Examples
Worked examples
- Is an instance
A participant in a marketing analytics study withdraws consent and requests erasure of their personal data; the controller, lacking another lawful basis, deletes the records and confirms in writing.
- Is an instance
A long-term population-health cohort receives an erasure request and applies the Article 17(3)(d) research exemption to retain pseudonymised records but removes direct identifiers from the participant-facing dataset and notifies the participant of the basis.
Counter-examples
Looks similar, but isn't
- Not an instance
Erasure does not apply to data the controller is legally required to retain (for example, regulated clinical-trial source documents under ICH GCP).
- Not an instance
Anonymous data, having no data subject, cannot be the subject of an Article 17 request.
Editorial commentary
Often called the right to be forgotten, Article 17 applies where the data are no longer necessary for the purposes for which they were collected, consent is withdrawn and no other lawful basis applies, the data subject objects under Article 21 and there are no overriding legitimate grounds, the data were unlawfully processed, or erasure is required to comply with a legal obligation. Article 17(3) provides that the right does not apply to the extent that processing is necessary for scientific or historical research purposes in accordance with Article 89(1) where erasure would be likely to render impossible or seriously impair the achievement of the research objectives. Controllers must document any reliance on Article 17(3) and communicate erasure to other controllers where the data have been made public.
References
- GDPR Regulation (EU) 2016/679 Article 17 Right to erasure
- European Data Protection Board Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases
- UK Information Commissioner's Office Guide to the UK GDPR: Right to erasure
Also known as
right to be forgotten · GDPR Article 17
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Right to erasure"
vocab-term-identifier="https://casrai.org/dictionary/term/right-to-erasure" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"name": "Right to erasure",
"identifier": "https://casrai.org/dictionary/term/right-to-erasure",
"description": "The right under Article 17 of the GDPR for a data subject to obtain from the controller the erasure of personal data concerning them without undue delay where one of the grounds in Article 17(1) applies and no exception in Article 17(3) operates.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-and-regulatory/",
"url": "https://casrai.org/dictionary/term/right-to-erasure",
"sameAs": [
"right to be forgotten",
"GDPR Article 17"
],
"license": "https://creativecommons.org/licenses/by/4.0/"
}
