What is the right to be forgotten in GDPR?
The right to be forgotten or the right to erasure under Article 17 of GDPR requires that data subjects have the right to have their personal data erased or forgotten. In GDPR, data subject refers to any individual whose personal data is collected or processed by an organisation.
EU residents have the right to have their personal data erased, under certain circumstances when:
- The data is no longer necessary to fulfil the purpose it was collected for
- The data subject withdraws their consent
- The data subject objects to the processing
- The data has been collected or processed unlawfully
- Legal compliance with laws of the EU or the Member States requires the data to be erased
- The data is subject to Article 8 relating to the personal data of children
The right to erasure isn’t absolute or unlimited. The exceptions to it include the following:
- To exercise the right to freedom of expression and information of the organization
- To carry out the processing for public interest purposes
- For the defence of legal claims