Article 12 — Right to Erasure

1. 1.

   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay, where one of the following grounds applies:

   1. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
   2. The data subject withdraws consent on which the processing is based in accordance with Article 7, and there is no other legal ground for the processing.
   3. The data subject objects to the processing and there are no overriding legitimate grounds for the processing.
   4. The personal data have been unlawfully processed.
   5. The personal data have to be erased for compliance with a legal obligation under the law of the State to which the controller is subject.
   6. The personal data have been collected in relation to the offer of information society services to a minor, as referred to in Article 7, paragraph 7.
2. 2.

   Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers that are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

3. 3.

   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary for:

   1. The exercise of the right of freedom of expression and information.
   2. Compliance with a legal obligation that requires processing by the law of the State to which the controller is subject, or for the performance of a task carried out in the public interest.
   3. Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing.
   4. The establishment, exercise, or defence of legal claims before the courts or administrative bodies of the State or of any other jurisdiction.
4. 4.

   Where erasure is carried out, it shall be complete and irreversible, encompassing all copies, replications, and backups of the personal data within the controller’s systems, except where retention of specific copies is required by law or falls within the exceptions set out in paragraph 3. The controller shall document the erasure, including the date on which it was effected and the scope of data erased.

5. 5.

   The controller shall communicate any erasure of personal data carried out in accordance with paragraph 1 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

6. 6.

   The procedural requirements of Article 10, paragraphs 5 and 6, apply to requests under this Article.