The Right to Erasure: Deletion and the Right to Be Forgotten

When you can require your data deleted, when you cannot, and how delisting from search results actually works.

Article 17 gives you the right to have personal data erased in defined circumstances: where the data is no longer necessary for its purpose, where you withdraw consent and no other basis applies, where you successfully object, where the processing was unlawful, or where a legal obligation requires deletion. It is a right with real teeth and real limits — the popular name right to be forgotten promises more than the law delivers, and knowing the difference is what makes requests succeed.

When erasure applies — and when it does not

The strongest cases: marketing databases after you withdraw consent; accounts and profiles no longer needed after closure; data collected without a lawful basis; and material whose retention period has simply expired. The weakest cases: data an organisation still genuinely needs for the purpose you gave it, records the law obliges it to keep (financial, employment, medical retention duties), and information protected by freedom of expression.

A bank cannot erase your loan history on request; a former employer cannot delete the personnel records employment law requires it to hold. An erasure request that acknowledges the lawful retention and targets what remains — the excess, the expired, the unnecessary — is far harder to refuse than a demand to delete everything.

Search engine delisting

The delisting right established in EU case law obliges search engines, on request, to remove particular results appearing against searches for your name — where the linked information is inadequate, irrelevant or excessive, balanced against public interest. The underlying page is not deleted; what changes is its findability via your name.

Search engines operate formal request processes and grant a substantial share of well-founded applications. Strong candidates: old, resolved matters with no continuing public relevance; inaccurate or seriously outdated material; content about private individuals with no public role. Weak candidates: recent matters of genuine public interest, and information about your professional or public activities. Refusals can be escalated to the Data Protection Commission.

Making the request effectively

Identify the specific data or links, state the Article 17 ground that applies, and address the obvious counter-argument in advance — why retention is no longer necessary, why any public interest has faded. The organisation has the same one-month clock as access requests, extendable for complexity, and must tell you if it refuses and why.

Where data was made public and erasure is granted, the controller must take reasonable steps to inform other controllers processing it — a provision worth invoking expressly where material has spread.

When they refuse

Refusals come in two kinds: reasoned reliance on a genuine exemption, and boilerplate. The first may be right — test it against the actual retention obligations claimed. The second escalates well: a solicitor's letter engaging the specific ground, then a DPC complaint, and where damage flows from unlawful retention or continued publication, a data protection action. Erasure disputes also often travel with defamation and privacy questions when the material is harmful — the remedies work best chosen together.

Frequently asked questions

Can I make a company delete everything it holds about me?

Only what no longer has a lawful basis or purpose. Data genuinely needed for live purposes, or which the law requires the organisation to retain, survives an erasure request. Targeted requests succeed where blanket demands fail.

How do I get something removed from Google searches for my name?

Use the search engine's delisting process, identifying the links and explaining why the content is inadequate, irrelevant or excessive against any public interest. The page itself stays online; it stops surfacing against your name. Refusals can go to the DPC.

Does erasure remove newspaper articles about me?

Rarely — journalism enjoys freedom of expression protections, and the usual realistic remedy is delisting from name searches rather than deletion at source. Where an article is false, defamation law is the separate and often stronger track.

How long does an erasure request take?

The organisation must respond within one month, extendable by up to two further months for complexity — with the extension notified to you within the first month.

What if the data has already been shared with others?

Where a controller has made the data public and must erase it, it is obliged to take reasonable steps to inform other controllers processing it of your request. Invoke this expressly when material has spread.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.