Right to erasure

The right to erasure, also known as the "right to be forgotten," gives individuals the legal power to request the deletion of their personal data under certain conditions. Under the GDPR, people can ask organizations to delete their data when it's no longer necessary, unlawfully processed, or when they withdraw consent. This right helps protect privacy and gives people control over their digital footprint.

Legal Basis

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based [...] and where there is no other legal ground for the processing;
(c) the data subject objects to the processing [...] and there are no overriding legitimate grounds for the processing [...]"

— Article 17(1), Regulation (EU) 2016/679 (GDPR)

Why It Matters

The right to erasure is fundamental for anyone whose personal data is collected and processed online, including in political advertising contexts. When political campaigns, advertisers, or platforms use personal data for targeting or ad delivery under Regulation 2024/900, individuals retain their GDPR rights to request deletion of that data.

For providers of political advertising services and publishers, this means implementing processes to respond to erasure requests within one month. Organizations must verify whether the grounds for erasure apply and inform the individual of their decision. If data has been shared with third parties, controllers must take reasonable steps to inform those parties about the erasure request.

However, the right isn't absolute. Organizations can refuse erasure requests when processing is necessary for compliance with legal obligations, for archiving purposes in the public interest, or for the establishment, exercise, or defense of legal claims. Record-keeping obligations under political advertising transparency rules may also limit when data can be deleted.

Key Points

Individuals can request deletion of their personal data when it's no longer necessary, processed unlawfully, or when they withdraw consent
Controllers must respond to erasure requests within one month, extendable by two months for complex requests
The right applies to personal data used in targeting and ad-delivery techniques for political advertising
Exceptions exist for legal compliance, public interest, and legal claims—transparency record-keeping requirements may override erasure requests
Organizations must inform third parties about erasure requests where technically possible and not disproportionately difficult
Refusing an erasure request requires clear justification and informing the data subject of their right to complain to a supervisory authority

Right to erasure vs. Right to restriction

The right to erasure means permanently deleting personal data, while the right to restriction means limiting how data can be used without deleting it. Restriction is appropriate when someone contests data accuracy, objects to processing, or needs the data for legal claims even though the organization no longer needs it. With restriction, the data is stored but not otherwise processed without the person's consent. Erasure is final; restriction is temporary. In political advertising contexts, restriction might apply during an investigation into targeting practices, while erasure would follow once the legal basis for processing ends and no record-keeping obligation applies.

Related Terms

Personal data
Data subject
Legal basis for processing
Consent
Targeting techniques
Data protection authority
Right to restriction
Controller
Processor
Record-keeping obligations

Very transparent. Every political ad will be labelled, linked to a transparency notice with detailed information, and online ads will be searchable in a central European repository.

The Network coordinates election-related cooperation between member states. National contact points for TTPA enforcement should be members of this network where possible.

Election campaigns will need to ensure all paid advertising includes proper labels and transparency notices. Sponsors must be prepared to provide required information to all service providers.

Several major platforms currently do not allow paid political advertising, including some large social networks. This limits where political actors can place paid online advertisements.

The TTPA applies from 10 October 2025. Member States had until 10 April 2025 to designate competent authorities, and the Commission must provide label templates by 10 July 2025.

Publishers must ensure completeness and accuracy of certain information but are not required to verify all sponsor claims. They must correct manifestly erroneous information when they become aware of it.

Yes. When a hosting provider and a website both display an ad, both are considered publishers with responsibility for their specific services. Contracts should clarify how they share compliance duties.

If a publisher removes or disables access to a political ad due to illegality or terms violations, they must still provide access to the transparency information for the full seven-year retention period.