Right to be Forgotten

Legal Framework

The right to be forgotten is codified in Article 17 GDPR, which grants data subjects the right to obtain erasure of their personal data under six enumerated grounds. The controller must act "without undue delay" once any ground applies — whether the data are no longer necessary, consent is withdrawn, the data subject objects under Article 21, the processing was unlawful, a legal obligation requires erasure, or the data were collected in connection with information society services offered to a child.

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:"
— GDPR Art. 17(1)

Where the controller has made personal data public and is obliged to erase it, Article 17(2) extends the obligation to take reasonable steps — including technical measures — to inform other controllers processing links to or copies of that data. Article 19 GDPR separately requires the controller to notify each recipient to whom the data were disclosed:

"The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort."
— GDPR Art. 19

Article 15(1)(e) ties these rights together by requiring controllers to inform data subjects of the existence of the right to request erasure when responding to access requests.

Key Developments

The CJEU has repeatedly confirmed the structure of Article 17 in cases including GC and Others v CNIL, Österreichische Datenschutzbehörde v CRIF, and X v Russmedia Digital SRL, though the precise contours of when erasure must override other interests remain actively tested. Enforcement authorities have not hesitated to act where controllers obstruct erasure requests. In the Spanish DPA's action against Kutxabank, the authority investigated a bank that effectively blocked a former customer from opening a new account because of a prior erasure request, requiring the data subject to "unblock" data to proceed. In the Google LLC case, the AEPD found that automatic transmission of data subjects' information to the Lumen project — without any opportunity to object — undermined the right to erasure, and the DPA specifically found that Google "did not sufficiently enable data subjects to exercise their right to erasure of their data."

"the DPA also found that Google did not sufficiently enable data subjects to exercise their right to erasure of their data."
— Spanish DPA (AEPD), Google LLC §2

Status of the Debate

This topic is contested in court. While the CJEU has consistently reaffirmed the textual structure of Article 17, the boundaries — particularly the balance between erasure and competing interests such as freedom of expression, archiving in the public interest, and the extraterritorial reach of delisting obligations — remain actively litigated. The EDPB's Guidelines 5/2019 on the search engines cases and Opinion 39/2021 on whether supervisory authorities may order erasure ex officio illustrate that even the question of whether erasure requires a data-subject request is not fully settled:

A definitive CJEU ruling on the ex officio erasure question would resolve the open debate on whether Article 58(2)(g) can independently ground an erasure order.

Practical Guidance

• Map each processing activity to a retention trigger: For every dataset, identify which of the six Article 17(1) grounds could activate erasure and build automated retention schedules that execute deletion when the trigger fires (e.g., consent withdrawal, purpose exhaustion).
• Build downstream notification workflows: Article 19 requires communicating erasure to all recipients of the data. Maintain a current register of disclosures so that notification can be executed without disproportionate effort.
• Do not condition erasure on counter-obligations: The Kutxabank enforcement demonstrates that blocking a data subject's future interactions because of a prior erasure request attracts regulatory action. Erasure must be clean and unconditional.
• Assess public-data takedown obligations under Article 17(2): Where personal data has been published, document the reasonable technical steps taken to inform downstream controllers of links or copies — and record the cost-benefit analysis that informed those steps.
• Ensure objection mechanisms are functional at all times: The Google enforcement shows that coupling data transfers to mandatory conditions without an opt-out path undermines both the legal basis and the erasure right simultaneously.