GDPR & Right to Erasure: Using Data Protection Law to Remove Content

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 provide powerful tools for removing personal information published online — including defamatory content. The right to erasure (Article 17) can be used alongside or instead of a defamation claim to force the removal of damaging content. This guide explains how.

What Is the Right to Erasure?

The right to erasure — commonly called the "right to be forgotten" — entitles individuals to request the deletion of their personal data in certain circumstances. Under Article 17 of UK GDPR, you can request erasure where:

• The personal data is no longer necessary for the purpose it was collected
• You withdraw consent (where consent was the legal basis for processing)
• You object to processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed
• The personal data must be erased to comply with a legal obligation

Using the Right to Erasure for Defamatory Content

When defamatory or false information about you is published online, data protection law provides an additional route for removal that does not require you to prove all the elements of a defamation claim. The key argument is that the processing of your personal data (the publication of false information about you) is unlawful because it is inaccurate and causes damage to your rights and interests.

This approach is particularly useful when:

• The publisher is anonymous and you cannot identify them for a defamation claim
• The content is hosted by a data controller (e.g., a website operator) who can be compelled to act
• The limitation period for defamation (1 year) has expired, but the 6-year data protection limitation period has not
• You want to avoid the cost and publicity of defamation proceedings

Right to Erasure vs Search Engine De-Listing

The CJEU's landmark decision in Google Spain v AEPD [2014] established that search engines are data controllers and must consider requests to de-list search results that are inadequate, irrelevant, or excessive. Under UK law post-Brexit, the same principle applies through the UK GDPR.

De-listing requests to Google and other search engines are distinct from erasure requests to the original publisher:

• De-listing — the content remains published but is no longer findable through the search engine for name-based searches
• Erasure — the content itself is deleted by the publisher

In practice, pursuing both routes simultaneously provides the most comprehensive protection.

How to Make an Erasure Request

1. Identify the data controller — this is usually the website operator, not the hosting provider. Check the website's privacy policy for contact details.
2. Submit a written request — clearly identify the data you want erased, the URL where it appears, and the legal basis for erasure (e.g., unlawful processing, inaccuracy).
3. Allow one month for response — the data controller has one calendar month to respond. This can be extended by two months in complex cases.
4. Complain to the ICO — if the data controller refuses or fails to respond, you can complain to the Information Commissioner's Office.
5. Court proceedings — you can also apply directly to court for an order compelling erasure under section 167 of the Data Protection Act 2018.

Exemptions and Limitations

The right to erasure is not absolute. Article 17(3) provides exemptions for processing that is necessary for:

• Exercising the right of freedom of expression and information
• Compliance with a legal obligation
• Reasons of public interest in the area of public health
• Archiving purposes in the public interest, scientific or historical research, or statistical purposes
• The establishment, exercise, or defence of legal claims

The journalism exemption is often raised by publishers. However, false or defamatory content is unlikely to qualify as legitimate journalism deserving of Article 10 protection.

GDPR Compensation Claims

Where personal data has been processed unlawfully — including the publication of false or private information — you may also be entitled to compensation under Article 82 of UK GDPR for both material damage (financial loss) and non-material damage (distress). This is an additional remedy that can be pursued alongside erasure.

Related Reading

Privacy Claims Hub | How to Remove Defamatory Content | Misuse of Private Information