# Right to be Forgotten — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/right-to-be-forgotten > Sources are cited per item. Verify against the official texts before relying on them. Right to have personal data erased under certain conditions ## Overview ## Legal Framework The right to be forgotten is codified in [Article 17 GDPR](/laws/gdpr/art-17), which grants data subjects the right to obtain erasure of their personal data under six enumerated grounds. The controller must act "without undue delay" once any ground applies — whether the data are no longer necessary, consent is withdrawn, the data subject objects under Article 21, the processing was unlawful, a legal obligation requires erasure, or the data were collected in connection with information society services offered to a child. > "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:" > — [GDPR Art. 17(1)](/laws/gdpr/art-17#par-1) Where the controller has made personal data public and is obliged to erase it, Article 17(2) extends the obligation to take reasonable steps — including technical measures — to inform other controllers processing links to or copies of that data. [Article 19 GDPR](/laws/gdpr/art-19) separately requires the controller to notify each recipient to whom the data were disclosed: > "The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort." > — [GDPR Art. 19](/laws/gdpr/art-19) [Article 15(1)(e)](/laws/gdpr/art-15#par-1-pnt-e) ties these rights together by requiring controllers to inform data subjects of the existence of the right to request erasure when responding to access requests. ## Key Developments The CJEU has repeatedly confirmed the structure of Article 17 in cases including *GC and Others v CNIL*, *Österreichische Datenschutzbehörde v CRIF*, and *X v Russmedia Digital SRL*, though the precise contours of when erasure must override other interests remain actively tested. Enforcement authorities have not hesitated to act where controllers obstruct erasure requests. In the Spanish DPA's action against Kutxabank, the authority investigated a bank that effectively blocked a former customer from opening a new account because of a prior erasure request, requiring the data subject to "unblock" data to proceed. In the Google LLC case, the AEPD found that automatic transmission of data subjects' information to the Lumen project — without any opportunity to object — undermined the right to erasure, and the DPA specifically found that Google "did not sufficiently enable data subjects to exercise their right to erasure of their data." > "the DPA also found that Google did not sufficiently enable data subjects to exercise their right to erasure of their data." > — [Spanish DPA (AEPD), Google LLC §2](/posts/47291#seg-2) ## Status of the Debate This topic is contested in court. While the CJEU has consistently reaffirmed the textual structure of Article 17, the boundaries — particularly the balance between erasure and competing interests such as freedom of expression, archiving in the public interest, and the extraterritorial reach of delisting obligations — remain actively litigated. The EDPB's Guidelines 5/2019 on the search engines cases and Opinion 39/2021 on whether supervisory authorities may order erasure ex officio illustrate that even the question of whether erasure requires a data-subject request is not fully settled: A definitive CJEU ruling on the ex officio erasure question would resolve the open debate on whether Article 58(2)(g) can independently ground an erasure order. ## Practical Guidance - **Map each processing activity to a retention trigger**: For every dataset, identify which of the six Article 17(1) grounds could activate erasure and build automated retention schedules that execute deletion when the trigger fires (e.g., consent withdrawal, purpose exhaustion). - **Build downstream notification workflows**: Article 19 requires communicating erasure to all recipients of the data. Maintain a current register of disclosures so that notification can be executed without disproportionate effort. - **Do not condition erasure on counter-obligations**: The Kutxabank enforcement demonstrates that blocking a data subject's future interactions because of a prior erasure request attracts regulatory action. Erasure must be clean and unconditional. - **Assess public-data takedown obligations under Article 17(2)**: Where personal data has been published, document the reasonable technical steps taken to inform downstream controllers of links or copies — and record the cost-benefit analysis that informed those steps. - **Ensure objection mechanisms are functional at all times**: The Google enforcement shows that coupling data transfers to mandatory conditions without an opt-out path undermines both the legal basis and the erasure right simultaneously. ## Legislation (full text of key provisions) ### Right to erasure (‘right to be forgotten’) *Source: GDPR, gdpr-art-17-en, 2016-04-27 — https://overview.legal/posts/90426* ### Notification obligation regarding rectification or erasure of personal data or restriction of processing *Source: GDPR, gdpr-art-19-en, 2016-04-27 — https://overview.legal/posts/90457* The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ### Recital 66 — right to erasure online environment *Source: GDPR, gdpr-rec-66-en, 2016-04-27 — https://overview.legal/posts/91647* To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request. ### Recital 65 — data subject rectification and erasure rights *Source: GDPR, gdpr-rec-65-en, 2016-04-27 — https://overview.legal/posts/91645* A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. ### Recital 59 — modalities for data subject rights exercise *Source: GDPR, gdpr-rec-59-en, 2016-04-27 — https://overview.legal/posts/91633* Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests. ### Recital 73 — lawful restrictions on data subject rights *Source: GDPR, gdpr-rec-73-en, 2016-04-27 — https://overview.legal/posts/91661* Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms. ### Recital 68 — data subject data portability right *Source: GDPR, gdpr-rec-68-en, 2016-04-27 — https://overview.legal/posts/91651* To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject should also be allowed to receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. Data controllers should be encouraged to develop interoperable formats that enable data portability. That right should apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller. The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible. Where, in a certain set of personal data, more than one data subject is concerned, the right to receive the personal data should be without prejudice to the rights and freedoms of other data subjects in accordance with this Regulation. Furthermore, that right should not prejudice the right of the data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another. ## Case law ### CJEU C-312/24 Darashev: Data subject's right to erasure of criminal investigation data *Source: Court of Justice of the European Union, C-312/24, 2025-09-04 — https://overview.legal/posts/158443 — original: https://gdprhub.eu/index.php?title=CJEU_-_Case_C_312/24_-_Darashev* Facts — The data subject is a police officer, holding various positions at the Internal Security directorate-general of the Bulgarian Ministry of the Interior (controller). In March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. A few days later, the data subject was arrested and after being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures, which in the course of 2016, were suspended without the offender having been identified. The controller stored the data about the criminal investigation on his personnel file, as provided by the ministerial instruction relating to personnel files, issued as a regulatory act pursuant to the statutory authorisation provided for in the Law on the Ministry of the Interior (ZMVR). The data subject continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry but he was rejected. The data subject brought an action before the Sofia District Court (Sofiyski rayonen sad) seeking compensation for non-material damage for the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asked that his name be erased from the database kept by the controller, in which he is mentioned as a suspect. In this context the court decided to stay the proceedings and to refer some questions to the CJEU for a preliminary ruling, regarding the interplay of the GDPR with the Law Enforcement Directive (LED), and more specifically regarding the storage of data concerning the official in his personnel file. The questions were combined and reformulated by the AG as follows: whether Article 2(1) GDPR and Article 9(1) LED are to be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of LED. whether Article 17(3) GDPR, read in conjunction with Article 6(1)(c) and Article 6(3) thereof, is to be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, may be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform. Holding — Regarding the first question about the scope of the GDPR, the AG responded