Your Right to Erasure Was Refused
Under UK GDPR Article 17, you have the right to request that a data controller erase your personal data. This right is not absolute — controllers can refuse on specific grounds. If your erasure request is refused, you can escalate to the ICO, apply to the court, or request delisting from search engines.
Quick Answer
UK GDPR Article 17 gives you the right to erasure where data is no longer necessary, you withdraw consent, or processing is unlawful. Controllers can refuse on grounds including freedom of expression, legal obligations, or the public interest. If refused, complain to the ICO or apply to the court for an order. Search engines can be asked separately to delist content from their results.
Full Explanation
The right to erasure (sometimes called the 'right to be forgotten') is set out in UK GDPR Article 17. A data subject may request erasure where: the personal data is no longer necessary for the purpose for which it was collected; consent has been withdrawn and there is no other lawful basis; the data subject objects under Article 21 and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required to comply with a legal obligation.
The right is not absolute. Under Article 17(3) and Schedule 2 Part 5 of the Data Protection Act 2018, controllers can refuse erasure where retention is necessary for: exercising the right of freedom of expression and information; compliance with a legal obligation; reasons of public interest in the area of public health; archiving, research, or statistical purposes in the public interest; or the establishment, exercise, or defence of legal claims.
The journalistic exemption (Schedule 2 Part 5 DPA 2018) is frequently relied upon by media organisations and internet platforms to refuse erasure. This exemption covers processing for journalistic, academic, artistic, and literary purposes where erasure would be incompatible with that purpose. However, the exemption must be applied proportionately — not all processing by a media organisation will qualify.
In NT1 and NT2 v Google LLC [2018] EWHC 799 (QB), the High Court conducted the first detailed UK analysis of the right to be forgotten in the context of search engine results. The court found that NT1's claim failed (the information remained accurate and in the public interest) but NT2's claim succeeded (the information related to spent convictions and there was no sufficient public interest in continued indexing). This case confirmed that the balancing exercise between privacy and freedom of expression is highly fact-specific.
If a controller refuses your erasure request, they must inform you of the reasons and of your right to complain to the ICO and seek a judicial remedy under Article 17(4). You can then complain to the ICO, apply to the court under DPA 2018 s.167 for an order, and/or request delisting from search engines directly (Google, Bing, and others have separate delisting request forms for search results relating to UK data subjects).
Legal Basis
- §UK GDPR Art 17 — right to erasure (right to be forgotten)
- §UK GDPR Art 17(3) — grounds on which controllers may refuse erasure
- §Data Protection Act 2018 Sched 2 Part 5 — journalistic, academic, artistic, literary exemption
- §NT1 and NT2 v Google LLC [2018] EWHC 799 (QB) — right to be forgotten in UK search engine context
- §Data Protection Act 2018 s.167 — court order for compliance
What To Do
Identify the Correct Grounds for Your Erasure Request
Check Article 17(1) UK GDPR to confirm which ground applies to your request (e.g. data no longer necessary, consent withdrawn, processing unlawful). Cite the specific ground in your erasure request — a well-founded request is harder to refuse. Keep a copy of the request and any response.
Send a Formal Letter Requesting Erasure to the Controller's DPO
Write to the controller's Data Protection Officer requesting erasure, citing Article 17 UK GDPR and the specific ground(s) you rely on. Give a 14-day deadline (the controller has one month under Article 12). Send by recorded delivery.
Challenge Any Refusal and Request a Review
If your request is refused, the controller must explain their grounds under Article 17(3). Write back challenging each ground — for example, if the journalistic exemption is claimed, question whether the specific data truly relates to a journalistic purpose. Request a formal review of the decision.
Complain to the ICO
File a complaint with the ICO on ico.org.uk. Provide all correspondence and explain why you believe the refusal is not justified. The ICO can investigate and, if it agrees your rights have been infringed, require the controller to comply.
Submit a Search Engine Delisting Request
Separately from any claim against the original publisher, request delisting of search engine results that display the personal data. Google, Bing, and other search engines have dedicated 'right to be forgotten' request forms for UK/EEA data subjects. Delisting from search results does not erase the data from the original source.
Important Deadlines
Important Warnings
Erasure of data from one controller does not mean the data has been removed from the internet generally — it may still exist on other websites, search engine caches, and archives. You may need to make separate requests to each controller.
The public interest and freedom of expression grounds are widely relied upon by media organisations and public bodies — the threshold for overriding these is high.
The right to erasure does not apply where data is processed for statistical, research, or archiving purposes in the public interest if erasure would seriously impair the achievement of those purposes.