The right to erasure, also known as “the right to be forgotten” is stated in article 17 GDPR and means that individuals have the right to have personal data erased. This right is not an absolute right which means that it only applies in certain situations.
An individual has the right to get their data erased in the following situations:
- When the personal data no longer is necessary for the purpose which it initially is processed for;
- The processing rely on consent as their lawful basis, and the individual withdraws their consent;
- The processing rely on legitimate interests and the individual objects to the processing, and the controllers’ legitimate interest is not strong enough to continue this processing;
- The personal data is used for direct marketing and the individual objects to the processing;
- The controller has processed the personal data unlawfully;
- The erasure is mandatory in order to comply with a legal obligation; or
- The controller has processed the personal data in order to offer information society services to a child.
Synonyms:
the right to be forgotten