positively, that the GDPR does apply in this case, provided that the storage of that data pursues purposes other than those set out in Article 1(1) LED, purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regarding the second question, the AG responded negatively, that the storage of the data subject’s data in this case was not lawful. First, he clarified that within the meaning of Article 6(3) GDPR, the storage of personal data could be based on a legal obligation being defined in a national law other that a law stricto sensu, though in accordance with national constitutional law. Therefore, in this case, the ministerial instruction was considered an appropriate legal basis. Nevertheless, the AG expressed doubts as to the foreseeability of the purposes of the processing, which, in accordance with Article 6(3) GDPR must be determined by the legal basis of the processing. As laid down in the ministerial instruction, the purpose of the storage was for reasons of ‘change of duties’. The AG considered that this, did not appear to meet an objective of public interest, for the purposes of Article 6(3) GDPR. Furthermore, he failed to see how the nature of the duties of maintaining public order, which fall to the data subject, could justify the storage of the data at issue in his personnel file. In conclusion, the AG opined that the storage of the data at issue was not lawful and that the data subject had the right to have them erased, pursuant to Article 17(1)(d) GDPR. ### Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság *Source: Court of Justice of the European Union, C-46/23, 2024-03-14 — https://overview.legal/posts/132267 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0046* In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory authority to order a controller to erase unlawfully processed personal data without a prior request from the data subject. The case arose from a dispute between the Budapest District IV (Újpest) municipal administration and the Hungarian National Data Protection and Freedom of Information Authority (NAIH), which had ordered the municipality to erase unlawfully processed data. The Court held that GDPR provisions do not require a prior data subject request for a supervisory authority to exercise its corrective power to order erasure of unlawfully processed personal data, as such a requirement would undermine the consistent and effective protection of fundamental rights under the GDPR. ### Proximus NV v Gegevensbeschermingsautoriteit *Source: Court of Justice of the European Union, C-129/21, 2022-10-27 — https://overview.legal/posts/132304 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129* In a preliminary ruling requested by the Brussels Court of Appeal, the Court of Justice of the European Union addressed the interpretation of Article 12 of Directive 2002/58/EC (ePrivacy Directive) and several GDPR provisions in proceedings between Proximus NV and the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit). The core issue concerned the obligations of providers of public telephone directories regarding subscriber consent, information requirements, and the right to erasure under the GDPR, following the DPA's imposition of a EUR 20,000 fine and remedial orders against Proximus. The Court clarified the interplay between the ePrivacy Directive's consent regime for directory inclusion and the GDPR's broader data protection obligations, including the controller's responsibility to ensure erasure of subscriber data upon withdrawal of consent. ### CJEU - C-12/25 *Source: CJEU, C-12/25, 2026-10-01 — https://overview.legal/posts/593202 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-12/25* Facts — The data subject was baptised as a minor. The name, date and place of birth and place of baptism were recorded in the baptismal register with the Bisdom Gent (Diocese of Ghent, controller). The baptismal register is a physical book that indicates the date of birth and the place of baptism. It is kept in a safeguarded storage (for example in a locked safe or dedicated room) that only a limited amount of persons affiliated with the Diocese have access to. After the data subject departed from the Church, they requested the controller to erase their personal data from the register. The controller recorded the departure of the data subject from the church with an annotation in the baptismal register. Upon the request, the controller stroke through the personal data of the data subject from the registry, however, it remained legible. The data subject complained with the DPA. The DPA found an infringement of the GDPR. The controller appealed the decision with the Court of Appeal of Brussels. The Court of Appeal, having doubts about the interpretation of the GDPR, referred the question to the CJEU for a preliminary ruling whether an individual who was baptised as a minor and who, as an adult, wishes to dissociate themselves from the religious community in question, has the right to have their personal data erased from the baptismal register. The referring court also wishes to know whether the mere annotation, in the margin of the baptismal register, that a person has left the religious community constitutes ‘erasure’ within the meaning of Article 17(1) and (3) of the GDPR. Advocate General Opinion — The Advocate General structured the opinion under the aspects of applicability of the GDPR, right to erasure, archiving in the public interest or historical research, and the concept of "erasure". 1. Applicability of the GDPR — Firstly, according to the Advocate General Medina, the baptismal register is to be considered a filing system under Article 4(6) GDPR. Therefore, the GDPR is applicable despite the manual processing of the data. The personal data in the register is arranged according to a particular logic and the information therein can be easily retrieved. The register is structured on the basis of a geographical criterion (the location of the parish) and a chronological criterion (the date of celebration). It is immaterial that the criteria employed to structure the filing system do not directly concern the data subjects who were baptised. Neither is it relevant that the register is only available to a limited number of persons. The Advocate General clarified that the GDPR is also applicable in its personal scope to entities such as churches or religious communities. 2. Right to erasure under Article 17(1)(c) GDPR and Article 17(1)(d) GDPR — The data subject can request the erasure of their personal data under Article 17(1)(d) GDPR when the processing was unlawful. The processing of the data subject’s personal data in the baptismal register is to be considered special categories of personal data pursuant to Article 9(1) GDPR, namely data on the religious belief. The conditions of Article 9(2)(d) GDPR are met because the data is processed by a religious entity and the register is safeguarded. Moreover, the controller can rely on the legal basis of Article 6(1)(f) GDPR for the processing of the data because the controller pursues the interest of ensuring a proper administration of the sacraments. It is necessary to keep a record of all baptisms in order to prevent believers from being baptised twice. The sacraments are of utmost importance to the Church. When balancing the interest of the controller with the rights and interests of the data subject under Article 6(1)(f) GDPR, the Advocate General took into account the fact that the data subject was unable to consent to the data processing because they were a child at the time of the baptism. On the other hand, the Advocate General considered that only a limited number of people have access to the register, which is a mitigating factor. Moreover, the register also serves the interests of individuals who need to provide proof of their baptism in order to receive other sacraments such as religious marriage. According to the Advocate General, whether the processing could be based on Article 6(1)(f) GDPR is ultimately for the referring court to decide. In case of the affirmative, the data subject could not request the erasure pursuant to Article 17(1)(d) GDPR before the controller was informed about the data subject’s objection to the processing. Pursuant to Article 17(1)(c) GDPR, the data subject has a right to erasure when the data subject objects to the processing under Article 21(1) GDPR and there are no overriding compelling legitimate grounds for the processing that the controller can rely on. The correct administration of sacraments can be considered a compelling legitimate ground. However, it is for the national court do decide whether the processing is necessary in order to ensure the correct administration of the sacraments. It must be considered that the data subject can provide other means of evidence proving the fact that he has been baptised in the past, such as the correspondence with the parish. As far as the balancing of interests pursuant to Article 17(1)(c) GDPR is concerned, the Advocate General argued that the emotional distress of the data subject to be perceived as belonging to a religious community with which they are not associated must be considered. The processing of the data in the register in perpetuity negatively affects the data subject’s right to self-determination. Unless the controller can present compelling grounds that override the data subject’s interest, the data must be erased. 