Right to Erasure ("Right to be Forgotten") under Article 17 GDPR
What is the Right to Erasure?
The Right to Erasure, also known as the "Right to be Forgotten", is defined in Article 17 of the General Data Protection Regulation (GDPR). It allows data subjects to request the prompt deletion of their personal data when certain legal grounds are met.
When Does the Right to Erasure Apply?
Data subjects may request erasure in the following cases:
- The data is no longer needed for the original purposes
- The data subject withdraws consent and no other legal basis exists
- An objection is raised (Article 21 GDPR) and no overriding legitimate grounds apply
- The processing was unlawful
- Erasure is required to comply with legal obligations
- The data was collected in relation to information society services (e.g., children under Article 8 GDPR)
In such cases, the controller must delete the data without undue delay.
Exceptions to the Right to Erasure
This right does not apply if processing is necessary for:
- Exercising the right to freedom of expression and information
- Compliance with legal obligations or performance of tasks in the public interest
- Public interest in the area of public health
- Archiving, scientific or historical research purposes, where erasure would seriously impair the objectives
- Establishment, exercise, or defence of legal claims
Controller Obligations
If the data has been made public, the controller must take reasonable steps to inform other controllers of the erasure request (Article 17(2) GDPR).
Under Article 19 GDPR, all recipients must be informed of the erasure, where feasible.
How Can the Right to Erasure Be Exercised?
The request can be made in writing, electronically, or orally. The data subject must be clearly identifiable.
The controller must respond within one month. This may be extended by up to two months in exceptional cases.
The response must be provided in a clear, transparent, and intelligible form in accordance with Article 12(1) GDPR.
