The GDPR allows individuals to request that their information be deleted in the following situations:[1]

• Companies must delete data upon request if the data was processed based solely on consent. The GDPR recognizes that companies may process data based on six alternate lawful grounds.[2] One of these is where a person has given consent to the processing for a specific purpose.[3] If a company’s sole basis for processing data to train an AI is the consent of individuals, the company is typically required to honor an erasure request, which might for all practical purposes be viewed as a revocation of that consent. Conversely, if processing is based on an additional permissible purpose, an erasure request does not necessarily have to be granted.

• Companies must delete data upon request if the data was processed based upon the controller’s legitimate interest, and that interest is outweighed by the individual’s rights. One of the other grounds upon which a company can process data is to further the company’s “legitimate interest.” When training an AI is based upon a company’s legitimate interest, an individual has a right to request erasure unless the interest of a controller or a third party is demonstrably “overriding.”[4]

• Companies must delete data upon request if data is being processed unlawfully. The GDPR states that an erasure request must be honored if the processing of personal information is (or has become) unlawful.[5] Here, too, the obligation to honor an erasure request may be redundant of other obligations within the GDPR. Put differently, if a company is complying with the other requirements of the GDPR its processing would presumably be lawful and there may be few, if any, situations in which a “right to be forgotten” request would require that the company take any additional actions. Framing this as an individual’s right, however, opens up an additional source of civil liability for the company towards the individual.

• Companies must delete data upon request if erasure is already required by law. The GDPR states that a “right to be forgotten” request must be honored if the data is required to “be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.”[6] This requirement also appears redundant to other legal obligations. If a company is required to erase data pursuant to another Member State law and is complying with that requirement, there may be few, if any, situations in which additional action would be necessitated by a “right to be forgotten” request.

• Companies must delete data upon request if it is collected from a child as part of offering an information society service. The GDPR requires the deletion of information when requested where the information was “collected in relation to the offer of information society services” to children under 16.[7]

In the context of AI, some supervisory authorities have suggested that if a company uses publicly sourced data to train an AI (e.g., data scraped from the internet), the only plausible lawful purpose would be either (1) the consent of the individuals whose personal information is being provided or (2) the legitimate interest of the controller.[8] As discussed above, if processing is based either on consent or on legitimate interest then individuals must be given a right to request that their information be deleted.

It should be noted that information does not always need to be deleted simply because an erasure request has been made. For example, a company can choose to decline an erasure request if honoring it would interfere with a legal obligation imposed on the company to maintain the data, or if the data is needed to establish, exercise, or defend a legal claim.[9]

[1] Requests for deletion are referred to interchangeably as “deletion requests” and “erasure requests.”

[2] GDPR, Article 6(1)(a)-(f).

[3] GDPR, Article 6(1)(a).

[4] GDPR, Article 17(1)(c).

[5] GDPR, Article 17(1)(d).

[6] GDPR, Article 17(1)(e).

[7] GDPR, Article 17(1)(f); Article 8(1).

[8] Garante Per La Protezione Dei Dati Personali, Provision of April 11, 2023[9874702] (English translation).

[9] GDPR, Article 17(3)(b), (e).