UK Right to Erasure (Right to Be Forgotten)

The UK right to erasure, popularly called the "right to be forgotten", lets you ask an organisation to delete your personal data in defined circumstances under Article 17 of the UK GDPR. It is not an absolute right, and a controller has one calendar month to respond.

For the full UK framework, see our United Kingdom data privacy laws overview.

What the right to erasure actually covers

The right to erasure is set out in Article 17 of the UK GDPR, supplemented by the Data Protection Act 2018. The Information Commissioner's Office (ICO) is clear that this is a qualified right, not a guarantee that any data will be deleted whenever you ask. It only bites when one of the specific Article 17(1) grounds is made out, and even then several exemptions can override it. The right also overlaps with, but is distinct from, the rights to rectification, to restrict processing, and to object. An erasure request does not have to use the words "erasure" or cite Article 17; the ICO treats any clear request to delete personal data as engaging the right, so organisations must recognise informal requests and route them correctly.

Watch out: erasure is about your personal data, not about removing accurate published information from the internet at large. Deleting a record from a controller's files is a different act from removing a result from a search engine, which follows the delisting route discussed below.

The grounds: when you can demand erasure

Article 17(1) lists six grounds, and at least one must apply before a controller is obliged to delete. The data is no longer necessary for the purpose it was collected for; you withdraw consent where consent was the lawful basis and there is no other basis; you object to processing under Article 21 and there are no overriding legitimate grounds (or you object to direct marketing, which is an absolute objection); the data has been unlawfully processed; the data must be erased to comply with a legal obligation; or the data was collected from a child in relation to online services under Article 8. The ICO notes that erasure linked to a withdrawal of consent or a successful objection is the most common route for members of the public.

The exceptions: when a controller can refuse

Article 17(3) sets out the exemptions where the right does not apply even if a ground is made out. A controller can lawfully keep the data where processing is necessary for exercising the right of freedom of expression and information (which the ICO explains covers journalism and academic, artistic and literary purposes); for compliance with a legal obligation, or for the performance of a task carried out in the public interest or in the exercise of official authority; for public-health reasons under Article 9(2)(h)-(i); for archiving in the public interest, scientific or historical research, or statistical purposes, where erasure would seriously impair that work; or for the establishment, exercise or defence of legal claims. The ICO gives the example that a business can refuse to delete records it must keep to comply with financial or other regulations.

Watch out: the freedom-of-expression exemption is why a news organisation can usually decline to delete a lawful, accurate report. A separate question is whether a search engine should still link your name to that report, which is governed by delisting, not by Article 17 erasure against the publisher.

How to make a request and the one-month clock

The ICO confirms you can make a request verbally or in writing, and to any part of the organisation, though putting it in writing creates a clear record. The controller must act without undue delay and respond within one calendar month of receipt. That period can be extended by up to two further months where the request is complex or where you have made a number of requests, provided the controller tells you within the first month and explains why. Erasure is generally free. A controller can charge a reasonable administrative fee, or refuse, only where a request is manifestly unfounded or excessive, for example where it is clearly repetitive or made to harass. Under Article 19, a controller that erases data must also take reasonable steps to tell other recipients it has disclosed the data to, so they can erase it too.

Search-engine delisting: Google Spain and NT1 and NT2

Delisting is the part of the "right to be forgotten" people most often have in mind, and it has its own legal lineage. In Google Spain SL v AEPD and Costeja Gonzalez (C-131/12), decided on 13 May 2014, the Court of Justice of the EU held that a search engine operator is a data controller and can in principle be required to remove links to information about a person from results returned for a search on their name, even where the underlying page stays online. That ruling remains influential in the UK as retained case law.

The first English application came in NT1 and NT2 v Google LLC [2018] EWHC 799 (QB), decided by Mr Justice Warby on 13 April 2018 with the Information Commissioner intervening. Two businessmen, anonymised as NT1 and NT2, asked Google to delist results referring to their past convictions. The court reached opposite results. NT1's claim failed: the judge found he had shown little remorse, had continued in business, and that information about his conviction remained relevant to the public's assessment of his honesty. NT2's claim succeeded and Warby J ordered delisting, finding his conviction information had become out of date and of no sufficient legitimate interest to searchers. The case shows that delisting turns on a fact-specific balance of public interest against privacy, not on the age of the data alone.

If a controller refuses

A controller that declines an erasure request must, under the UK GDPR, tell you why and inform you of your right to complain to the ICO and to seek a judicial remedy. The ICO's guidance for the public advises raising the issue with the organisation first to give it a chance to put things right. If you remain dissatisfied, or the organisation does not respond, you can complain to the ICO, which can investigate and, where appropriate, take regulatory action. The ICO asks that you raise a complaint within three months of your last meaningful contact with the organisation, and provide a copy of your original request and the organisation's response. You also retain the option of court proceedings to enforce your rights or claim compensation for any damage caused, which is the route the claimants used in NT1 and NT2.