The right to erasure, or the "right to be forgotten," is not an absolute right and is subject to specific exemptions. A primary exemption occurs when the continued processing of personal data is necessary for an organization to comply with a legal obligation. For instance, laws related to taxation, anti-money laundering, or specific industry regulations may require an organization to retain data for a prescribed period. In such cases, the legal requirement to hold the data supersedes the individual's request for deletion, and the organization can lawfully reject the erasure request for the duration of the legal retention period.

A. An outdated original purpose.

Processing for an outdated purpose is a reason to grant an erasure request, as it violates the principle of storage limitation.

C. The offer of information society services.

This is a lawful basis for processing data, particularly for children, but it does not create an exemption from the right to erasure.

D. The establishment of personal legal claims.

The exemption applies to the controller's need to establish, exercise, or defend legal claims, not ambiguously "personal" ones, which could imply the data subject's.

---

1. General Data Protection Regulation (EU) 2016/679 (GDPR): Article 17(3)(b) explicitly states that the right to erasure shall not apply to the extent that processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

2. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (2nd ed.). IAPP. In Chapter 5

"Data Subject Rights

" the text details the exceptions to the right of erasure

highlighting that a request can be denied if the data is required "for compliance with a legal obligation."

3. Information Commissioner's Office (UK). (2023). Guide to the UK General Data Protection Regulation (UK GDPR): Right to erasure. In the section "When can we refuse to comply with a request for erasure?"

the guidance lists as the first exemption: "We need to process the data to comply with a legal obligation."