# R7 | meta/muse-spark-1.1 | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

I'll pull the official text of the right to erasure and its limits from EU sources.

Under GDPR Article 17, individuals have the right to obtain erasure of personal data concerning them without undue delay — commonly called the 'right to be forgotten' [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). It is not absolute and only applies in certain circumstances [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## What it is

Article 17 establishes both a right for the data subject and an obligation for the controller to erase data where one of the grounds applies [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm).

The controller must erase without undue delay if:

* **Purpose expired:** personal data are no longer necessary for the purposes for which they were collected or otherwise processed [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Consent withdrawn:** the data subject withdraws consent under Article 6(1)(a) or 9(2)(a) and there is no other legal ground [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Objection:** the data subject objects under Article 21(1) and there are no overriding legitimate grounds, or objects under Article 21(2) for direct marketing [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Unlawful processing:** data have been unlawfully processed [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Legal obligation:** erasure is required to comply with a legal obligation under EU or Member State law [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Child services:** data were collected in relation to an offer of information society services under Article 8(1) [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)

If the controller has made the data public, it must take reasonable steps, considering available technology and cost, to inform other controllers processing the data that the data subject has requested erasure of any links to, copy or replication [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm). Under Article 19, the controller must also inform recipients of any erasure [Right to be Forgotten Summary](https://gdpr-info.eu/issues/right-to-be-forgotten/).

Individuals can request verbally or in writing, and the controller must respond within one month [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). The right only applies to data held at the time of the request, not future data [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## Main limitations - when it does not apply

Article 17(3) states that paragraphs 1 and 2 shall not apply to the extent processing is necessary for [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm):

* **Freedom of expression and information:** to exercise the right of freedom of expression and information [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm) - This is the key balancing test, especially for search engines and journalism [Right to be Forgotten Summary](https://gdpr-info.eu/issues/right-to-be-forgotten/).
* **Legal obligation / public interest:** for compliance with a legal obligation requiring processing or for performance of a task in the public interest or official authority [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Public health:** for reasons of public interest in the area of public health under Article 9(2)(h) and (i) and 9(3) [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Archiving, research, statistics:** for archiving in the public interest, scientific or historical research, or statistical purposes under Article 89(1) where erasure would render impossible or seriously impair objectives [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)
* **Legal claims:** for the establishment, exercise or defence of legal claims [Article 17 Text](https://www.legislation.gov.uk/eur/2016/679/article/17/data.htm)

In practice, the ICO gives examples: an employer can refuse erasure if it must retain salary data to comply with HMRC obligations, or a healthcare provider can retain records required for liability insurance [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

Other practical limits:

* Special category data may continue to be processed where necessary for preventative or occupational medicine, health care management, under professional secrecy obligations [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).
* Requests can be refused if manifestly unfounded or excessive, with reasons provided [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).
* Erasure from backups may be satisfied by putting data 'beyond use' until overwritten, provided it is not otherwise used [Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

Do you want a template for making a valid Article 17 erasure request and how controllers must document the response?
