Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?

The General Data Protection Regulation (GDPR) in Article 17(1)(a) explicitly states that a data subject has the right to obtain the erasure of their personal data when "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed." This directly supports the principle of purpose limitation, a fundamental concept in data protection law. Once the original, specified, and legitimate purpose for processing has been fulfilled and there is no other legal basis for retention, the data must be erased upon the data subject's request.

A. The status of the data subject as a public authority is not a condition for exercising the right to erasure; this right applies to all natural persons.
B. Public interest is cited in Article 17(3) as a reason to refuse an erasure request, for example, for archiving or public health purposes.
C. Processing by automated means is a key condition for the right to data portability under Article 20, not the right to erasure under Article 17.

1. Regulation (EU) 2016/679 (General Data Protection Regulation)

Official Journal of the European Union

L 119/1.

Article 17(1)(a): "The data subject shall have the right to obtain from the controller the erasure of personal data... where... the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed".

Article 17(3)(b) & (d): Lists exceptions to the right of erasure

including processing necessary "for the performance of a task carried out in the public interest" and "for archiving purposes in the public interest".

Article 20(1)(b): Specifies that the right to data portability applies when "the processing is carried out by automated means."

2. European Data Protection Board (EDPB). (2020). Guidelines 05/2020 on the right to data portability under the GDPR.

Section II.A

Paragraph 11: This document clarifies that one of the cumulative conditions for the right to data portability is that "the processing is carried out by automated means

" distinguishing it from the grounds for other rights like erasure.

3. Voigt

P.

& von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter on "Article 17 Right to erasure (‘right to be forgotten’)"

Page 203: The text explains that the primary ground for erasure is when the purpose for which the data was collected no longer exists

directly referencing Article 17(1)(a).