3. Archiving in the public interest and historical research — The right to erasure does not apply when the processing is necessary for archiving purposes in the public interest, or historical research pursuant to Article 17(3)(d) GDPR. Archiving in the public interest presupposes that the record is accessible to the public or to public authorities. Therefore, if the record is only accessible to persons belonging to the entity in question, the archiving does not serve a public interest. The controller did not confirm that they conduct any historical research. In any case, in order to assess the necessity of processing for historical research, it must be inquired whether historical researchers must be aware of the exact identity of each individual listed in the register in order for the processing to be necessary for the purpose of historical research. 4. Concept of “erasure” — The annotation that the data subject has departed from the Church is not an erasure, but, at most, a rectification of the data, according to the Advocate General. Neither is striking through the personal data while leaving the words legible. The controller could, for example, cover the personal data of the data subject with opaque stickers in order to comply with the request to erasure. The data subject cannot request the erasure of all traces from their baptism from the register under Article 17 GDPR. The right to erasure only includes the removal of the personal data; information about the baptism of an individual that has taken place at a given place and at a given time can remain in the register. According to the Advocate General, the fact that the register is a unique material carrier and a unique record of historical facts does not call these considerations into question. 5. Conclusion — The Advocate General opined that the data subject has a right to have their data erased from the register unless the controller is able to present overriding grounds for the processing. A mere annotation or the striking through of the data that leaves the data legible cannot be considered erasure. The fact that the register is not digital, and that it is a unique material carrier and a unique record of historical facts does not affect the legal considerations. Holding — tbd ### UZ v Bundesrepublik Deutschland *Source: Court of Justice of the European Union, C-60/22, 2023-05-04 — https://overview.legal/posts/132289 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060* In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik Deutschland regarding the processing of personal data in an asylum application file. The Court held that an administrative authority transmitting an electronic asylum file to a competent national court via an electronic mailbox constitutes processing under the GDPR, and that where both the authority and the court determine the purposes and means of processing, they are joint controllers under Article 26, requiring an arrangement allocating responsibility and maintaining records of processing activities under Article 30. The Court further clarified that transmission of personal data without the data subject's consent constitutes unlawful processing, triggering the right to erasure under Article 17(1)(d) and the right to restriction under Article 18(1)(b), and that national courts must disregard such unlawfully processed data. No fine was imposed. ### TU and RE v Google LLC *Source: Court of Justice of the European Union, C-460/20, 2022-12-08 — https://overview.legal/posts/132301 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0460* In Case C-460/20, the Court of Justice (Grand Chamber) ruled on a preliminary reference from the Bundesgerichtshof (Germany) concerning two individuals' request that Google de-reference search results containing allegedly inaccurate articles about them and remove thumbnail images from image search results. The Court held that the right to erasure under Article 17(3)(a) GDPR does not extend to requiring a search engine operator to de-reference links to articles whose content the requester claims is inaccurate, as that exception addresses the balance between data protection and freedom of expression rather than data accuracy. The Court further ruled that the requester bears the burden of providing relevant evidence to substantiate the alleged inaccuracy of the information. ### OLG Köln - 15 W 55/26 *Source: Higher Regional Court Cologne, 2026-06-12 — https://overview.legal/posts/53657 — original: https://gdprhub.eu/index.php?title=OLG_Köln_-_15_W_55/26* Facts — The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future publication of, a notice stating that between six and ten reviews concerning his medical practice had been removed during the previous year following complaints relating to defamation under German law. The Regional Court of Cologne dismissed the application, following which the data subject lodged an immediate appeal before the Higher Regional Court of Cologne. The data subject argued that the notice was inaccurate because the reviews had been challenged on the basis that no genuine patient relationship existed, rather than on the ground of defamation. He submitted that the notice therefore created the false impression that he had complained of defamatory reviews, rendering the processing of his personal data unlawful. The Controller argued that complaints alleging the absence of a genuine customer or patient relationship fell within its internal category of complaints concerning defamation under German law and that publishing the number of removed reviews promoted transparency regarding its review moderation process. Holding — The court held that where a data subject seeks not only the erasure of personal data but also an injunction preventing its future publication, Article 17(1) GDPR provides a basis for both forms of relief. It further held that the journalistic exemption under Article 85(2) GDPR did not apply because the Controller's review platform, including the automated notices relating to removed reviews, did not process data for journalistic purposes. The court also held that the displayed number of removed reviews constituted personal data within the meaning of Article 4(1) GDPR because it related to an identified natural person. By storing and disclosing that information, the Controller processed personal data within the meaning of Article 4(2) GDPR. In assessing the accuracy of the notice under Article 5(1)(d) GDPR, the court considered how an average user would understand the information. It held that a prominently linked information page entitled "Defamation under German law" explained that the platform categorised not only false or reputation-damaging reviews, but also complaints alleging that the reviewer was not a genuine customer, as complaints concerning defamation. As the data subject did not dispute that he had successfully requested the removal of between six and ten reviews on the basis that the reviewers had not been genuine patients, the court concluded that users could readily understand the platform's use of the term and that the notice was factually accurate. The court also rejected the data subject's reliance on the Festzins Plus judgment (BGH, judgment of 21 September 2017 – I ZR 53/16), distinguishing that case because the corrective information there appeared only at the end of a lengthy and unclear text, whereas the notice in the present case contained a clearly highlighted hyperlink directing users to explanatory information specifically addressing the platform's categorisation of review removals. The court held that the Controller had legitimate interests in promoting transparency regarding its handling of review-removal requests and that publication of the notice was necessary for that purpose. These interests outweighed the data subject's rights because the notice related only to his professional activity, was presented in a factual manner, contained no criticism of his behavior and was not prominently displayed, appearing only after users selected the "Reviews" tab. Accordingly, the court concluded that the processing was lawful under Article 6(1)(f) GDPR and that the data subject was not entitled to erasure or an injunction preventing the future publication of the notice under Article 17(1) GDPR. ### VG Stuttgart orders deletion of SIS alert for refusal of entry under Art. 17 GDPR *Source: Administrative Court Stuttgart, 2026-07-14 — https://overview.legal/posts/184726 — original: https://gdprhub.eu/index.php?title=VG_Stuttgart_-_1_K_12737/25* Facts — A resident of North Macedonia (the data subject) was expelled from German territory in September 2021, and a two-year ban on entry and residence was imposed on him. The data subject subsequently re-entered German territory without