# R7 | google/gemini-3.6-flash | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The right to erasure under Article 17 of the General Data Protection Regulation (GDPR) gives individuals the right to have their personal data deleted by a data controller without undue delay [EU GDPR Article 17](https://gdpr-info.eu/art-17-gdpr/). However, this right is not absolute and only applies under specific circumstances, such as when data is no longer necessary or consent is withdrawn [UK ICO Guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). Organizations can lawfully refuse requests if processing is required for legal obligations, public interest, or freedom of expression [Data Protection Commission](https://www.dataprotection.ie/en/individuals/rights-individuals/data-protection-rights-explained/right-erasure).

## What is the Right to Erasure?

The "right to erasure," commonly known as the "right to be forgotten," allows individuals located in the EU and UK to ask organizations to wipe their personal data [EU GDPR Article 17](https://gdpr-info.eu/art-17-gdpr/). Upon receiving a valid request, controllers must erase the personal data without undue delay, generally within one calendar month [GDPR EU Guide](https://gdpr.eu/right-to-be-forgotten/). If the data controller has made the personal data public, it must take reasonable technical steps to inform other controllers processing the data that the individual has requested its deletion [Data Protection Commission](https://www.dataprotection.ie/en/individuals/rights-individuals/data-protection-rights-explained/right-erasure).

An individual can demand erasure under six specific conditions set out in Article 17(1):

| Ground for Erasure | Statutory Trigger |
| --- | --- |
| Purpose Fulfillment | Personal data is no longer necessary for the purpose it was originally collected or processed. |
| Consent Withdrawal | Processing was based on consent, the individual withdraws consent, and no other legal basis exists. |
| Objection to Processing | The individual objects to processing under Article 21, and there are no overriding legitimate grounds. |
| Unlawful Processing | Personal data was collected or processed unlawfully under EU or national law. |
| Legal Compliance | Erasure is required to comply with a legal obligation to which the controller is subject. |
| Child Information Services | Data was collected from a child in connection with the offer of information society services under Article 8(1). |

## Main Limitations and Exceptions

The right to be forgotten is conditional. Article 17(3) outlines statutory exemptions where a controller can lawfully refuse an erasure request because processing remains necessary [EU GDPR Article 17](https://gdpr-info.eu/art-17-gdpr/).

**Freedom of Expression and Information**
Erasure can be refused to protect freedom of expression and public information access, such as in journalism, artistic content, and public interest publishing [Data Protection Commission](https://www.dataprotection.ie/en/individuals/rights-individuals/data-protection-rights-explained/right-erasure).

**Compliance with Legal Obligations**
Controllers are not required to delete data if retention is mandated by law, such as financial recordkeeping, tax audits, employment legislation, or regulatory mandates [UK ICO Guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

**Public Interest and Public Health**
Organizations may retain data to carry out tasks in the public interest, exercise official authority, or address public health concerns like tracking communicable diseases [EU GDPR Article 17](https://gdpr-info.eu/art-17-gdpr/).

**Archiving, Research, and Statistics**
Erasure is exempt if deleting the data would render impossible or severely impair archiving in the public interest, scientific or historical research, or statistical calculations [UK ICO Guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

**Legal Claims**
Personal data can be retained if it is required to establish, exercise, or defend against legal claims or ongoing legal proceedings [UK ICO Guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

**Manifestly Unfounded or Excessive Requests**
If a request is clearly baseless, malicious, or repetitive, a controller can charge a reasonable administrative fee or refuse the request entirely [GDPR EU Guide](https://gdpr.eu/right-to-be-forgotten/).

## Territorial Scope and Search Engine Delisting

For online search engine providers, the right to erasure operates as a "right to delist" links appearing under search queries for a person's name. The Court of Justice of the European Union (CJEU) established that search engine operators must remove search results on European domain extensions, but they are not obligated to carry out global removals across non-EU domains [ComplyDog Article 17](https://complydog.com/blog/gdpr-article-17-right-to-erasure-right-to-be-forgotten).

Would you like to know how data controllers must handle erasure requests when personal data is stored on immutable backups or database archives?
