# R7 | openai/gpt-5.6-luna | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR’s **right to erasure**, commonly called the “right to be forgotten,” lets an individual ask a controller to delete personal data about them in specified circumstances. It is **not an absolute right**: deletion can be refused where retaining or processing the data is necessary for expression, legal compliance, public interests, research, or legal claims.

## What the right means

Under **Article 17 GDPR**, a data subject may require the controller—the organisation deciding why and how personal data is processed—to erase personal data **without undue delay** when one of these grounds applies:

- The data is no longer necessary for the purpose for which it was collected.
- The individual withdraws consent, and there is no other lawful basis for processing.
- The individual objects to processing and there are no overriding legitimate grounds for continuing it.
- The data was processed unlawfully.
- Erasure is required to comply with a legal obligation.
- The data was collected in connection with an online service offered directly to a child.

[1] [GDPR Article 17 — Right to erasure](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

The right applies to **personal data**, not necessarily every record, document, account, or reference associated with an individual. The controller must assess the request against the applicable legal grounds and exceptions.

## Main limitations

### 1. It does not apply automatically

A request alone does not guarantee deletion. The individual must generally show that an Article 17 ground applies, while the controller must assess whether an exception permits continued processing.

The right is therefore better understood as a **qualified right to request erasure**, not a general power to remove any information someone dislikes. [2] [EDPB data-subject rights](https://www.edpb.europa.eu/topics/key-gdpr-concepts/data-subject-rights_en) ([edpb.europa.eu](https://www.edpb.europa.eu/topics/key-gdpr-concepts/data-subject-rights_en?utm_source=openai))

### 2. Freedom of expression and information

Erasure may be refused when processing is necessary to exercise the right to **freedom of expression and information**. This can cover, depending on the circumstances, journalism, academic commentary, public reporting, and access to information.

This exception requires balancing privacy against expression and information rights; it does not automatically protect every publication or public reference. [1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 3. Legal obligations and official functions

A controller may retain data where processing is necessary to comply with a legal obligation or to perform a task in the public interest or under official authority. Examples can include statutory employment, tax, accounting, regulatory, or record-keeping duties.

In these cases, the controller generally cannot erase data merely because the individual requests it. [1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 4. Public health

Erasure may be refused where processing is necessary for specified **public-health reasons**, such as protecting against serious cross-border health threats or ensuring standards for healthcare and medicines.

This is a narrower exception than a general “public interest” exemption and must relate to the conditions in Article 17(3). [1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 5. Archiving, research, and statistics

Data may be retained for archiving in the public interest, scientific or historical research, or statistical purposes where deletion would likely make the work impossible or seriously impair it.

The exception is not unlimited: the processing must fall within the relevant public-interest or research conditions, and appropriate safeguards remain applicable. [1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 6. Legal claims

Erasure may be denied when the data is necessary to establish, exercise, or defend legal claims. This can include preserving evidence for actual or reasonably anticipated litigation, regulatory proceedings, or disputes.

[1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 7. It is not a guarantee that information disappears from the internet

Where a controller has made personal data public and must erase it, Article 17(2) requires it to take reasonable steps to inform other controllers processing links, copies, or replications of the data. The obligation is qualified by what is technically feasible and proportionate.

This means the GDPR does not guarantee removal from every website, archive, cached copy, database, or jurisdiction worldwide. [1] [GDPR Article 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

### 8. Backups and technical deletion may take time

Erasure must occur without undue delay, but organisations may have backup systems, archives, or disaster-recovery copies. In practice, data may be isolated, blocked from ordinary use, and deleted according to the organisation’s backup cycle where immediate deletion from every backup is not technically realistic.

The organisation must still prevent the data from continuing to be used improperly and should be able to explain its approach.

### 9. Controllers may verify identity and extend the response period

A controller may request information reasonably necessary to confirm the requester’s identity. It normally must respond within **one month**, but may extend that period by up to **two further months** where the request is complex or numerous, provided it explains the extension within the first month.

[3] [GDPR Articles 12 and 17](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/FR-EN/TXT/?uri=CELEX%3A32016R0679&utm_source=openai))

## Practical summary

| The right generally supports erasure when… | Erasure may generally be refused when… |
|---|---|
| Data is no longer needed | Retention is legally required |
| Consent is withdrawn and no alternative legal basis exists | Processing is necessary for legal claims |
| Processing is unlawful | Processing is necessary for freedom of expression or information |
| The individual’s objection overrides the controller’s grounds | Data is needed for specified public-health purposes |
| Data was collected from a child in connection with an online service | Deletion would seriously impair qualifying archiving, research, or statistical work |

The European Data Protection Board describes the right as **non-absolute** and identifies the central practical challenge as balancing erasure against competing rights and legal obligations. [4] [EDPB 2026 report](https://www.edpb.europa.eu/news/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en) ([edpb.europa.eu](https://www.edpb.europa.eu/news/edpb-identifies-challenges-hindering-the-full-implementation-of-the-right-to-erasure_en?utm_source=openai))

Would you like a short example of how to submit a GDPR erasure request to a company?
