What is GDPR Article 17?
GDPR Article 17 is the right to erasure, commonly called the right to be forgotten. It lets a person ask an organisation holding personal data about them to delete it, and it obliges that organisation to comply when one of six listed grounds applies and none of five listed exemptions does. It binds data controllers under European and United Kingdom data protection law. It is not a general right to have things removed from the internet, it is not enforceable by an American against an American publisher, and it does not override journalism.
What the right to erasure actually says
Article 17(1) gives a data subject the right to obtain erasure of personal data concerning them without undue delay, and it puts a matching obligation on the controller. The right is conditional. It exists where one of six grounds is met, and it yields where one of five exemptions applies. Everything difficult about Article 17 lives in that structure. The full provision is short enough to read in one sitting at Article 17 of the GDPR, the right to erasure.
The six lawful grounds in Article 17(1)
Erasure is owed where the personal data are no longer necessary for the purposes they were collected for; where you withdraw the consent the processing relied on and there is no other legal basis; where you object under Article 21 and there is no overriding legitimate ground; where the data have been processed unlawfully; where erasure is required to comply with a legal obligation; or where the data were collected in connection with information society services offered to a child.
Notice what is absent. There is no ground for embarrassment, and none for mere age. Age and relevance do matter, but they matter through the first ground, by undermining the claim that the data are still necessary for the purpose they were collected for.
Controller obligations when the data were made public
Article 17(2) adds a duty that is easy to miss and often the most useful part of a request. Where the controller has made the personal data public and is then obliged to erase it, it must take reasonable steps, including technical measures, to inform other controllers that you have requested erasure of any links to, or copies or replications of, that data. In practice that means a controller who syndicated your data cannot simply delete its own copy and call the matter closed.
The exemptions in Article 17(3)
The right does not apply to the extent processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation or a task in the public interest; for reasons of public interest in public health; for archiving in the public interest, scientific or historical research, or statistics; or for the establishment, exercise or defence of legal claims.
The first exemption is the one that decides most reputation cases. Journalism sits inside freedom of expression and information, which is why Article 17 is not a route to unpublish a news article, and why requests about court reporting, regulatory findings and public roles are refused far more often than requests about stale personal details.
How erasure differs from search delisting
These two are constantly conflated and they are not the same instrument.
| Erasure under Article 17 | Delisting from search |
|---|---|
| Aimed at the controller holding the data | Aimed at the search engine |
| The data itself is deleted | Only the search listing is removed |
| The source page can be the target | The source page stays live |
| Grounds and exemptions in the regulation | Balanced against public interest by the search engine |
| Applies wherever the controller is bound | Applied to European versions and by geolocation, not worldwide |
Search delisting is the more common request because it is faster, but it is also weaker: the page is still there and still reachable by any other route. Google publishes running figures on what it receives and grants in its transparency report on European privacy delisting requests, which is a useful reality check before you assume a request will succeed. The mechanics of making one are covered on our page about how to request the right to be forgotten.
GDPR Article 17 binds controllers, not the internet
The obligation falls on controllers subject to the GDPR: organisations established in the European Union, and organisations outside it that offer goods or services to people in the EU or monitor their behaviour. The United Kingdom retained an equivalent right after leaving the EU, in the UK GDPR read with the Data Protection Act 2018, administered by the Information Commissioner's Office.
An American company with no European establishment, no European customers and no monitoring of European users is generally outside that scope. Sending it an Article 17 request is not wrong, but it is a courtesy request rather than a legal demand, and it will often be treated as one.
Why this is not an American right
The United States has no federal equivalent. The constitutional position runs the other way: publishing true information lawfully obtained is strongly protected, and a general power to compel deletion of accurate published material would collide with the First Amendment directly. The First Amendment Encyclopedia sets out why the right to be forgotten has not travelled into American law, and the reasoning is worth understanding rather than working around.
What Americans do have is narrower and more specific: state privacy statutes that let you ask a business to delete data it holds about you, data broker deletion mechanisms, and search engine policies that remove certain categories of personal information from results. Those are covered on our page about the right to be forgotten in the US. None of them reaches a publisher.
If you are unsure which framework your situation actually sits under, that is the sort of thing a reputation audit resolves before anyone spends money on a request that was never going to apply.
This page is not legal advice. Article 17 is the primary source, linked above in full, and a national data protection authority is the right place to take a request that a controller has refused.
Questions about gdpr article 17: the right to erasure
What is GDPR Article 17?
It is the right to erasure. A person can ask an organisation holding personal data about them to delete it, and the organisation must comply where one of six grounds applies and none of five exemptions does.
When does the right to erasure apply?
When the data are no longer necessary for their original purpose, when consent is withdrawn and no other basis exists, when an objection under Article 21 is not overridden, when processing was unlawful, when a legal obligation requires erasure, or when the data were collected from a child through an online service.
Does GDPR Article 17 apply in the United States?
Only to organisations that fall within the GDPR's territorial scope, meaning those established in the EU or offering goods and services to, or monitoring, people in the EU. There is no general American right to erasure.
Can Article 17 remove a news article?
Generally no. Article 17(3)(a) disapplies the right where processing is necessary for exercising freedom of expression and information, which is where journalism sits.