Article 17: Right to erasure ('right to be forgotten') - GDPR

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

(d) the personal data have been unlawfully processed;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(e) for the establishment, exercise or defence of legal claims.

Understanding This Article

Article 17, often called the 'right to be forgotten,' enables data subjects to request deletion of their personal data under specific circumstances. However, this is not an absolute right and must be balanced against other legitimate interests.

Paragraph 1 establishes six grounds for erasure:

(a) No longer necessary: Data was collected for a specific purpose that has been fulfilled

(b) Consent withdrawn: When consent was the only legal basis and it's been withdrawn

(c) Objection: Data subject objects and no overriding legitimate grounds exist

(d) Unlawful processing: Processing violated GDPR or other laws

(e) Legal obligation: Law requires erasure

(f) Children's data: Data collected from children for information society services

Paragraph 2 addresses situations where data was made public. Controllers must take reasonable steps to inform other controllers processing that data about the erasure request, considering available technology and implementation costs.

Paragraph 3 sets out five important exceptions where erasure rights don't apply, including freedom of expression, legal obligations, public health, research purposes, and legal claims.

Key Points

Six grounds for erasure: no longer necessary, consent withdrawn, objection, unlawful processing, legal obligation, or children's data

Controllers must erase data 'without undue delay' when grounds apply

When data was made public, controller must inform other processors

Five exceptions: freedom of expression, legal obligations, public health, research/archiving, and legal claims

Not an absolute right - balances individual rights against other important interests

Practical Application

Common Valid Erasure Requests:

Former customer requests deletion after closing account and data is no longer needed

Job applicant withdraws application and requests deletion of application materials

Newsletter subscriber unsubscribes and requests deletion of email address

Parent requests deletion of child's data from gaming platform

Common Invalid Erasure Requests (Exceptions Apply):

Tax records that must be kept for legal compliance period

Medical records needed for ongoing treatment

Employee data needed for employment law obligations

Data needed for defending against a legal claim

Anonymized research data serving public interest

Implementation Steps:

Assess whether one of the six grounds in paragraph 1 applies

Check if any of the five exceptions in paragraph 3 apply

If erasure is required, delete data 'without undue delay'

Notify recipients of the data (Article 19)

If data was public, take reasonable steps to notify other controllers

Document the request and action taken

Balancing Test Example: A news website cannot be forced to delete an article about a public figure's past conviction just because they want to be "forgotten" - freedom of expression and information (exception 3(a)) overrides the erasure right in most cases.

Understanding This Article

Key Points

Practical Application

Related Recitals

Related Articles in Chapter 3

Popular Articles