# R7 | moonshotai/kimi-k3 | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The "right to erasure," set out in Article 17 of the GDPR, gives individuals the right to have their personal data deleted by a controller "without undue delay" — which is why it is commonly called the "right to be forgotten" [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504). It is not an absolute right: it applies only when one of six specific grounds is met, and it is displaced by five categories of exceptions [ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## What the right is

Under Article 17(1), a data subject can demand erasure and the controller is obligated to comply where a valid ground exists [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain). Requests can be made verbally or in writing, and the controller must respond without undue delay and at the latest within one month, either confirming erasure or explaining the refusal [ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). If the controller has made the data public, Article 17(2) additionally requires it to take reasonable steps, including technical measures, to inform other controllers processing that data of the erasure request [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504).

## When the right applies

Erasure must be granted if any of these six grounds applies [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain):

- The data is no longer necessary for the purposes for which it was collected
- The individual withdraws consent and no other legal basis for processing exists
- The individual objects to processing based on legitimate interests and no overriding grounds exist, or objects to direct marketing
- The data was processed unlawfully
- Erasure is required to comply with a legal obligation
- The data was collected from a child in relation to online (information society) services

## Main limitations

Article 17(3) disapplies the right where processing is necessary for any of the following [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504):

| Exception | Practical effect |
|---|---|
| Freedom of expression and information | Protects journalism and public discourse |
| Legal obligation, public interest task, or official authority | Controllers required by law to retain data can refuse |
| Public health | Covers preventive medicine, diagnosis, and health care management under professional secrecy |
| Archiving, research, and statistics | Applies where erasure would seriously impair those purposes |
| Legal claims | Data can be kept to establish, exercise, or defend claims |

Beyond these statutory exceptions, several practical limits apply:

- The right covers only data held when the request is received, not data created in the future [ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).
- Controllers may refuse requests that are "manifestly unfounded" or "excessive," but must assess each case individually — blanket refusal policies are not permitted — and must justify the refusal to the individual and, if asked, to the regulator [ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).
- The right is not the only deletion obligation: controllers must separately consider deleting data under the storage-limitation principle even without a request [ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## Search engines and delisting

A prominent application is "delisting" — requiring search engines to remove links to personal information from results for a person's name. The European Data Protection Board's Guidelines 5/2019 set out the criteria for these requests, including how to balance privacy against the public's interest in access to information [edpb.europa.eu](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf). The UK GDPR retains an essentially identical Article 17 regime post-Brexit [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain).

Would you like a step-by-step guide on how an individual can submit an effective erasure request to a company?
