GDPR Article 17 — Right to erasure ("right to be forgotten")
Enforced by: ICO (UK) / National DPAs
Current as of May 25, 2018
Plain Language Summary
Individuals can demand deletion in 6 circumstances: data no longer needed, consent withdrawn, unlawful processing, legal obligation, or collected from a child.
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected;
(b) the data subject withdraws consent and there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds;
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation.