GDPR — Article 17

The article's text

Article 17
Right to erasure (‘right to be forgotten’)
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) 
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) 
the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) 
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) 
the personal data have been unlawfully processed;
(e) 
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) 
the personal data have been collected in relation to the offer of information society services referred to in Article 8(full text1).
personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) 
for exercising the right of freedom of expression and information;
(b) 
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(c) 
for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
(d) 
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(e) 
for the establishment, exercise or defence of legal claims.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

business association

company

NGO

other

EU citizen

Who	Country	What they wrote
German Insurance Association	DE	the meaning of Art. 15 GDPR. • Rectification (Article 16) Members reported limited use of the right of rectification. • Erasure (Article 17) Members mainly reported limited use of the right of erasure. The deletion of all data is often requested at the same t ↗
FEBIS	DE	etail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
Asociación Española de Economía Digital (Adigital)	ES	tail of the information to be provided (Articles 12 to 14) ● Access to data (Article 15) ● Rectification (Article 16) ● Erasure (Article 17) ● Data portability (Article 20) ● Right to object (Article 21) ● Meaningful explanation and human intervention in auto ↗
Felix Neumann	DE	eigen sich verschiedene Probleme bei der Anwendung dieses Artikels. Neben Unklarheiten in der Auslegung und einer in Konflikt mit Art. 17 AEUV stehenden Stichtagsregelung fehlt es vor allem an formalen Instrumenten, die eine Kohärenz zwischen den Entscheidunge ↗
Doctrine	FR	responsable de traitement de faire valoir des motifs légitimes et impérieux pour faire échec à la demande de droit, tandis que l’article 17 du RGPD prévoit expressément des dérogations pouvant faire échec à l’application du droit à l’effacement, dont l’exerci ↗
State Archives of Belgium	BE	al ‘data subject’ rights for archiving in the public interest, in particular in the context of requests for the right of erasure (Art. 17 GDPR). Overall, the State Archives has received only few requests for the exercise of data subject rights (below 10 in tot ↗
ANITEC-ASSINFORM	IT	ed by businesses. 5b) Answer – Detailed We have noticed that there are no EDPB Guidelines supporting the practical application of Article 17 of the GDPR in the context of erasure requests. ↗
Bitkom e.V.	DE	However, clarity on rectification requirements and processes remains necessary to streamline compliance. Erasure (Article 17) Erasure requests have witnessed an increase, accompanied by challenges such as insufficient awareness about data retention obligations ↗
Federation of the European Sporting Goods Industry (FESI)	BE	of detail of the information to be provided (Articles 12 to 14) -Access to data (Article 15) -Rectification (Article 16) Erasure (Article 17) -Data portability (Article 20) -Right to object (Article 21) -Meaningful explanation and human intervention in automat ↗
BDI e.V. (Federation of German Industries)	DE	an be verified with independent sources, which does not lead to rectification requests when access has been exercised. ▪ Erasure (Article 17) Increasingly more exercised. Some challenges: - Insufficient awareness about the necessity for the controllers and pro ↗
ACCIS	BE	challenge the input data used in their credit scores (right to rectification, Article 16 GDPR) and the right to request erasure (Article 17 GDPR). 5. Enhanced protections for solely automated decisions: When a credit decision is solely based on an automated p ↗
French Association of Large Companies (AFEP)	FR	oach to the essential principles of the GDPR, reconciling freedom and proportionality. • Rectification (Article 16) NA • Erasure (Article 17) AFEP member companies note that personal data for which the data subject exercises his/her right to erasure/right to o ↗
EDRi European Digital Rights	ES	making it challenging or even impossible for data subjects to confirm the accuracy or completeness of their data. • Erasure (Article 17) EDRi is alarmed by a significantly low level of adherence to the right to erasure. Data controllers exhibit hesitancy in re ↗
Information Accountability Foundation	US	ample is the issue of deletion – in relation to the ‘storage limitation principle’ under Article 5 and the right to erasure under Article 17. The relationship between AI training data, AI models and usage is complex. The tokenised data structure of generative ↗
ISPA-Internet Service Provdiers Austria	AT	atisfactory situation and stands in the way of legally compliant application of the GDPR. • Rectification (Article 16) • Erasure (Article 17) In general the members have not reported any problems to us in connection with the data subject's right to cancellatio ↗
Council of the Notariats of the EU	BE	right of access is increasingly being used in litigation and pre-litigation proceedings. • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
ACT \| The App Association	BE	23, 1040 Brussels \| www.actonline.org \| [email protected] • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
EuroISPA (European Internet Services Providers Association)	BE	ed (Articles 12 to 14) Ref. Ares(2024)973400 - 08/02/2024 2 • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
European Association of Public Banks and funding agencies (EAPB)	BE	of Justice of the European Union (CJEU) with reference to Case C-307/22 and the available Advocate General's opinion. 3. Erasure (Article 17) The deletion of data can be technically challenging, leading to the suggestion of permanently blocking relevant person ↗
European Association for the Consumption-based Billing of Energy Costs	BE	se law now no longer permits a reply in the form of an unencrypted email, even if the request was made in that manner. • Erasure (Article 17) Individuals struggle with the fact that their data can only be deleted after the conclusion of the normative retention ↗
MyData-TRUST	BE	is contacted again because of the acquisition of new contact data from third party sources. Thus, balancing the right to erasure (Article 17 GDPR) with the need to retain data for residual legitimate purposes poses practical challenges. MyData-TRUST calls for ↗
BSA \| The Software Alliance	BE	obtain information outside of the litigation process. In addition, there are cases when data subjects exercise right to erasure (Article 17 of the GDPR) to have data deleted to cover up their fraudulent activity. In both cases, the data subjects can be diffic ↗
Bundesrechtsanwaltskammer	DE	etail of the information to be provided (Articles 12 to 14)  Access to data (Article 15)  Rectification (Article 16)  Erasure (Article 17) Position page 4  Data portability (Article 20)  Right to object (Article 21)  Meaningful explanation and human inte ↗
Gesellschaft für Datenschutz und Datensicherheit (GDD) e.V.	DE	nformen Erfüllung des Auskunftsanspruchs für KMU ein richtiger Ansatz zur Unterstützung und Entlastung darstel- len. c) Löschung, Art. 17 DS-GVO Dem Antrag auf Löschung kommt eine immer größere Bedeutung zu und von diesem wird durch die Betroffenen immer häuﬁg ↗
Die Deutsche Kreditwirtschaft	DE	l obligations to keep records, i.e. only for archiving purposes, should be excluded from the right of access. - Deletion of data (Art. 17 GDPR) may be technically difficult or even impossible. Consideration should therefore be given to qualifying or limiting t ↗
United Internet	DE	the potential overburdening of data controllers with excessive or inappropriate requests. • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
Sören Grünberg	DE	en. Kirchen und Religionsgemeinschaften steht das Recht auf Selbstverwaltung zu (Art. 137 Abs. 3 und 5 WRV i. V. m. Art. 140 GG). Art. 17 Abs. 1 AEUV legt dementsprechend fest, dass der Status der Kirchen, religiösen Vereinigungen oder Gemeinschaften nicht bee ↗
Telefonica, S.A.	ES	etail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗
Federation of Austrian Industries	AT	uals want to misuse this right for gaining more information, which is no longer covered by the right to access data. 5 • Erasure (Article 17) The right to erasure poses real problems to controllers, as there are data subjects that don’t want to accept that the ↗
Homo Digitalis	EL	etail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in auto ↗

Source: public consultation submissions and position papers. n = 56 mentions; counted as a literal reference to the article number.

Ask about this article →