a visa in December 2024 and travelled back to North Macedonia in July 2025. A federal police directorate (the controller) assumed that the data subject had violated the ban on entry and residence. The controller determined that the data subject posed a threat within the meaning of Article 24(2) of Regulation (EU) 2018/1861, ordered an alert for refusal of entry and stay, and entered it into the Schengen Information System (SIS) in August 2025. The data subject filed a lawsuit with the Stuttgart Administrative Court in October 2025, requesting that the controller be ordered to delete the alert and alternatively to correct it or to impose a time limit on it. Holding — The court held that the lawsuit was admissible and well-founded and ordered the controller to delete the alert for refusal of entry and stay from the SIS pursuant to Articles 53(1), 24(1) and (2) of Regulation (EU) 2018/1861 in conjunction with Article 17(1) GDPR. In the present case, the personal data of the data subject was inaccurate as the requirements for the alert were no longer fulfilled: the court held it could not be assumed that the data subject’s presence on German territory posed a threat to public order or security. In addition, the court referred to the principle of proportionality and pointed out that alerts may not be stored in the SIS for longer than necessary. The data subject had clearly changed his behaviour by marrying a German citizen and filing a visa application for family reunification since his expulsion from Germany. Therefore, the court held that the grounds for erasure laid down in Article 17(1)(a) and (d) GDPR were applicable. ### Agentsia po vpisvaniyata v OL *Source: Court of Justice of the European Union, C-200/23, 2024-10-04 — https://overview.legal/posts/132161 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0200* The Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Bulgarian Supreme Administrative Court in a dispute between the Agentsia po vpisvaniyata (Registration Agency) and OL concerning the Agency's refusal to erase personal data contained in a company's constitutive instrument published in the commercial register. The Court held that non-compulsory personal data included in company documents under Directive (EU) 2017/1132 does not qualify as processing necessary for compliance with a legal obligation under GDPR Article 6(1)(c), and where no other valid legal basis applies (such as consent under Article 6(1)(a)), the data subject is entitled to erasure under Article 17; furthermore, publication of such data without a valid legal basis may constitute non-material damage compensable under Article 82, though the existence and amount of any compensation depends on national court assessment of the actual harm suffered. No fine was imposed, as this was a preliminary ruling proceeding. ### Rijeka Court: AZOP decision on media reporting of former Zagrebački Holding board *Source: Administrative Court in Rijeka, 2025-11-11 — https://overview.legal/posts/49225 — original: https://gdprhub.eu/index.php?title=USR_-_Us_I-755/2025-8* Facts — The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023. A television broadcaster published several pieces, including a video on its YouTube channel, reporting on the data subject’s resignation. The publications mentioned his name, role, employer, salary, and information on the brand of his private car. The data subject filed a complaint with the Croatian Personal Data Protection Agency (AZOP), claiming that the publication constituted unlawful processing under the GDPR because the media lacked a valid legal basis under Article 6, the reporting was inaccurate and excessive, and it did not serve any genuine public interest. He latter further claimed during the lawsuit against AZOP's decision that the authority had incorrectly and incompletely established the facts, misapplied substantive law, and breached procedural rules. He emphasized that the published personal data was unrelated to transparency in public administration, that he was neither a public figure nor a political actor, and that any public interest ended once he left office on 31 March 2023. He invoked his right to erasure under Article 17 GDPR and sought removal of the content, annulment of AZOP’s decision, or alternatively, a remittal for a new procedure. AZOP contested the lawsuit in full, maintaining that it had acted in accordance with Article 34 of the Croatian GDPR Implementation Act and Article 77 GDPR. It argued that the publication fell within a justified public interest under Article 8 of the Croatian Media Act and that it had properly carried out a balancing test between privacy (Article 8 ECHR) and freedom of expression (Article 10 ECHR). According to AZOP, the reporting was necessary, proportionate, and not sensationalistic, and did not excessively intrude on the data subject’s privacy. It added that consent was not required because the processing relied on legitimate interest under Article 6(1)(f) GDPR. Holding — The Administrative Court dismissed the action and upheld AZOP’s decision. Because Zagrebački holding is a city-owned and publicly funded company, the court considered information about the data subject’s salary, compensation for using his private vehicle in official duties, and his managerial role to be directly connected to the use of public resources. This placed the publication within the legitimate public interest in transparency recognised by Article 8 of the Media Act. In its proportionality assessment, the court accepted AZOP's application of Article 5 and 6 GDPR, emphasizing that the published data did not touch upon the data subject’s family or intimate life but related solely to his public functions. Publication was therefore limited to what was necessary to inform the public about the management of a publicly owned company. The data subject’s claims that the publication was false or harmful to his reputation did not alter the outcome, as AZOP is not empowered to determine the truthfulness or tone of journalistic content, particularly under the journalistic exemption in Article 85 GDPR. Issues of accuracy or reputational harm must instead be pursued through media-law mechanisms such as requests for correction or civil actions. On the erasure request, the court held that the right to be forgotten under Article 17 GDPR cannot override freedom of expression and information where media reporting is involved. Although the data subject no longer served on the board, the publication continued to contribute to public understanding of how a major public entity was run during his tenure, thus the public interest persisted and erasure was not justified. Finally, the court reiterated that consent was not required because Article 6 GDPR offers alternative lawful bases for processing. Since Article 6(1)(f) was satisfied, the absence of consent was irrelevant. Concluding that AZOP had properly applied the law and that the interference with the data subject’s privacy was proportionate, the court upheld the decision and denied the data subject’s claim and costs. ### UF and AB v Land Hessen *Source: Court of Justice of the European Union, C-26/22, 2023-12-07 — https://overview.legal/posts/132278 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026* The Court of Justice of the European Union (First Chamber) ruled on preliminary references from the Verwaltungsgericht Wiesbaden in joined cases C-26/22 and C-64/22, concerning UF and AB's challenge to the Hessischer Beauftragter für Datenschutz und Informationsfreiheit's refusal to order SCHUFA Holding AG to delete data regarding the discharge of their remaining debts. The core issue was whether storage of such data by a credit information agency was lawful under GDPR Article 6(1)(f) and whether the supervisory authority's dismissal of the complaints satisfied Article 78's right to an effective judicial remedy. The Court held that the legitimate interests of credit agencies in assessing creditworthiness may justify retention of remaining-debt-discharge data, but the three-year storage period presumptively lawful under German law must be assessed against GDPR necessity and proportionality requirements, and that national courts must conduct full judicial review of supervisory authority decisions rather than limited deferential review. No fine was imposed. ### GC and Others v CNIL *Source: CJEU, C-136/17, 2019-09-24 — https://overview.legal/posts/51475 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136* Conditions for delisting sensitive data from search results. ## Guidance ### Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) *Source: EDPB, edpb-guidelines-on-the-criteria-of-the-right-to-be-forgotten-in-the-search-engines-cases-under-th, 2020-07-07 — https://overview.legal/posts/38070 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en* The European Data Protection Board (EDPB) issued these guidelines to clarify the criteria and grounds for exercising the right to erasure (right to be forgotten) specifically in the context of search engine cases under the GDPR. The document details the six grounds