The Court of Justice of the European Union (ECJ) upheld the complaint of a Spanish man who objected to the fact that Google searches on his name threw up links to a 1998 newspaper article about the repossession of his home.
It creates both technical challenges and potential extra costs for companies like Google, the world's no.1 search engine, and Facebook.
Google can be required to remove data that are "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed", said judges at the Luxembourg-based court. The ECJ said the rights of people whose privacy has been infringed outweighed the general public interest.
Google said it was disappointed with the ruling, which contradicted a non-binding opinion from the ECJ's court adviser last year that said deleting sensitive information from search results would interfere with freedom of expression.
"We are very surprised that it differs so dramatically from the Advocate General's opinion," said Google spokesman Al Verney.
The European Commission proposed in 2012 that people should have the "right to be forgotten" on the internet.
This was watered down by the European Parliament last year in favour of a "right to erasure" of specific information.
The proposal needs the blessing of the 28 European Union governments before it can become law.