Article 17 GDPR : The Right to Erasure and Lawful Exceptions
Article 17 GDPR establishes the right to erasure ('right to be forgotten') based on 6 strict legal grounds (data no longer necessary, consent withdrawn, objection, unlawful processing, legal obligation, child consent) and 5 public-interest exceptions. Case C-199/24 confirms commercial publication of criminal records does not automatically qualify for journalistic exemption.
The 6 Lawful Grounds for Erasure (Art. 17.1 GDPR)
The controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- The data subject withdraws consent on which the processing is based (Art. 6.1.a or 9.2.a) and there is no other legal ground for the processing;
- The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds, or objects to direct marketing (Art. 21.2);
- The personal data have been unlawfully processed;
- The personal data have to be erased for compliance with a legal obligation in Union or Member State law;
- The personal data have been collected in relation to the offer of information society services directly to a child (Art. 8.1).
Case Law Update: CJEU C-199/24 Legal Newsdesk Sweden
The Legal Newsdesk Sweden ruling affirms that the reconciliation between erasure and freedom of expression cannot simply be presumed for commercial database publishing of criminal court decisions. Qualification as processing for journalistic purposes depends on concrete characteristics, including genuine editorial processing and factual verification.
Where such commercial activity does not fall under the Article 85 exemption, all standard GDPR safeguards and remedies remain applicable. An erasure request must nevertheless be assessed in light of the specific processing regime and Article 17 conditions; the judgment does not create an automatic right to erasure.
Statutory Exemptions and Grounds for Refusal (Art. 17.3 GDPR)
The right to erasure is not absolute. Article 17(3) provides 5 strict exceptions where a request for erasure must lawfully be refused:
- For exercising the right of freedom of expression and information;
- For compliance with a legal obligation under Union or Member State law (e.g., statutory accounting or tax retention duties);
- For reasons of public interest in the area of public health (Art. 9.2.h/i);
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Art. 89);
- For the establishment, exercise or defence of legal claims.
Verified Official Sources
General Data Protection Regulation — EU Reference Legal Framework
Consult official source →Transparence (Art. 12, 13, 14), langage clair, information par couches
Consult official source →Mise à disposition en ligne, contre rémunération, de décisions relatives à des condamnations pénales : cette activité ne relève pas, en principe, de fins journalistiques (Art. 85) ; les voies de recours prévues par le RGPD demeurent applicables (Art. 77 à 82).
Consult official source →See Also in the Legal Framework
Article 15 GDPR : Modalities of the Right of Access and Delivery of Data Copy
Legal framework of Article 15 GDPR and EDPB Guidelines 01/2022: scope of access rights, free first copy of data, specifi...
Article 6 GDPR: The Six Lawful Grounds for Lawful Processing
Legal analysis of Article 6 GDPR: the six alternative legal bases for lawfulness of processing, valid consent criteria, ...
Article 18 GDPR : Restricting Processing Pending Verification of Rights
The four statutory cases for restriction of processing under Article 18 GDPR, technical freezing of restricted data, lif...
Article 10 GDPR : Criminal Data, Statutory Safeguards and Legal Newsdesk Sweden Ruling
Regime of Article 10 GDPR applicable to criminal convictions, offences and security measures: legal basis, safeguards an...
CJEU C-199/24 Legal Newsdesk Sweden: Criminal Convictions Data and Article 85 GDPR
CJEU judgment of 9 July 2026 (ECLI:EU:C:2026:564): commercial publication of criminal conviction records does not fall, ...