Article 17 and Recitals 65 & 66 relate to this right.
This is also known as the "right to be forgotten" and to a great extent reflects the currently existing right.
The right can be exercised when one of the following applies:
- consent is withdrawn and there are no other grounds for processing;
- the right to object to direct marketing has been exercised
- the right to object to processing has been exercised and there are no other grounds for processing
or the data:
- is no longer necessary for the purpose(s) for which they were collected or otherwise processed;
- has been unlawfully processed
- have to be erased to comply with a legal obligation on the controller
- was collected in relation to information society services and relates to a child (or a child that has now reached maturity)
Limitations on the extent of the exercise of the right include where the processing is necessary:
- for exercising the right of free speech (journalism, literature, art etc)
- compliance with a legal obligation in relation to a task carried out by virtue of public interest or in exercise of official authority
- public interest in the area of public health
- archiving in the public interest, research or statistical purposes
- establishment, defence or exercise of legal claims
Controllers obliged to erase data are subject to additional obligations:
If the data has been made public by the controller, Article 17(2) states:
"the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the data, that the data subject has requested the erasure by such controllers of any links to, or copy or replication of that personal data."
If the controller has disclosed the personal data, Article 17b applies and the controller must advise each recipient of the data in question about the erasure and, if requested, the controller must inform the data subject about those recipients.