under Article 17(1) that allow data subjects to request delisting, alongside the relevant exceptions, such as the right to freedom of expression and information. As a guidance instrument, it does not impose administrative fines but instead aims to harmonize how search engine providers handle and balance delisting requests across the EU. ### Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject *Source: EDPB, opinion-392021-on-whether-article-582g-gdpr-could-serve-as-a-en, 2021-12-14 — https://overview.legal/posts/125971 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-392021-on-whether-article-582g-gdpr-could-serve-as-a_en* Adopted 1 Opinion 39 /2021 on whether Article 58(2) ( g) GDPR coul d serve as a legal basis for a s upervisory a uthority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject Adopted on 14 December 2021 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63 and Article 64 (2) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural… ### Coordinated Enforcement Action, *Source: EDPB, coordinated-enforcement-action-implementation-right-erasure-en, 2026-03-02 — https://overview.legal/posts/53740 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/other/coordinated-enforcement-action-implementation-right-erasure_en* EDPB, Coordinated Enforcement Action, implementation of the right to erasure by controllers ### Guidelines 01/2022 on data subject rights - Right of access *Source: EDPB, edpb-guidelines-on-data-subject-rights---right-of-access, 2023-04-17 — https://overview.legal/posts/38055 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en* The right of access of data subjects is enshrined in Art. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR. ### One-Stop-Shop case digest on right of access *Source: EDPB, oss-case-digest-right-of-access-en, 2025-01-16 — https://overview.legal/posts/50410 — original: https://www.edpb.europa.eu/documents/support-pool-of-experts/one-stop-shop-case-digest-on-right-of-access_en* EDPB/SPE 16 jan 2025 One-Stop-Shop case digest on right of access. Een rapport opgesteld door Hanne Marie Motzfeldt (Københavns Universitet) waarin beslissingen inzake het inzagerecht onder het eenloketmechanisme worden geanalyseerd. ### Guidelines 10/2020 on restrictions under Article 23 GDPR *Source: EDPB, edpb-guidelines-on-restrictions-under-article-23-gdpr, 2021-10-13 — https://overview.legal/posts/38062 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en* The European Data Protection Board (EDPB) issued these guidelines to clarify the scope and application of Article 23 of the GDPR, which allows Member States to restrict certain data subject rights and controller obligations. The guidelines outline the necessary conditions and safeguards, emphasizing that any restrictions must respect the essence of fundamental rights and be implemented via foreseeable, proportionate legislative measures. This document serves as authoritative guidance for interpreting the specific grounds and requirements under which Member States may legally impose such limitations. ### EDPB Annual Report 2019 *Source: EDPB, edpb-annual-report-2019-en, 2020-05-18 — https://overview.legal/posts/126163 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-annual-report-2019_en* EDPB Annual Report 2019 1 EDPB Annual Report 2019 1 European Data Protection Board 2019 Annual Report WORKING TOGETHER FOR STRONGER RIGHTS An Executive Summary of this report, which provides an overview of key EDPB activities in 2019, is also available. Further details about the EDPB can be found on our website at edpb.europa.eu. EDPB Annual Report 2019 EDPB Annual Report 2019 2 3 FOREWORD 1 4 MISSION STATEMENT, TASKS AND PRINCIPLES 2 5 Tasks and duties Guiding principles 5 6 2.1. 2.2 . ABOUT… ### Guidelines 05/2020 on consent under Regulation 2016/679 *Source: EDPB, edpb-guidelines-on-consent, 2020-05-04 — https://overview.legal/posts/38053 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en* The European Data Protection Board (EDPB) adopted Guidelines 05/2020 on consent under Regulation 2016/679 to provide detailed interpretive guidance on the requirements for valid consent under the GDPR, including the elements of freely given, specific, informed, and unambiguous consent, as well as the conditions for explicit consent and the obligation to demonstrate consent. The guidelines address practical issues such as power imbalances, conditionality, granularity, detriment, and the minimum content requirements for informing data subjects. No fines are imposed, as this is a guidance document rather than an enforcement decision. ## Enforcement decisions ### HDPA (Greece) - 54/2024 *Source: HDPA (Greece), 2023-06-29 — https://overview.legal/posts/125608 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_54/2024* Facts — In 2020, the data subject filed a complaint with the DPA against Google LLC (the controller) for failing to fulfill their right to erasure (Article 17 GDPR) concerning links - referring to criminal charges - appearing in search results based on their name. The data subject argued that these results contained outdated information about a closed criminal case involving them. The controller partially complied with the request but retained one link. The data subject then identified additional publications that required deletion. However, the controller failed to act within the 30-day deadline stipulated by Article 12(3) GDPR. Instead, it responded with an automated message, attributing the delay to the Covid-19 pandemic and claiming that the erasure request was incomplete because it lacked the court judgment clearing the data subject of charges. Before the DPA, the data subject argued that the pandemic is not a valid justification for delays and that the erasure request form does not allow attachments, preventing them from submitting supporting documents. The controller stated that it provides multiple channels for data subjects to request data erasure, including direct email contact with its DPO and the retained link in question referred to a comment, which allegedly did not meet the criteria for erasure or contain any information directly linking it to the data subject. Holding — The DPA found Google LLC to be the controller as it is responsible for the deletion process not Google Hellas/Athens. The DPA found, that contrary to the controller's statement the remaining link could be associated with the data subject’s identity and past criminal cases. Thus, the DPA held, that the erasure request must be fulfilled unless the controller demonstrates compelling and lawful reasons for continuing processing (Article 21(1) GDPR), which the DPA found lacking. The DPA held that the lack of an attachment option hinders the effective exercise of data subjects' rights, as they are forced to seek alternative communication methods. Thus, the controller fails to facilitate the erasure request process. Additionally the court found, that the controller did not comply with Article 12(3) GDPR, as a general, automated response does not meet it’s requirements and the contact link for the controller’s DPO did not include any contact details, making direct communication impossible in breach of Article 37(7) GDPR. Based on these findings, the DPA ordered the controller to: Provide an attachment option in the erasure request submission form. Stop sending automated responses to submitted requests. Publish the contact details of its DPO. Delete the remaining link, as requested by the data subject. ### HDPA (Greece) - 33/2020 *Source: HDPA (Greece), 2026-07-24 — https://overview.legal/posts/158444 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_33/2020* Facts — The data subject was under the employment of the College for a certain period of time, during which two female students of the College filed a complaint against the complainant regarding the latter's posts on social media that violated the College's Code of Conduct due to their homophobic and racist content. After this event, the College decided to move the complainant to a different position, while reacting to this situation the complainant argued that he had suffered a defamation by the College and requested the altering of the situation. The College asked the complainant to appear to the new position, something the complainant never did, but, nevertheless, the College continued paying the complainant's salary up to the ending point of their contract. Then, the data subject/complainant filed a request to the American College of Greece, asking for access to and copies of their personal data the latter is keeping in its records given the employment relationship between the two, while they specifically requested access to the two complaints made by the two students. With the same request, the data subject asked for the erasure of their personal data from the College's records, since the reason for which the data had been collected and were being kept was no longer valid, since the employment relationship between the complainant and the College had expired. In addition, with the same request, the complainant revoked their - possibly