# R7 | moonshotai/kimi-k3 | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The "right to erasure," commonly called the **right to be forgotten**, is set out in Article 17 of the GDPR. It gives individuals the right to have their personal data deleted "without undue delay" in specific situations — but it is not absolute and applies only when certain conditions are met [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504).

## What the right is

Under Article 17(1), a data subject can demand erasure, and the controller is obliged to comply, when one of six grounds applies [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504):

- The data is **no longer necessary** for the purposes for which it was collected or processed
- The individual **withdraws consent** (where consent was the legal basis) and no other legal ground exists
- The individual **objects to processing** based on legitimate interests with no overriding grounds, or objects to direct marketing
- The data has been **unlawfully processed**
- Erasure is required to **comply with a legal obligation**
- The data was collected from a **child** in connection with information society services (e.g., online apps), where consent may not have been fully informed

Requests can be made **verbally or in writing**, and controllers must respond within **one month** [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). A controller that has made the data public must also take reasonable steps to inform other controllers processing that data of the erasure request. The right has also been extended by case law and regulator guidance to **search-engine delisting**, with criteria set out in dedicated EDPB guidelines [edpb.europa.eu](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf).

## Main limitations

Article 17(3) states the right **does not apply** where processing is still necessary for specific overriding purposes [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504):

| Exception | Example |
|---|---|
| **Freedom of expression and information** | Journalistic content, public records |
| **Legal obligation or public-interest task** | Tax records, statutory retention duties |
| **Public health** | Epidemiological records, occupational medicine under professional secrecy |
| **Archiving, research, statistics** | Where erasure would seriously impair scientific or historical research |
| **Legal claims** | Data needed to establish, exercise, or defend claims in litigation |

Beyond these statutory exceptions, regulators identify further practical limits [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/):

- **Only existing data is covered** — the right applies to data held when the request is received, not data created in the future
- **Manifestly unfounded or excessive requests** can be refused (e.g., repetitive requests), assessed case-by-case rather than by blanket policy
- **Refusals must be justified** — the controller must explain the reasons, and inform the individual of their right to complain to a supervisory authority (such as the ICO) and to seek a judicial remedy
- **Special category data** (health data, etc.) enjoys extra protection from erasure when processed for public health or medical purposes under professional secrecy obligations

The European Commission confirms the bottom line for organizations: deletion is **not automatic on request** — it is required only when one of the Article 17 grounds is satisfied and no exception applies [commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en). Note that post-Brexit, the UK applies an essentially identical regime via the UK GDPR and its own Article 17 [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain).

Would you like guidance on how to actually submit an erasure request to a company, or on how organizations should handle one?
