# R7 | anthropic/claude-opus-5 | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR right to erasure lets individuals require a controller to delete their personal data "without undue delay" when one of six specific grounds applies — but it is a conditional right, not a general power to delete one's digital footprint. The right is set out in Article 17, is also known as the "right to be forgotten," and is not absolute — it only applies in certain circumstances.

## The six grounds for erasure (Article 17(1))

| Ground | When it applies |
|---|---|
| No longer necessary | The data are no longer necessary for the purposes for which they were collected or otherwise processed |
| Consent withdrawn | The data subject withdraws consent under Art. 6(1)(a) or 9(2)(a) and there is no other legal ground |
| Objection upheld | The subject objects under Art. 21(1) and there are no overriding legitimate grounds, or objects under Art. 21(2) (direct marketing) |
| Unlawful processing | The personal data have been unlawfully processed |
| Legal obligation to erase | Erasure is required for compliance with a legal obligation in Union or Member State law |
| Children's data | Data were collected in relation to the offer of information society services referred to in Article 8(1) |

Full text: [Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/).

## Downstream obligations

Erasure can reach beyond the original controller. Where the controller has made the data public, it must — taking account of available technology and cost of implementation — take reasonable steps, including technical measures, to inform other controllers processing the data that the subject has requested erasure of any links to, or copies or replications of, those data ("reasonable steps" accounts for available technology and cost of implementation) ([Irish DPC](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr)). Article 19 additionally requires notifying recipients the data were disclosed to.

## Main limitations (Article 17(3))

The right does not apply where processing is necessary for: exercising the right of freedom of expression and information; compliance with a legal obligation, a task carried out in the public interest, or the exercise of official authority; reasons of public interest in the area of public health; archiving in the public interest, scientific or historical research, or statistical purposes; and the establishment, exercise or defence of legal claims ([Irish DPC](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr)). Health-related special category data carries its own carve-out: retention can be necessary for preventive or occupational medicine, assessing an employee's working capacity, medical diagnosis, or the provision or management of health or social care — but only where the data are handled by or under the responsibility of a professional bound by an obligation of professional secrecy ([ICO](https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/)).

## Practical and procedural limits

- **Scope is time-bound.** The right only applies to data held at the time the request is received ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)).
- **Abusive requests can be refused.** A controller can refuse a request that is "manifestly unfounded or excessive," a term with no fixed definition; this must be assessed case by case with no blanket policy, and the controller must be able to justify its reasoning to the regulator.
- **Partial refusal is possible.** Where an exemption applies, a controller may refuse wholly or partly, and exemptions do not all operate the same way.
- **National-law exemptions layer on top.** In the UK, for example, a company director cannot have their name and address removed from the public register at Companies House, because that would prevent the Registrar meeting a legal obligation to publish it ([ICO exemptions guide](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/exemptions/a-guide-to-the-data-protection-exemptions/)). Intelligence-services processing rights can be restricted by the national security exemption.
- **Research has a built-in exception.** Article 17 contains a built-in exception for research purposes, though exemptions must not be applied in a blanket manner and must be considered case by case.
- **Restriction as a fallback.** Article 18 lets individuals limit how their data is used as an alternative to requesting erasure; suppression lists are a typical example, where data is retained precisely to honour an objection to marketing.
- **Timing.** Requests can be made verbally or in writing, and the controller has one month to respond.
- **Technical reality.** Complete deletion in electronic systems is often problematic, but controllers are expected to have adequate systems and storage media to comply.

## Enforcement stakesFailure to honour the right falls into the GDPR's upper fine tier of EUR 20 million (GBP 17.5 million under the UK GDPR) or 4% of annual global turnover.

One frequently misunderstood point: against search engines, the right operates as de-indexing of specific result links rather than deletion of the underlying source content, and the freedom-of-expression and public-interest balance in Article 17(3)(a) is where most contested cases — particularly those involving journalism or public figures — are resolved.

Would you like a practical template and checklist for submitting or responding to an erasure request?
