What is the Right to be Forgotten?
The right to be forgotten, formally known as the right to erasure, is enshrined in Article 17 of the GDPR. It gives individuals the right to have their personal data erased in certain circumstances.
When Does the Right Apply?
Individuals have the right to have their data erased when:
- The personal data is no longer necessary for the purpose it was originally collected or processed
- The individual withdraws consent (where consent was the legal basis) and there is no other legal ground for processing
- The individual objects to the processing and there are no overriding legitimate grounds
- The personal data has been unlawfully processed
- The personal data must be erased to comply with a legal obligation
- The personal data was collected in relation to the offer of information society services to a child
Exceptions to the Right
The right to erasure does not apply when processing is necessary for:
- Exercising the right of freedom of expression and information
- Compliance with a legal obligation or performance of a task in the public interest
- Public health purposes in the public interest
- Archiving purposes in the public interest, scientific or historical research, or statistical purposes (where erasure would seriously impair achievement of objectives)
- The establishment, exercise or defense of legal claims
Obligations for Controllers
When a controller has made personal data public and is obliged to erase it, they must take reasonable steps, including technical measures, to inform other controllers processing the data that the individual has requested erasure of links to, copies, or replication of that data.
Response Timeline
Organizations must respond to erasure requests without undue delay and within one month of receipt (extendable by two further months for complex requests).
Balancing Rights
The right to erasure must be balanced against other rights and interests. Organizations must carefully assess each request and document their decision-making process.