Right to erasure (right to be forgotten)
Also known as: right to be forgotten, right to erasure, right to delete, de-indexing, de-listing, RTBF
The right to erasure, often called the right to be forgotten, lets individuals ask organizations to delete their personal data in certain circumstances, such as when it's no longer needed or consent is withdrawn.
It also covers asking search engines to remove links to outdated or harmful information. While it's sometimes described as erasing your past, it's actually a limited right that must be balanced against free expression, legal obligations, and the public interest.
Right to erasure (right to be forgotten), explained at three levels
At home
Think of the right to erasure as asking a company to shred your file once it no longer has a good reason to keep it. If the data isn't needed anymore, you withdraw consent, or it was used unlawfully, you can ask for deletion. A related right lets you ask search engines to stop showing links to outdated or harmful information when someone searches your name.
At work
The right to erasure, in GDPR Article 17, lets individuals require an organization to delete their personal data in defined cases, such as when it is no longer needed, consent is withdrawn, or processing was unlawful. Similar rights exist in Quebec's Law 25 and many US state laws. Businesses care because they must find and delete data across systems, tell recipients, and document what they kept and why.
At home
Erasure works as a set of triggers and exceptions. Triggers include data no longer being needed, withdrawn consent, a successful objection, or unlawful processing. Exceptions let an organization keep data for freedom of expression, a legal obligation such as tax records, public health, research, or defending legal claims. Search engine de-listing removes a link from the results for your name, but the original page, like a news article, usually stays online.
At work
A deletion request has to follow the data. Copies may sit in production databases, analytics tools, backups, logs, and processors' systems, and the controller must instruct processors to delete their copies too. Many organizations keep a minimal 'suppression list' so a deleted customer isn't re-added from an old marketing list, which is acceptable because it serves the person's own request. Retention schedules reduce the load, since data deleted on time never becomes an erasure problem.
At home
Search engine de-listing is a balancing act. The search engine weighs your privacy against the public's interest in finding the information, considering your role in public life, the nature of the information, how old it is, and whether it's accurate. Since 2019, de-listing generally applies to EU versions of search results, not worldwide. In my opinion, it's an imperfect balance but a reasonable one, since a stranger's decade-old debt shouldn't define them forever.
At work
Technically, erasure is harder than it sounds. Immutable backups, data lakes, machine learning training sets, and distributed replicas all keep copies. Common approaches include crypto-shredding, where deleting a per-person encryption key makes the data unreadable, backup expiry cycles, and documented timelines for deletion to propagate. Regulators generally accept that backups age out on schedule if the data is put beyond use, meaning it isn't restored or accessed in the meantime.
Real-world examples
At home
Carlos, who had a minor legal dispute ten years earlier, found that an old local news article still appeared when people searched his name. He submitted a de-listing request to the search engine, which agreed the information was outdated and removed the link from results in the EU.
At work
Fatima manages data operations at a Toronto e-commerce company. When a former customer asked for her data to be deleted, Fatima's team removed it from the CRM and marketing tools, asked its email provider to delete it, and added the address to a suppression list so it wouldn't be re-imported.
Common confusions
- The right to be forgotten deletes information from the internet. — It usually removes search links or deletes data held by a specific organization. The original content, like a news article, often stays online.
- Companies must delete your data whenever you ask. — Erasure applies in specific cases. Companies can keep data for legal obligations, legal claims, or certain public interest reasons.
- De-listing applies worldwide. — The EU's top court ruled in 2019 that de-listing generally applies within the EU, not globally.
For analysts
The cheapest way to handle erasure requests is to keep less data. I'd push for clear retention schedules and automatic deletion, because every record you don't need is a future request you won't have to process.
History & origin
The modern right began with a 2014 case. Mario Costeja González, a Spanish lawyer, wanted Google to remove links to a 1998 newspaper notice about his debts. In May 2014, the Court of Justice of the European Union ruled that search engines could be required to de-list results that were 'inadequate, irrelevant or no longer relevant.' GDPR codified the right to erasure in Article 17 in 2018. In 2019, the same court ruled that Google wasn't required to de-list results globally, only within the EU. In Canada, Quebec's Law 25 introduced a de-indexation right in 2023, and the Federal Court of Appeal confirmed in 2023 that PIPEDA applies to Google's search engine. In my view, the right to be forgotten is one of the few privacy rights that genuinely changes how the internet treats ordinary people.