Article 19 — Right to Erasure (right to Be Forgotten) — shared requirements from Articles 17 and 19

Legal Provision

Right to erasure (right to be forgotten): establishes the data subject’s right to request the erasure of personal data under specific conditions.

Applies to entities processing personal data: data controllers.

Duty: the data controller must allow the data subject to request the erasure of their personal data.

Established channels for data subjects to submit erasure requests.
Documented erasure request handling procedures, as well as causes of rejection and delay.
Logs of erasure requests received, and actions executed.
Records of notifications made when data have been erased.

Contextual evaluation to verify whether conditions for erasure are fulfilled (e.g., withdrawal of consent, no overriding legitimate grounds, unlawful processing)
Assessments and documentation of the impact of erasure, particularly in cases involving significant implications for the data subject or third parties.
Balancing tests for erasure requests affecting third-party rights, clearly documenting any exceptions or redactions.
Transparent communication and documentation of reasons for delays or rejections of erasure requests.

Periodic audits and reviews of request handling processes and logs.
Verification of timely, and appropriate execution of erasure requests.
Continuous review and improvement of internal communication and handling protocols for data subject requests.

Fines up to €20 million or 4% of global turnover.
Legal claims and complaints from data subjects
Regulatory scrutiny and potential enforcement actions by supervisory authorities.
Significant reputational harm and potential loss of consumer trust.
Mandatory corrective actions imposed by supervisory authorities.