Right to Erasure

Legal Framework

Article 17 GDPR establishes the right to erasure, commonly known as the right to be forgotten. Under Article 17(1), data subjects may obtain erasure of personal data where one of six grounds applies: the data is no longer necessary for the original purpose; the lawful basis was consent and that consent is withdrawn; the data subject objects to processing under Article 21(1) and there are no overriding legitimate grounds; the data subject objects to direct marketing under Article 21(2); the data was unlawfully processed; or erasure is required to comply with a legal obligation under EU or Member State law. A controller receiving a valid erasure request must erase the personal data without undue delay, and in any event within one month of receipt of the request, extendable by two months where necessary under Article 12(3).

Article 17(2) imposes an obligation on controllers who have made the data public to take reasonable steps to inform other controllers processing the data that the data subject has requested erasure. Article 17(3) sets out exemptions where erasure is not required, including processing necessary for freedom of expression, legal compliance, public interest archiving, scientific or statistical research, and the establishment or defense of legal claims.

Article 19 GDPR supplements this by requiring controllers to notify each recipient to whom personal data were disclosed of any erasure carried out under Article 17(1), unless this proves impossible or involves disproportionate effort. Upon request, the controller must inform the data subject about those recipients.

Key Developments

The scope of erasure is not unlimited. Doctrinal commentary establishes that the right does not extend to correcting or removing impressions, opinions, research results, or conclusions with which the data subject disagrees. The accuracy of such content must be challenged through appropriate procedural channels rather than through an erasure demand. A data subject's disagreement with portions of a report does not, by itself, constitute grounds for erasure.

The Gerechtshof Arnhem-Leeuwarden (case 200.256.426) addressed the balancing of interests between intellectual property rights and data protection rights, weighing Article 17 of the EU Charter of Fundamental Rights against property protections. The court's approach confirms that erasure claims require a contextual balancing exercise rather than automatic application.

The Digital Rights Ireland ruling established that legally mandated metadata retention constitutes a justified interference only when directed at fighting serious crime, based on objective criteria, and subject to clear substantive and procedural conditions. This frames the outer limits of lawful retention that resists erasure demands.

The EDPB's Guidelines 5/2019 clarify the criteria and grounds for exercising the right to be forgotten specifically in search engine cases, providing a structured framework for evaluating delisting requests. Recent developments include the EDPB's CEF implementation report on the right to be forgotten (February 2026) and an updated One-Stop-Shop case digest on the right to object and right to erasure (June 2026), reflecting continued enforcement attention.

Practical Guidance

• Establish a structured intake and verification process for erasure requests that identifies the applicable ground under Article 17(1)(a)-(f) and assesses whether any exemption under Article 17(3) applies before acting.
• Maintain a data mapping system that tracks all recipients of personal data, enabling compliance with the Article 19 notification obligation when erasure is carried out.
• Train staff to distinguish erasure grounds from disagreement claims — a data subject's objection to opinions or conclusions in a report does not automatically trigger an erasure obligation; assess whether the request genuinely falls within Article 17(1).
• Document the balancing exercise when erasure requests conflict with other rights or legitimate interests, particularly freedom of expression, legal claims, or research purposes, as courts expect a contextual, reasoned assessment.
• Apply the one-month response deadline under Article 12(3), with documented extensions where complexity justifies a two-month extension, and provide the data subject with reasons for any delay.