given silently - consent for the keeping and processing of their personal data by the College. The complainant claimed that there was no response from the College to their request. The HDPA requested the College's response to the situation. The latter claimed that the request under question only came into its attention via the HDPA's request for response to the claims. It justified this situation by mentioning that the employee who received the request was not in a good state of health, while the period when the request was filed was a period of heavy workload at the College. The College further underlined that, as soon as the request came to its attention, it contacted the complainant and: i) fulfilled their right to access their data by informing them for all data currently kept by the College and for providing information on how to get copies of all personal data, but not for the data referring to the personal information of one female student of the College who had filed a complaint against the data subject/complainant regarding the latter's behaviour, since the student expressed her not willingness for her name and complained to be known. The College also sent a question to the HDPA regarding the existence or not of their legal responsibility to provide access to the details of the complaint made by the student who expressed her not willingness to be known, as well as regarding the conditions under which such an access should be provided. This question, as the HDPA found, was never answered. ii) informed the complainant that the right to erasure could only be partly fulfilled, since some of the personal data being kept by the College must continue being kept due to the existence of the legal necessity for their existence, in order for the College to be able to fulfil some of its legal responsibilities, according to the provisions of Article 17(3)f GDPR, 250-253 Civil Law Code, and 95 Law 4387/2016. Moreover, the College claimed that it had the right to deny the fulfilment of the complainant's right to access and erasure, according to article 12(5)b GDPR, since the respective request has been made in a manifestly unfounded or excessive and repetitive manner. Answering to the College's claims, the complainant argued that the College is not fulfilling their rights to access and erasure, as well as that the College is not properly justifying the excessive or unfounded manner of the complainant's requests based on the said GDPR article. Additionally, the complainant argued that their right to access had never been fulfilled as their relevant request to the College was only answered by the latter with the explanation that the College had sent a question to the HDPA regarding the legality of fulfilling such a request, but with no information being provided later on by the College. Thus, the complainant underlined that, under Article 55 of Law 4629/2019, the College had the legal responsibility, as a data processor, to inform the data subject for all the data being kept and processed and to fulfil the data subject's right to access before fulfilling their right to erasure. Dispute — Whether the American College of Greece violated the complainant's right to access and erasure of their personal data? Holding — The HDPA confirmed its jurisdiction to rule on the complaint regarding a possible violation of the rights to access to and erasure of personal data, according to Articles 51,55,57,58 GDPR and Articles 9,13,15 of Law 4624/2019. On the contrary, it underlined its lack of jurisdiction to rule on the dispute of the complainant and the American College of Greece as regards the conditions of the employment relationship between them. The HDPA, after presenting the principles of data processing of Article 5(1) GDPR, underlined that, based on Article 5(2) GDPR, it is the data processor's responsibility to conform and to be able to prove their conformity with these principles at all times and by themselves (principle of accountability). Additionally, the HDPA stated that, in accordance with Article 8(1) of the Charter of Fundamental Rights of the EU, Article 9A of the Greek Constitution, and the Recital 4 of GDPR, the right to protection of personal data is not an absolute right, but a right that should be perceived always in connection to its function within society and a right that should be weighted in connection to other fundamental rights, always according to the principle of proportionality. Furthermore, the HDPA referred to Articles 12 and 15 GDPR regarding the right to access personal data, while it also underlined the restrictions to this right that Articles 23 GDPR and 33 Law 4624/2019 provide. More specifically, Article 33 mentions that the right to access cannot be fulfilled when: "1) [...] b) the data i) were recorded just because they could not have been erased due to legal provisions for the necessity of their keeping or ii) exclusively serve purposes of protection or control of data, and the provision of information would require a disproportional effort and the necessary technical and organisational measures render the processing of the data impossible for other purposes. 2) The reasons for the denial of provision of information to the data subject should be justified. The denial must be justified to the data subject, unless the provision of the real and legal reasons on which the denial is based would put the purpose of the denial into danger. [...] 4) The right to information on their data according to Article 15 GDPR does not apply, to the degree that through the provision of information other information, that according to a legal provision or to their nature, especially due to a third party's interest, must remain confidential, would be revealed. " Adding to this, the HDPA noted its past Decision 73/2010, where it judged that "the information of who is complaining against the accused constitutes an information that refers to the latter and is included in the right to access [...] . More specifically, the right to know the source of the data means that the data processor must inform the data subject of the source of the data (HDPA Decisions 4/2005, 39/2005). The HDPA has ruled that the "source" can also be a third party (natural person) (HDPA Decisions 4/2003 & 43/2003, where it is underlined that the accused has the right to access the text of the complaint and to know - when the complaint is eponymous - the name of the complainant, without the matter of whether the complainant is a third party or not being examined). After all, the knowledge of the source of the data is necessary for the data subject to be able to exercise their further rights [...]. Therefore, the HDPA underlined that the name of the female student in included in the content of the term personal data for which the data subject has the right to access, according to Article 15(1)g GDPR. Thus, the HDPA held that the College as a data controller, according to Article 4(7) GDPR, fulfilled the right to access of the complainant via the provision of copies of the data being kept. But, as concerns the non provision of the information for the complaint made by the second female student, the College violated Article 15 GDPR regarding the right to access, since it connected the provision of access to those with the consent of the female student, without examining Article 15 GDPR or Article 33 Law 2462/2019. In addition, from the merits of the case, there is no evidence for the existence of any danger faced by the female student nor is there any claim by the College or the female student for such a danger, given as well that the College did not pursue a disciplinary process against the complainant, while it also continued their salary payments even though the complainant denied to work in the new position where they were transferred. {Here there was a separate opinion of one member of the HDPA, highlighting that the text of the female student's complaint should have been provided to the complainant but with the covering of all relevant data pointing to the female student's identity.