Thisright is explicitly provided for in Article 17 of the GDPR: “Provided that any of the grounds described by letters (a-f) applies, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”

The Guidelines by the A29 WP^[1] clarify that this right implies not only the right for individuals to obtain erasure of links to web pages containing their personal data, but also their right to object to the processing of their personal data under Article 21 of the GDPR. These Guidelines also note that there is an intrinsic link between the two GDPR rights, because the exercise of the right to object is one of the six grounds for the right to obtain erasure. Controllers have an obligation to erase personal data where: (1) individuals object to the processing of their personal data based on reasons relating to their particular situation under Article 21(1) of the GDPR;and (2) controllers cannot demonstrate that there are compelling legitimate reasons for the data processing, which override those reasons.

^[1]EDPB, Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR, 2 December 2019.