# R7 | anthropic/claude-opus-5 | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR "right to erasure" (Article 17) lets individuals require a controller to delete their personal data without undue delay when one of six specific grounds applies — but it is a conditional right, not an absolute one. Article 17 grants individuals the right to request, on certain grounds, erasure of their personal data and requires all data controllers to erase the personal data when those grounds are met, subject to exceptions [EDPB Guidelines Summary](https://www.hunton.com/privacy-and-information-security-law/edpb-publishes-guidelines-on-the-right-to-be-forgotten-in-search-engine-cases).

## What the right actually saysThe data subject has the right to obtain from the controller erasure of personal data concerning him or her without undue delay, and the controller has an obligation to erase without undue delay where one of the listed grounds applies [Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/).

The six grounds in Article 17(1) are:

- The data are no longer necessary for the purposes for which they were collected or processed.
- The data subject withdraws consent and there is no other legal basis for the processing.
- The data subject objects under Article 21 and there are no overriding legitimate grounds (objections to direct marketing always succeed).
- The data have been unlawfully processed.
- Erasure is required to comply with a legal obligation under EU or Member State law.
- The data were collected in relation to the offer of information society services referred to in Article 8(1) (i.e. children's data) [Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/).

There is also a downstream duty: where the controller has made the data public, it must take reasonable steps — accounting for available technology and cost — including technical measures, to inform other controllers processing the data that the subject has requested erasure of any links to, or copies or replications of, those data [Art. 17(2)](https://gdpr-info.eu/art-17-gdpr/). Ireland's DPC frames this as taking reasonable steps to inform other controllers, meaning steps that account for available technology and the cost of implementation [DPC Ireland](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr).

## How requests are made and handled

No formality is required. The GDPR does not specify how to make a valid request, so an individual can request erasure verbally or in writing, to any part of the organisation, without naming Article 17 or using the phrase "request for erasure" [ICO Right to Erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). Controllers must act without undue delay, and should have processes to delete the data within one month of receiving the request [Clarip on Article 17](https://www.clarip.com/data-privacy/gdpr-erasure/) — the one-month deadline comes from Article 12(3), extendable by two further months for complex requests.

## The main limitations

Article 17(3) disapplies the right where processing is necessary for the following purposes:

| Exemption | Typical example |
|---|---|
| Freedom of expression and information | Journalistic archives, news reporting |
| Compliance with a legal obligation, or a public-interest/official-authority task | Tax and accounting records, regulatory retention rules |
| Public interest in public health (Art. 9(2)(h),(i), 9(3)) | Medical records, disease surveillance |
| Archiving in the public interest, scientific/historical research, statistics | Research datasets where erasure would seriously impair the purpose |
| Establishment, exercise or defence of legal claims | Evidence held for pending or anticipated litigation |

These are set out by the DPC as the cases where the right to be forgotten does not apply: freedom of expression and information; compliance with a legal obligation or performance of a public-interest task or official authority; public interest in public health; archiving in the public interest, scientific or historical research or statistical purposes; and the establishment, exercise or defence of legal claims [DPC Ireland](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr). In practice, Article 17(3)(b) permits retention where a legal obligation requires processing, and Article 17(3)(e) permits retention where data are needed to establish, exercise or defend legal claims [Clarip](https://www.clarip.com/data-privacy/gdpr-erasure/).

Further practical constraints:

- **It is not retroactive or forward-looking.** The right only applies to data held at the time the request is received [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).
- **Delisting is not deletion.** For search engines, obtaining delisting removes the specific content from the results list for a name-based search, but the content remains findable by other search terms, and the data are erased neither from the source website nor from the provider's index and cache [EDPB Guidelines 5/2019](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf).
- **Public interest in information can override it.** Search engine operators may refuse to delist content where they can demonstrate that its inclusion in the results is strictly necessary for protecting the freedom of information of internet users [Hunton Analysis](https://www.hunton.com/privacy-and-information-security-law/edpb-publishes-guidelines-on-the-right-to-be-forgotten-in-search-engine-cases).
- **Original publication can stay lawful.** The CJEU held that a search engine may be obliged to remove links even where the information is not erased from those web pages and even where its publication on those pages is itself lawful [EDPB Guidelines 5/2019](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf) — the flipside being that erasure against a search engine does not touch the publisher.
- **Geographic reach is limited.** The EDPB guidance was issued following the CJEU cases Google Spain v Costeja González (C-131/12) and Google v CNIL (C-136/17) [Lexology Summary](https://www.lexology.com/library/detail.aspx?g=296f3232-5f39-420a-916b-d8039577d795); the latter confirmed there is no general obligation to delist worldwide, only across EU domains.
- **Member State law can narrow it further** via Article 23 restrictions (national security, defence, criminal enforcement), and controllers may refuse or charge for manifestly unfounded or excessive requests under Article 12(5).

## Primary official sources

- **Regulation text (EU 2016/679)** — Article 17 in full: [Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/) and the authoritative version at [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- **EDPB Guidelines 5/2019** — criteria for the right to be forgotten in search engine cases: [EDPB Document Page](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-52019-criteria-right-be-forgotten-search-engines_en)
- **Irish Data Protection Commission** — plain-language guidance on Articles 17 and 19: [DPC Guidance](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr)
- **UK ICO** — controller-facing handling guidance (UK GDPR, materially identical wording): [ICO Guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

Would you like a practical checklist for responding to an erasure request as a controller, or template wording for making one as an individual?
