities available to individuals for protecting their privacy online. Finally, this thesis discusses the remaining current and potential issues relating to the protection of personal data and the practical implementation of the right to be (digitally) forgotten.