# R7 | meta/muse-spark-1.1 | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

I'll explain the GDPR right to erasure and its main limitations, drawing on official sources.

The GDPR 'right to erasure', also known as the 'right to be forgotten', is the right in Article 17 for an individual to obtain deletion of their personal data without undue delay when certain conditions are met.

## What it is

Under Article 17(1), the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies [Right to Erasure](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

**This is also known as the ‘right to be forgotten’** [Irish Data Protection](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

The grounds are [Art. 17 GDPR – Right to erasure](https://gdpr-info.eu/ART-17-GDPR/):

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
2. the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing
3. the data subject objects to the processing pursuant to Article 21(1) or 21(2) and there are no overriding legitimate grounds
4. the personal data have been unlawfully processed
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law
6. the personal data have been collected in relation to the offer of information society services to a child under Article 8(1)

If the controller has made the personal data public and is obliged to erase it, the controller must take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested erasure of any links to, or copy or replication of, those personal data [GDPR Article 17 Text](https://gdpr-info.eu/ART-17-GDPR/).

Article 19 also requires the controller to communicate erasure to each recipient to whom the data have been disclosed, unless impossible or disproportionate effort [Right to Erasure Duties](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

## Main limitations - Article 17(3)

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary [Art. 17(3) GDPR](https://gdpr-info.eu/ART-17-GDPR/):

**1. Freedom of expression and information**
For exercising the right of freedom of expression and information [Freedom of Expression Exception](https://gdpr-info.eu/ART-17-GDPR/).

**2. Legal obligation or public task**
For compliance with a legal obligation which requires processing by Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller [Legal Obligation Exception](https://gdpr-info.eu/ART-17-GDPR/). The Irish Data Protection Commission summarizes this as compliance with a legal obligation, performance of a task in the public interest or exercise of official authority [Irish DPA Limitations](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

**3. Public health**
For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) [Public Health Exception](https://gdpr-info.eu/ART-17-GDPR/).

**4. Archiving, research and statistics**
For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right is likely to render impossible or seriously impair the achievement of the objectives of that processing [Research Archiving Exception](https://gdpr-info.eu/ART-17-GDPR/). This is also listed by the DPC as archiving purposes in the public interest, scientific or historical research [DPC Research Limitation](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

**5. Legal claims**
For the establishment, exercise or defence of legal claims [Legal Claims Exception](https://gdpr-info.eu/ART-17-GDPR/).

National law may provide further restrictions necessary for important objectives of public interest or to balance with freedom of expression [Section 43 Restriction](https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr?ref=gp21012022c).

In practice, this means the right is not absolute — controllers must balance the request against these exceptions and can refuse erasure where processing remains necessary for one of the above purposes.

Would you like a template for making a valid Article 17 erasure request to a controller?
