The right to erasure (Articles 17 & 19 of the GDPR)

This is also known as the ‘right to be forgotten’.

You have the right to have your data erased, without undue delay, by the data controller, if one of the following grounds applies:

1. Where your personal data are no longer necessary in relation to the purpose for which it was collected or processed.
2. Where you withdraw your consent to the processing and there is no other lawful basis for processing the data.
3. Where you object to the processing and there is no overriding legitimate grounds for continuing the processing (see point 6 below).
4. Where you object to the processing and your personal data are being processed for direct marketing purposes (see point 6 below).
5. Where your personal data have been unlawfully processed.
6. Where your personal data have to be erased in order to comply with a legal obligation.
7. Where your personal data have been collected in relation to the offer of information society services (e.g. social media) to a child.

What happens when the data controller made your personal data public and is obliged to erase the data?

Where the data controller has made your personal data public and, on the basis of one of the above grounds, is obliged to erase the data:

• The data controller must communicate any rectification or erasure of your personal data to each recipient to whom the personal data have been disclosed, unless this is impossible or involves disproportionate effort.
• If you request information on recipients of your personal data, the data controller must inform you about the recipients.
• The data controller shall take reasonable steps to inform other controllers who are processing your personal data that you have requested the erasure by them of any links to, or copies of, your data. (Reasonable steps means taking account of available technology and the cost of implementation including technical measures.)

Are there circumstances in which the right to be forgotten will not apply?

Yes, the GDPR states that the right to be forgotten will not apply where processing is necessary for:

• Exercising the right of freedom of expression and information.
• Compliance with a legal obligation, the performance of a task carried out in the public interest or in the exercise of official authority.
• Reasons of public interest in the area of public health (See Article 9(2)(h) & (i) and Article 9(3), GDPR).
• Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• Establishment, exercise or defence of legal claims.

The right of erasure is also restricted in certain circumstances under Section 60 of the Data Protection Act 2018, which provides for restrictions that are necessary for important objectives of public interest, and by Section 43 of the Act which seeks to balance the right of erasure with the right of freedom of expression and information. More information about the restriction of individual rights can be found here.