Data Protection and the Right to Erasure under the UK GDPR

The right to erasure under Article 17 of the UK General Data Protection Regulation (UK GDPR) is best understood not as an absolute entitlement but as a conditional right that must be balanced against a series of competing interests, including freedom of expression, the public interest, and the legitimate purposes of data controllers.¹ The tension between privacy and the free flow of information has been most clearly articulated in the foundational decision of the Court of Justice of the European Union in Google Spain SL v AEPD, which established the doctrine of the 'right to be forgotten' and which continues to shape the interpretation of Article 17 in the domestic courts.²

In Google Spain, the Court held that a data subject may require a search engine operator to remove links to information that is inaccurate, inadequate, irrelevant, or excessive, even where the information is otherwise lawfully available at its original source.³ The significance of this ruling lies not merely in its outcome but in the analytical framework it established: the right to erasure requires a case-by-case balancing exercise in which neither privacy nor free expression enjoys categorical precedence. This approach was subsequently adopted in English law, as demonstrated in NT1 and NT2 v Google LLC, where Warby J conducted a detailed analysis of the competing interests in two separate claims and reached different conclusions in each case, reflecting the inherently contextual nature of the balancing exercise.⁴

The limits of the right are defined by the exceptions contained in Article 17(3) of the UK GDPR. These exceptions include the exercise of the right of freedom of expression and information, compliance with a legal obligation, and the establishment, exercise, or defence of legal claims.⁵ These exceptions are drafted broadly, and their application has generated considerable uncertainty in practice. Critics have argued that the freedom of expression exception in particular may swallow the right itself in any context where information has entered the public domain and retains residual journalistic or historical interest.⁶

A further complication arises from the distinction between the right to erasure from a search engine index and the right to erasure from the original source. As the Google Spain framework makes clear, the right operates differently in these two contexts: removal from a search index de-amplifies information without eliminating it, while erasure from the original source removes it entirely. The former is a proportionate restriction; the latter raises greater concerns about historical integrity and the completeness of the public record.

In conclusion, the right to erasure under Article 17 UK GDPR represents a meaningful but qualified privacy right whose practical scope is determined by the outcome of a contextual balancing exercise. The domestic case law demonstrates that courts are willing to uphold erasure claims in appropriate circumstances, but the breadth of the statutory exceptions ensures that the right cannot be exercised as a general veto over information that subjects find uncomfortable or embarrassing.