}. Additionally, the College's claim for the sickness of their employee and the work overload have no effect over the responsibility of the College to respond to the complainant's request, while there is also no effect on this responsibility from the fact that the HDPA did not answer to the College's request for its Opinion, since the HDPA did not have jurisdiction to impose to the data processor the provision to a third person of data nor had a complained been filed to the HDPA by th data subject (the female student) so as to open up the HDPA's jurisdiction (Article 5 Law 2472/1997, HDPA Opinions 4/2009, 6/2013, HDPA Decision 8/2019). Furthermore, the HDPA held that the complainant's claim that the College did not prove the unfounded or excessive character of their request is of no meaning, since the College responded to their request, even though with delay. The HDPA also held that the complainant's claim for the implementation of Article 55(5) Law 4624/2019 is unfounded, as its provisions cannot be implemented in this case. Lastly, the HDPA referred to Article 17 GDPR on the right to erasure and the restrictions of this non-absolute right provided in par.3 of the said Article and in Article 34 Law 4624/2019. Thus, the HDPA underlined that in the case under question the College as a data processor fulfilled the complainant's right to erasure. The HDPA held that there is, in this case, a legal case of exception from the right to erasure concerning the data referring to the complainant's employment relationship with the College that the latter is required to be keeping based on Article 17(3)b & e GDPR. Additionally, the HDPA held that the College has the legal right to keep the data referring to the two complaints made by the students according to Articles 17(3)e GDPR and 34(1) Law 4624/2019. Therefore, the HDPA held that the College partly fulfilled the data subject's right to access, since it did not provide information on the second female student's complaint, including her name, in violation of Articles 5,15 GDPR, 33 Law 4624/2019. Thus, the HDPA, making use of its corrective powers of Article 58(2)c GDPR, ordered the College to provide the complainant with the relevant information. Additionally, the HDPA held that the College fulfilled the right to access but in violation of the deadlines for such a fulfilment provided by Article 12(3) & (4) GDPR. For this reason, an administrative fine of 1000 EUR was imposed (83(5)b GDPR). Lastly, the HDPA held that the College fulfilled the complainant's right to erasure but in violation of the deadlines provided for such a fulfilment by Article 12(3) & (4) GDPR. For this reason, an administrative fine of 1000 EUR was imposed (Article 83(5)b GDPR). ### CNIL fines EXTIA for failing to properly handle job applicant erasure requests *Source: CNIL (France), 2026-07-21 — https://overview.legal/posts/354296 — original: https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2026-010* Facts — EXTIA, the controller, is a French consulting company specialising in IT and engineering services. As part of its recruitment activities, the controller processed personal data of job applicants and employees. Following complaints received in 2024 concerning difficulties in exercising the rights of access and erasure, the French Data Protection Authority (CNIL) sent the controller two formal notices reminding it of its obligations under the GDPR. As the controller failed to provide satisfactory responses, further complaints were lodged with the DPA. On 10 April 2025, the DPA conducted an on-site inspection of the controller's premises. The investigation revealed that the controller had received 265 erasure requests in 2024, mainly from unsuccessful job applicants, but had failed to properly handle a significant proportion of them. In particular, the investigation identified requests that had not been processed, requests for which data subjects had not been informed of the outcome, and requests to which the controller had responded after the applicable deadline. The controller argued that many of the requests concerned unsuccessful applicants whose personal data had already been automatically deleted 60 days after their applications were received. It also attributed the shortcomings to the temporary disorganisation of its legal department and a substantial increase in erasure requests. The DPA initiated sanction proceedings against the controller for alleged infringements of Articles 12, 13 and 17 GDPR. During the proceedings, the controller submitted additional evidence of the deletion of personal data and the measures taken to inform the affected data subjects. Holding — The DPA found that the controller infringed Articles 12 and 17 GDPR by failing to properly handle erasure requests and inform data subjects of the outcome of their requests. First, the DPA established that the controller had failed to process 12 erasure requests in violation of Articles 12 and 17 GDPR. Although the controller argued that many applicants' personal data had already been automatically deleted after 60 days, the DPA found that this did not exempt it from its obligations regarding the exercise of data subject rights. Second, the DPA found an infringement of Article 12 GDPR because 166 data subjects had not been informed of the outcome of their erasure requests. The DPA recalled that controllers must inform data subjects of the measures taken in response to their requests, regardless of whether their personal data has already been erased or can lawfully be retained. Third, the DPA found a further infringement of Article 12 GDPR because the controller had responded late to 26 erasure requests and one access request. The DPA emphasised that controllers must respond within one month unless a justified extension is communicated to the data subject within that period. In total, 204 erasure requests received in 2024 had not been properly handled, representing more than three-quarters of the requests received that year. The alleged infringement of Article 13 GDPR concerning information provided to employees was withdrawn and was not established. The DPA imposed a €300,000 administrative fine, taking into account the number of affected data subjects, the controller's negligence and its failure to comply with its obligations despite two previous formal notices. Although the controller had subsequently implemented corrective measures, these did not remove its responsibility for the infringements. The DPA decided not to issue an injunction, as the controller had demonstrated that it had addressed the infringements. It also ordered the publication of the decision, which will be anonymised after two years. ### DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR *Source: DSB (Austria), 2023-06-12 — https://overview.legal/posts/109003 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.4462* Facts — On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure request. On 17 July 2021, the data subject filed a complaint with the Austrian DPA (DSB) regarding the violation of their right to erasure under Article 17 GDPR. Over the course of the complaint proceedings, the controller refused the requested deletion. Holding — The DPA held that the European Union interprets the concept of data 'processing operations of courts acting in their judicial capacity', as defined in Article 55(3) GDPR, more broadly than under Austrian law. Referring to the decision of the CJEU in 'Autoriteit Persoonsgegevens' (C-245/20) EU:C:2022:216, the supervision of processing operations carried out by courts 'acting in their judicial capacity' could directly or indirectly affect judicial independence or influence their decisions. As judicial activities must be exercised autonomously and free from any external influence, they are therefore excluded from that authority's competence. Individuals must have no reasonable doubt about the independence and impartiality of the justice system. As judges may have access to the information provided by the Austrian Justice System, processing that data may influence their performance of judicial tasks and the decision-making process. Therefore, the DPA dismissed the complaint, as it has no supervisory competence over the data processing operations of courts 'acting in their judicial capacity' pursuant to Article 55(3) GDPR. ### Kutxabank, S.A.: Insufficient fulfilment of data subjects rights *Source: Spanish Data Protection Authority (aepd), 2021-04-08 — https://overview.legal/posts/46745 — original: https://www.enforcementtracker.com/ETid-630* The Spanish DPA (AEPD) has imposed a fine of EUR 100,000 on Kutxabank, S.A.. Following a complaint from a former customer, claiming that the bank did not comply with his request to erasure of his data, the DPA started an investigation against the controller. The data subject had already been a customer of the bank in the past. At that time, he had exercised his right to erasure of his data. When he tried to open a new account with the controller, he was informed that this was not possible as his ### Corint Logistic SRL.: Insufficient fulfilment of data subjects rights *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2024-05-30 — https://overview.legal/posts/48463 — original: https://www.enforcementtracker.com/ETid-2348* The Romanian DPA has imposed a fine of EUR 2,000 on Corint Logistic SRL. A customer had filed a complaint with the DPA because they had received advertising text messages from the controller, even though they had exercised their right to erasure and received confirmation that their personal data had been deleted. ### Anmavas 61, S.L.: Insufficient cooperation with supervisory authority *Source: Spanish Data Protection Authority (aepd), 2020-11-18 — https://overview.legal/posts/46567 — original: https://www.enforcementtracker.com/ETid-452* The Spanish DPA (AEPD) imposed a fine on Anmavas 61, S.L. for neither granting nor justifiably denying the right to erasure to the data subject, even after receiving a warning issued by the AEPD. ### DSB: online article about former politician is journalistic processing under Art. 85 GDPR *Source: