The right to be forgotten or right to erasure is provided for in Article 17 of the GDPR. It allows data subjects to request the deletion of their personal data.
The right to be forgotten can be invoked when:
- The personal data is no longer necessary for the purposes for which it was collected.
- The person concerned withdraws their consent
- The data subject exercises his/her right to object and no legitimate grounds can be invoked by the controller
- The personal data has been processed unlawfully.
- The data must be erased in order to comply with a legal obligation under EU or Member State law.
- The personal data has been collected in the context of the provision of information society services.
However, there are a number of situations in which the right to be forgotten cannot be invoked. For example, when processing is necessary:
- To exercise freedom of expression and information.
- For the fulfilment of a public service mission: if the data controller collects data for this purpose.
- For reasons of public interest in the field of public health.
- For archiving purposes , scientific or historical research or statistical purposes.
- For the exercise of legal rights.
Once a report has been made, the data controller must delete the data it has collected as quickly as possible and must at least provide a response within one month of receiving the request. However, there are certain situations where the deadline may be longer if:
- The person is asked to confirm their identity (e.g. provide a copy of an ID document)
- The organisation charges a fee
- The response time may be extended by two months if the organisation has received several requests from an individual or if the request is complex.