What is Article 17 of the GDPR

Article 17 EU GDPR: Right to erasure ("Right to be forgotten")

Comment on Article 17 EU GDPR

What does Art. 17 GDPR say?

Art. 17 GDPR standardizes the now legally stipulated "right to be forgotten" in three paragraphs.

Paragraph 1 defines the reasons that entitle the data subject to request immediate deletion:

  • There is no need to collect data.

  • The data subject has revoked the consent to certain processing operations; there is no other legal basis.

  • In the event of an objection according to Art. 21 Paragraph 1, there are no overriding legal grounds for the processing.

  • The objection according to Art. 21 Paragraph 2 applies without weighing interests.

  • There is unlawful data processing.

  • The deletion is necessary due to a legal obligation that is binding on the person responsible.

  • The data were collected in accordance with Art. 8 (1).

Paragraph 2 obliges the person responsible to take appropriate measures and information about the deletion of all data links and copies after the publication of data.

Paragraph 3 stipulates various exceptions for the application of paragraphs 1 and 2.

How is Art. 17 GDPR to be understood?

From a legal point of view, Art. 17 GDPR is clearly formulated. Problems arise in the practical implementation of the regulation, especially in technical terms. Companies are confronted with the back-up problem, which hardly allows the deletion of individual data records. However, the creation of backups and back-up tapes cannot be dispensed with, as companies are also legally obliged to do so.

What are the consequences of Art. 17 GDPR?

In order to achieve data protection compliance in connection with Art. 17 GDPR, in the future it will be important to document the data processing purposes particularly carefully and to work out viable deletion concepts.