Right to Erasure ('Right to be Forgotten')

Right to Erasure ('Right to be Forgotten') and Implementation

The "Right to be Forgotten" (Right to Erasure) is one of the most important principles of personal data protection, giving citizens the power to demand the destruction of their data. The Law of Georgia "On Personal Data Protection" (Article 22) obliges companies to delete or destroy data if it is no longer necessary for the purpose, if the subject withdrew consent, or if the data was processed illegally. However, this right is not absolute. Companies often have legitimate grounds (e.g., legal obligations, litigation) to refuse deletion. Maintaining this balance is a complex legal task.

Our service helps manage the "Right to be Forgotten" from both the subject's and the company's perspective. The service includes:

• Erasure Request Validation (for Companies): Analyzing whether the request is grounded and if there is a legal obligation to retain data (e.g., for tax purposes) that overrides the right to erasure.
• Erasure Request Preparation (for Citizens): Drafting legally substantiated applications to Google, social networks, or companies to remove your information from search engines and databases.
• Technical Execution Monitoring: Ensuring that data is deleted not only from "live" databases but also from backups within a reasonable timeframe.
• Informing Third Parties: If data was shared with other companies, fulfilling the obligation to inform them so they also delete the information.
• Refusal Justification: Preparing written refusals for companies explaining why the erasure request cannot be satisfied due to legal reasons.

Practical example: A client requests a bank to delete all data. The bank must delete marketing data but is obliged to keep transaction history for 6 years under the AML law. A lawyer helps the bank make this distinction. Another example: An old, reputation-damaging article appears in Google search. A citizen can request de-indexing of this link. A lawyer prepares arguments on why privacy outweighs public interest.

The legal regulation is based on the Law of Georgia on Personal Data Protection. The law states that data must be deleted immediately unless there is another ground for retention. Instead of deletion, data blocking is possible if deletion is technically impossible.

Collaborating with a lawyer is essential to avoid mistakes. Incorrectly deleted data (which should have been kept by law) is as dangerous as undeleted data (which should have been destroyed). Our experts ensure finding the golden mean.

Legal.ge gives you access to data protection experts. Manage your digital footprint and company databases legally with our help.