Editorial explainer · official sourcesmedium
The right to be forgotten: what GDPR Article 17 actually erases
The "right to be forgotten" is among the most invoked and most misunderstood parts of the GDPR. It sits in Article 17 as the right to erasure, with a case-law history starting at the Court of Justice of the EU in 2014. But it is not a switch that makes the past disappear: it is a conditional right, with precise prerequisites and just as many exceptions, to be balanced against freedom of information and other legal obligations. An explainer on what you can actually ask, from whom, and where the right stops.
A precise right, not an eraser
"Right to be forgotten" is a catchy phrase and, for that reason, a misleading one: it suggests anyone can make what concerns them disappear. The legal reality is narrower and more interesting. The right lives in Article 17 of the GDPR as the right to erasure, and it provides that a data subject can obtain from the controller the removal of their personal data in a set of defined cases: when the data are no longer necessary for the purposes for which they were collected, when consent is withdrawn and there is no other legal basis, when one objects legitimately to the processing, or when the data were processed unlawfully.
The root predates the regulation. In 2014, in the Google Spain judgment (case C-131/12), the Court of Justice of the EU held that a search-engine operator processes personal data and that, under certain conditions, a person may request the removal of specific results associated with their name. Not the deletion of the story at source: de-indexing, meaning that the result no longer appears when searching that name. It is a distinction at the heart of the whole subject.
- 01Article 17 prerequisitedata no longer needed, consent withdrawn, unlawful processing
- 02Request to the controllerthe data subject exercises the right to erasure
- 03Balancingthe controller weighs exceptions and third-party rights
Where the right stops
Article 17 is not absolute, and this is where almost all the misunderstandings dissolve. The article itself lists the exceptions: the right to erasure does not apply where processing is necessary for exercising freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in public health, for archiving, research or statistical purposes, or for the establishment, exercise or defence of legal claims. Translated: a piece of journalism in the public interest, or data the law requires to be kept, is not erased on request.
The territorial reach also has a limit, set by the Court of Justice in 2019 in the Google v CNIL judgment (case C-507/17): a search-engine operator is required to de-index on the versions of the engine corresponding to the Member States, not on all versions worldwide. European law stops, in principle, at the Union's borders.
How to exercise it, without illusions
In practice, the right is exercised by making a request to the controller — the company or body holding the data, or the search engine for de-indexing. The controller must respond without undue delay and, as a rule, within one month, assessing whether one of Article 17's prerequisites applies and whether one of the exceptions prevails. If the answer does not satisfy, there remain the complaint to the supervisory authority — in Italy the Garante for the protection of personal data — and judicial redress.
It should be said clearly, because it is the source of most disappointments: de-indexing from a search engine is not the same as deleting the content from the site that hosts it, which stays online and reachable by other routes. And every request entails a balancing between protecting the person and the public's interest in being informed: it is not automatic, it is a case-by-case assessment. Understood this way, the right to be forgotten is no less powerful — it is simply a real tool, with real prerequisites and limits, and using it well means knowing in advance what it can and cannot do.
