In short. GDPR Article 17 provides a conditional right to erase personal data, with search delisting assessed separately from removal of the source page.
Definition: Article 17 of the General Data Protection Regulation (GDPR) gives a person the right to obtain erasure of personal data concerning them without undue delay when a listed ground applies, subject to exceptions. In search, this right can require removing links from results for searches based on the person's name.
Key facts
- CNIL's reproduction of Article 17 lists grounds including data no longer needed for its purpose and unlawful processing.
- Under Article 4, personal data concerns an identified or identifiable natural person.
- The European Data Protection Board (EDPB)'s Guidelines 5/2019, adopted on 7 July 2020, explain that name-based delisting leaves the source page accessible.
- The Court of Justice of the European Union (CJEU)'s summary of Case C-507/17, dated 24 September 2019, explains the EU-wide scope of delisting required under EU law.
When does Article 17 apply?
A controller is the person or organisation determining the purposes and means of processing personal data, as defined in CNIL's text of Article 4.
Article 17(1) requires erasure when data is no longer necessary for the purposes for which it was collected or otherwise processed. Other grounds cover withdrawal of consent where no other legal ground remains, a qualifying objection, unlawful processing, a legal obligation to erase, and collection in connection with online services offered to a child under Article 8(1).
The relevant provisions are:
GDPR Article 17(1): grounds for erasure
GDPR Article 17(2): publicly disclosed personal data
GDPR Article 17(3): exceptions
For an objection under Article 21(1), the controller can continue processing if it demonstrates overriding compelling legitimate grounds or grounds relating to legal claims. Article 17(1)(c) also covers objections to direct marketing under Article 21(2).
What does erasure change in search?
Delisting means removing a link from specified search results. The EDPB guidelines distinguish processing by a search engine from processing by the website publisher. Ordinary name-based delisting leaves the source page online and the data in the engine's index and cache; other search criteria can still return the content. The guidelines also recognise exceptional cases requiring full erasure from indexes or caches.
Territorial scope is another limit. In its summary of Case C-507/17, the CJEU explains that EU law requires delisting across versions corresponding to all Member States, with effective measures preventing or seriously discouraging access from those states through other versions. EU law imposes no general obligation to delist worldwide. National authorities can order worldwide delisting after balancing the relevant rights under national protection standards.
Which exceptions matter for search?
Article 17(3) preserves processing necessary for freedom of expression and information, legal obligations or public tasks, specified public-health interests, qualifying archiving or research and statistical purposes, and legal claims. The archiving, research and statistical exception includes conditions concerning serious impairment of the processing objectives.
The EDPB guidelines explain the search-specific balance: relevant factors include the information's nature and sensitivity, public interest in access, and the person's role in public life. A publisher's justification for retaining an article and a search engine's justification for returning it in name searches require separate assessment.
How must a controller handle a request?
Article 12, reproduced by CNIL, requires information about action taken without undue delay and within one month of receipt. Complexity and the number of requests can justify two further months; the controller must explain the extension within the initial month. A refusal requires reasons and information about supervisory complaints and judicial remedies within one month.
Under Article 17(2), a controller that made data public and must erase it takes reasonable steps, considering technology and cost, to inform other controllers processing it about the request concerning links, copies or replications. Article 19 separately requires notification to recipients of erased data unless impossible or disproportionate.
Related terms
- GDPR right to object
- GDPR right to rectification
- Is the right to erasure absolute for search results?
- GDPR lawful basis for web data
FAQ
Does delisting delete the original article?
Under the EDPB guidelines, the article remains under the publisher's control and may remain publicly accessible after name-based delisting.
Can you request erasure if processing is unlawful?
Yes. Article 17(1)(d) expressly includes unlawful processing as a ground for erasure, subject to the Article 17(3) exceptions.
Is worldwide delisting automatic?
The CJEU's summary of Case C-507/17 states that EU law requires EU-wide protection; worldwide orders depend on the further balancing described in that ruling.
Sources
- CNIL, "CHAPITRE III - Droits de la personne concernée", 23 May 2016
- CNIL, "CHAPITRE I - Dispositions générales", 23 May 2016
- EDPB, "Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)", 7 July 2020
- CJEU, "Judgment in Case C-507/17", press release, 24 September 2019
Check how a page reads to answer engines. Open the GEO score analyzer