Someone asks for erasure, but I have to keep their data under a statutory retention obligation. What now?

Paragraph 3(b) says the right to erasure does not apply to the extent that processing is necessary to comply with a legal obligation to which you are subject. You may then keep the data covered by that retention obligation, but no more than that; data not covered by the obligation are erased where a ground in paragraph 1 applies. In line with Article 12(4) you tell the data subject within one month why you do not fully act on the request.

We published the data on our website and others have copied them. Do I have to get those removed too?

Paragraph 2 imposes a best-efforts duty: where you have made the data public and are obliged to erase them, you take reasonable steps, including technical measures, to inform other controllers that the data subject has requested erasure of links, copies and replications. You may take account of available technology and the cost of implementation. Recital 66 explains that this is meant to strengthen the right to be forgotten in the online environment.

Someone withdraws their consent. Do I always have to erase everything?

Not always. Paragraph 1(b) requires erasure where consent is withdrawn and there is no other legal ground for the processing. If you have another legal basis for part of the data, for example a legal obligation, you may keep that part, and the exceptions in paragraph 3 may also apply. You erase the rest without undue delay and record the ground on which you keep what remains.

Article 17: Right to erasure (‘right to be forgotten’)AI-relevant

Praxikon tracks Article 17 (Right to erasure (‘right to be forgotten’)) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 17 gives everyone the right to have their personal data erased and obliges the controller to do so without undue delay in six situations (paragraph 1): the data are no longer necessary for the purpose, consent has been withdrawn and no other legal ground exists, an objection has been made under Article 21, the processing was unlawful, a legal obligation requires erasure, or the data were collected from a child in relation to an online service referred to in Article 8(1). If you have made the data public, you take reasonable steps to inform other controllers that the data subject has requested erasure of links and copies (paragraph 2). Paragraph 3 lists the exceptions: freedom of expression, a legal obligation or task in the public interest, public health, archiving and research, and legal claims. The article exists because keeping data that are no longer necessary or were processed unlawfully infringes the Regulation, and because people, especially those who gave consent as a child, must be able to have data removed from the internet later (recitals 65 and 66).

Key term: Right to erasure: the right to have your data deleted when there is no longer a valid reason to keep them

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e) for the establishment, exercise or defence of legal claims.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

You test every erasure request against the six grounds in paragraph 1 and erase the data without undue delay where one of them applies, including data you use in, for example, an AI application. Where you have made the data public, you take reasonable steps, taking account of available technology and cost, to inform other controllers of the request (paragraph 2). If you refuse, that rests on an exception in paragraph 3, such as a statutory retention obligation, and you explain the reasons in line with Article 12(4).

Data Subject

You can ask for erasure in the situations of paragraph 1, for example when you withdraw consent, when the data are no longer needed or when you have objected. This also applies to data you provided as a child, even now that you are an adult (recital 65). Where one of those situations applies, the controller may refuse only for the reasons in paragraph 3 and must then explain why.

Compliance checklist

There is a procedure to receive erasure requests and test them against the six grounds in paragraph 1.Data that are no longer necessary for the purposes for which they were collected are erased (paragraph 1(a)).After consent is withdrawn, it is assessed whether another legal ground exists and otherwise the data are erased (paragraph 1(b)).After an objection under Article 21, it is assessed whether overriding legitimate grounds exist and otherwise the data are erased (paragraph 1(c)).For data that have been made public, reasonable steps are in place to inform other controllers of an erasure request (paragraph 2).Every refusal rests on an exception in paragraph 3 and is recorded with its reasons and communicated to the data subject in line with Article 12(4).Erasure takes place without undue delay and the data subject hears within the period of Article 12(3) what has been done with the request (paragraph 1).

Related recitals

(65)

A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member S...

(66)

To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged ...

Cross-references

Art. 6: Lawfulness of processing Art. 8: Conditions applicable to child's consent in relation to information society services Art. 9: Processing of special categories of personal data Art. 21: Right to object Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Frequently asked questions

← Art. 16: Right to rectification Art. 18: Right to restriction of processing →

Connections

Article 17: Right to erasure (‘right to be forgotten’)AI-relevant

What does Article 17 govern?

Official text

What does this mean for you?

Controller

Data Subject

Compliance checklist

Related recitals

Cross-references

Frequently asked questions

What connects to Article 17 GDPR

Case law

Guidelines

Enforcement and fines