Right to erasure ('right to be forgotten')
Article 17 lets a data subject have personal data erased - verbally or in writing - on specified grounds (data no longer needed, consent withdrawn, successful objection, unlawful processing, legal obligation to erase). It is not absolute: Article 17(3) exempts processing necessary for freedom of expression, legal obligations/public-interest tasks, and legal claims. Article 17(2) extends it to public data, and Article 19 requires notifying recipients. The judgment established the search-engine 'right to request delisting'.
Under a data subject can ask - in writing or verbally - for erasure where one of the listed grounds applies. Delisting does not erase the underlying data from the source site or the search engine's index/cache; it only affects results returned for a search of the person's name.
| Grounds for erasure - Art 17(1) | Exemptions - Art 17(3) |
|---|---|
| Data no longer needed for its original purpose, and no new lawful purpose exists | Exercising freedom of expression and information |
| Consent was the basis, consent is withdrawn, and no other lawful ground exists | Compliance with a legal obligation, or a public-interest/official-authority task (e.g. public health, archiving, research, statistics) |
| The data subject objects (Art 21) and there are no overriding grounds | Establishment, exercise or defence of legal claims |
| Data have been processed unlawfully | |
| Erasure is required by EU or member-state law |
A valid erasure request reaches backup archives, not just live systems. Where backups cannot be deleted immediately, the data set must be marked so it cannot easily be restored and reused without a compliance check.
- Article 17(2): where data were made public, the controller must take reasonable steps (incl. technology, weighing cost) to inform other controllers processing it
- Article 19: notify recipients of erasure/rectification/restriction, unless impossible or disproportionate effort (which the controller must prove)
- Strong emphasis on erasing children's data, even if the requester is no longer a child
- Costeja (13 May 2014): a data subject may ask a search engine to delist links appearing under a search of their name