DSB (Austria), 2020-09-01 — https://overview.legal/posts/158430 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2020-0.303.727* Facts — In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her. After the respondent’s refusal to do so, the complainant lodged a complaint with the DSB. The respondent argued that publishing the article on its website qualified as processing carried out for journalistic purposes under Article 85 GDPR and § 9(1) of the Austrian Data Protection Act (Datenschutzgesetz - DSG). Due to the derogations in § 9(1) DSG, the DSB would hence not be competent to handle the complaint. Dispute — Is the DSB competent to handle the complaint or is the processing on the respondent's website subject to Article 85 GDPR and § 9(1) of the Austrian Data Protection Act? Did the respondent violate the complaint's right to erasure under Article 17 GDPR? Holding — The DSB held, that the respondent qualifies as a media company under § 1(1)(6) of the Austrian Media Act, because it is a company which creates the content of the medium and handles the production, distribution, broadcasting and retrievability of the medium. It further held, that the data processing (publishing the complainant's personal data in an online article) was carried out for journalistic purposes . As the complainant is an former politician and the article revolved around legal procedures that she is involved in there was a public interest in mentioning the complainant's name. Under Article 9(1) DSG, Chapter III and Chapter VI of the GDPR do not apply on data processing carried out by media companies for journalistic purposes. Such GDPR violations must be tried before civil courts. Hence, the DSB considered itself not competent, rejected the complaint and did not investigate the alleged violation of Article 17 GDPR. ## Recent developments ### EDPB identifies challenges hindering the full implementation of the right to erasure *Source: European Data Protection Board, 2026-02-18 — https://overview.legal/posts/52724 — original: https://www.edpb.europa.eu/news/news/2026/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en* Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR). The Board selected this topic as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand ho ### Respondent has no right to erasure of personal data *Source: IT en Recht, 2023-03-01 — https://overview.legal/posts/6236 — original: https://www.itenrecht.nl/artikelen/geintimeerde-heeft-geen-recht-op-wissing-van-persoonsgegevens#entry-3985* Hague Court of Appeal February 3, 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the respondent) In this case, a man requested the deletion of his personal data processed by Veilig Thuis. The court ruled that Veilig Thuis's processing of the man's data was lawful under the Social Support Act (Wmo) and that the request for data deletion was therefore denied. Safe Home is not obliged to erase the man's personal data in order to comply with the legal obligation under Article 17(1)(e) AVG, b ### "Exploring the Right to be Forgotten: Understanding Article 17 and 21 of the GDPR and Article 35 of its Implementation Law on Requesting Removal of Search Results on Google Search" *Source: Dutch Courts, 2023-02-23 — https://overview.legal/posts/6240 — original: https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBLIM:2022:6330&pk_campaign=rss&pk_medium=rss&pk_keyword=uitspraken#entry-3929* Personal data protection. Request for removal of search results from the Google Search search engine: the right to be forgotten. Articles 17 and 21 General Data Protection Regulation (AVG) and Article 35 AVG Implementation Act. ### "The Right to Erasure: a Legal Analysis of Deleting Personal Information from Veilig Thuis' Records" *Source: Dutch Courts, 2023-02-28 — https://overview.legal/posts/6237 — original: https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHDHA:2023:306&pk_campaign=rss&pk_medium=rss&pk_keyword=uitspraken#entry-3967* Request for destruction of Safe Home files; admissibility; right to erasure of personal data under the AVG and Wmo ### One-Stop-Shop case digest on right to object and right to erasure updated *Source: European Data Protection Board, 2026-06-25 — https://overview.legal/posts/53055 — original: https://www.edpb.europa.eu/news/one-stop-shop-case-digest-on-right-to-object-and-right-to-erasure-updated_en* Brussels, 25 June - The EDPB has published an update of the One-Stop-Shop (OSS) case digest on right to object and right to erasure. This project has been developed in the framework of the of the Support Pool of Experts programme, which aims to support cooperation among Data Protection Authorities (DPAs).Thematic one-stop-shop case digests are drafted on the basis of one-stop-shop decisions taken from the EDPB’s public register (based on Art.60 GDPR). Such case digests complement the EDPB's publ ## Literature ### Forgetful AI: AI and the Right to Erasure under the GDPR *Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132542 — original: https://doi.org/10.21552/edpl/2020/3/8* Artificial Intelligence and, specifically, Machine Learning, depends on data for its development and continuous evolution. Frequently, the information used to train Machine Learning algorithms is personal data and, thereby, subject to the rules contained within the GDPR. If the necessary requirements are fulfilled, Article 17 of the GDPR grants to the data subject the right to request from the controller the erasure of personal data concerning him/her. In this paper we will study the impact of the right to erasure under the GDPR in the development of Artificial Intelligence in the European Union. We will assess whether datasets, mathematical models and the results of applying such models to new data need to be erased, pursuant to a valid request from the data subject. We will also analyse the challenges created by this erasure, how they can be minimized and the most adequate legal interpretations to ensure seamless AI development that is also compatible with the principles of privacy and data protection currently in force within the European Union. Keywords: Artificial Intelligence, GDPR, Right to Erasure ### IMPACT OF GDPR ON UKRAINIAN PERSONAL DATA PROTECTION LEGISLATION *Source: Pravo ta nauki, 2018-12-30 — https://overview.legal/posts/132472 — original: https://doi.org/10.66556/2522-4549.1519.koshovyi-b* The article examines the impact of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR), which entered into force on 25 May 2018, on Ukrainian personal data protection legislation. The main novelties of GDPR are analyzed, including the principle of accountability, the right to erasure (right to be ### The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how *Source: Przegląd Prawniczy Uniwersytetu im. Adam Mickiewicza, 2023-12-30 — https://overview.legal/posts/132546 — original: https://doi.org/10.14746/ppuam.2023.15.09* The data subject’s right to access information on data processing has a very broad meaning. Considering the latest developments in this field (mainly the CJEU ruling on Austrian posts and EDPB guidelines) one can draw the conclusion that the controller’s right to protect its confidential in-formation is limited and less valuable than the data subject’s rights. However, this may lead to unfair and unequal treatment of companies and data subjects. When looking at this right in a more systematic pe ### HOW GDPR TREATS AUTOMATED DECISION-MAKING *Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435* This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin ### GDPR: A new challenge for personal data protection *Source: Bankarstvo, 2017-01-01 — https://overview.legal/posts/132473 — original: https://doi.org/10.5937/bankarstvo1704166m* stručni članak Erne Mraznica Raiffeisen banka ad Beograd erne.mraznica@raiffeisenbank.rs GDPR - NOVI IZAZOV ZAŠTITE PODATAKA O LIČNOSTI Rezime Dana 4. maja 2016. godine objavljena je Opšta Uredba o zaštiti podataka o ličnosti u Sl. glasniku EU, koja će se primenjivati od 25. maja 2018. godine. Cilj propisa je harmonizacija zaštite podataka o ličnosti na nivou EU, veći stepen kontrole za lica čiji se podaci obrađuju i unapređeno upravljanje savremenim rizicima iz ove oblasti. Banke, po prirodi svog poslovanja, spadaju među najveće rukovaoce podataka o ličnosti i u postupku usklađivanja sa obavezama utvrđenih Uredbom biće u prilici da izvrše punu analizu svog postojećeg regulatornog i infrastrukturnog okvira zaštite podataka o ličnosti. Istovremeno, pruža im se prilika da isprave eventualne nedostatke u postojećim procesima, odnosno da značajno povećaju svest organizacije o standardima zaštite podataka o ličnosti, posebno imajući u vidu zaprećene stroge sankcije za slučaj neusklađenosti. Ključne reči : GDPR, podatak o ličnosti, osnovni principi, prava lica, rukovalac, obrada podataka, transfer podataka, sankcije, usklađivanje JEL : F52, G14 doi: 10.5937/bankarstvo1704166M 166 Bankars ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes --- Generated by overview.legal · https://overview.legal/topics/right-to-be-forgotten · 2026-10-13