Right to erasure ("right to be forgotten")

The right to erasure, also known as the right to be forgotten, is the right of the data subject to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the grounds in Art. 17(1) GDPR applies: the data are no longer necessary for the purposes; consent is withdrawn and there is no other legal basis; the data subject objects and there are no overriding legitimate grounds; the data have been unlawfully processed; erasure is required by law; or the data were collected from a child in relation to online services. Where the controller has made the data public, it must take reasonable steps to inform other controllers processing the data (Art. 17(2)).

The right is not absolute. Art. 17(3) excludes erasure where processing is necessary for freedom of expression, for compliance with a legal obligation or a task in the public interest, for public health reasons under Art. 9(2)(h) and (i), for archiving, scientific research or statistical purposes where erasure would render impossible or seriously impair the objectives (subject to Art. 89(1) safeguards), or for legal claims. Requests must be answered within one month, and recipients notified under Art. 19.

In clinical research the exceptions usually prevail: a participant who withdraws from a trial can stop further collection, but data already collected must be retained under Art. 58 CTR (25 years) and GCP integrity rules, and safety data cannot be deleted. The EDPB Opinion 3/2019 confirms this analysis, which is one reason why relying on consent as the legal basis for trial data is problematic. Informed consent forms should therefore explain honestly what withdrawal does and does not mean for data, and restriction should be offered as the practical alternative. For apps, marketing databases and recruitment registries, by contrast, erasure requests generally must be honoured.