What Is the Right to Erasure?
TL;DR
The right to erasure, often called the right to be forgotten, is the GDPR Article 17 right to have personal data deleted. It applies on six specific grounds rather than on request alone, and the one that arises most in outreach is that the data is no longer necessary for the purpose it was collected for.
When does the right to erasure apply?
Article 17(1) lists six grounds, and a request has to rest on one of them. Three concern the data itself: it is no longer necessary for the purpose it was collected for, it has been processed unlawfully, or erasure is required to comply with a legal obligation. The other three are a withdrawn consent with no other lawful basis available, an objection under Article 21(1) where no overriding legitimate grounds remain or an objection to direct marketing under Article 21(2), and data collected from a child in connection with information society services.
The direct marketing ground is the one that needs no argument. An objection under Article 21(2) is absolute, so once someone objects to marketing there is no balancing exercise and no overriding interest to weigh against it. The deadline is the same one month Article 12(3) sets for other requests.
When can a request be refused?
Article 17(3) sets out five places where the right yields. Processing that remains necessary for freedom of expression and information, for compliance with a legal obligation or a task carried out in the public interest, or for reasons of public health is not caught by it. Nor is processing for archiving, research or statistical purposes where erasure would seriously impair those purposes, or processing needed to establish, exercise or defend legal claims.
Refusing still requires a reply within the month, explaining the ground relied on and the right to complain to a supervisory authority. Silence is a breach even where the refusal itself would have been sound.
How does erasure square with a suppression list?
There is a real tension here. Delete a contact completely and nothing stops the same address being imported again next quarter from the same source, so the person who asked to be left alone gets contacted again. Keeping a minimal record of the address for the sole purpose of never contacting it again is the usual way this is resolved, and it is generally treated as serving the request rather than defeating it.
Minimal is the operative word: enough to match and block, not a retained profile with the original enrichment attached. Whether a given suppression record is proportionate in your circumstances is a call for counsel, and the point worth taking from a definition is that a hard delete with no record is not automatically the safer option.
Frequently asked questions
No. It applies on the six grounds in Article 17(1) and gives way to the exemptions in Article 17(3). The right that is absolute is the neighbouring one: an Article 21(2) objection to direct marketing stops that processing outright, with no balancing test available.