- DPO's Blog
- Data basics
What is the right to be forgotten?
- 3 minutes
- By Bronwyn McCabe
The ‘right to be forgotten,’ also known as the right to erasure, allows individuals to request for their personal data to be erased. As part of the General Data Protection Regulation (GDPR), the right to be forgotten gives individuals agency over the personal data held on them by organisations.
This is a huge step forward, and gives you the opportunity to have much more control over what companies and advertisers know about you.
The right to be forgotten aploes to almost all organisations and situations, but we'll come onto that.
When does the right to be forgotten apply?
- If your data is no longer necessary for the purpose in which it was originally collected and processed for
- If the organisation is relying on your consent as the lawful basis for processing the data and you withdraw consent
- If the organisation is relying on legitimate interests as the basis for processing data and you object, or there is no overriding legitimate interest to continue processing your data
- If your data is processed for direct marketing purposes and you object
- If your data has been processed unlawfully
- If your data must be deleted to comply with legal ruling or obligation
- If a child’s data has been processed to offer information society services
When does the right to be forgotten not apply? ❌
- If your data is used to exercise the right of freedom of expression and information
- If your data is used to comply with a legal ruling or obligation
- If your data is used to perform a task in the public interest, or when exercising an organisation’s official authority
- If the data is needed for public health purposes and serves in the public interest
- If the data is necessary to perform preventative or occupational medicine (but this only applies when processed by a health professional who is subject to a legal obligation)
- If the data represents important information serving the public interest, scientific research, historical research, or statistical research. The deletion of your data must then be likely to impair or halt progress towards achieving a set goal
- If the data is used for establishment of a legal defence, or in the exercise of other legal claims
- If the request is deemed ‘manifestly unfounded’ or ‘excessive’
- This is assessed on a case by case basis. Provided the request isn’t submitted to cause disruption to or elicit money from an organisation, it is unlikely to be ‘manifestly unfounded’ or ‘excessive’
What kind of data does this include?
So long as your request complies with the guidelines, you can request whatever personal data you like to be erased! Make sure to describe in detail precisely what you would like deleted and include URLs if applicable.
Also, if other organisations have had access to the data in question or if it has been made public (social media, for example) they must be informed by the organisation you’ve requested that your data has been erased. This includes backup data, too. If it isn’t possible to absolutely remove the data from all backup systems, it must be untouched until it is overwritten, and can’t be processed for any use or reason.
How can I ask?
You can make the request writing, and there is a a right to erasure request template that you can use. However, the best way to send requests like these is through Rightly.
We're biased, we know, but we're also right. You can send multiple deletion requests quickly and easily, and manage them from one central place, for free.
How long does it take?
Organisations must respond within 30 days. They normally take less time than that, but we'll keep you updated along the way if you've sent your request through Rightly. If you have any questions or concerns, please get in touch with our support team.
Final thoughts 💡
The right to be forgotten allows you to ask for your personal data to be deleted. Unless your data is being used in the public interest, such as for medical reasons, or you are legally obliged to share it, you can probably send off a right to be forgotten request successfully, but make sure to ask us if you're unsure.
If there is personal data held on you that you don’t feel comfortable with, you have the option to erase it. It is illegal for organisations to refuse this, unless they can prove otherwise.
If this sounds like something you'd like to try, you can send your first request below!
How your mental health data and information is sold to advertisers
- Key issues
Our mental health data, for many of us the most personal, is regularly shared with advertisers and data brokers.
- 8 minutes
Personal data explained: types, protection and deletion.
- DPO's Blog
- Data basics
Legally ⚖️ , 'personal data' is any information that allows a living person to be directly, or indirectly, identified.
- 5 minutes