Right to Be Forgotten Implementation

Explore the intricacies of the Right to Be Forgotten, its practical implementation across industries, key challenges, and strategic approaches for effective compliance in the digital age.

In the digital landscape, personal data flows freely across platforms, databases, and international borders. While this interconnectivity drives innovation and convenience, it also creates unprecedented privacy challenges. Among these challenges, the "Right to Be Forgotten" (RTBF) stands as one of the most complex yet essential components of modern privacy regulation. Established through landmark court decisions and codified in the General Data Protection Regulation (GDPR), this right empowers individuals to reclaim control over their digital footprint.

The concept seems straightforward at first glance: individuals should have the ability to request deletion of their personal data. However, the practical implementation reveals a web of technical hurdles, legal considerations, and ethical dilemmas that organizations must navigate. From determining when the right applies to implementing effective erasure mechanisms across complex IT infrastructures, RTBF compliance demands a multifaceted approach that balances individual rights with organizational realities and competing legal obligations.

This comprehensive guide explores the intricate landscape of RTBF implementation, providing organizations with actionable insights, best practices, and strategic frameworks to achieve compliance while maintaining operational efficiency. Whether you're a multinational corporation managing vast data networks or a growing business establishing privacy protocols, understanding the nuances of this fundamental privacy right is critical to building trust and meeting regulatory requirements in our increasingly privacy-conscious world.

Understanding the Right to Be Forgotten

The Legal Foundation

The Right to Be Forgotten, also known as the right to erasure, represents a cornerstone of data protection law. It emerged prominently following a landmark 2014 ruling by the Court of Justice of the European Union in the case of Google Spain v. AEPD and Mario Costeja González. This watershed decision established that search engines must consider requests from individuals to remove links containing personal information from search results. The concept was subsequently formalized in Article 17 of the GDPR, which came into force in May 2018, providing a comprehensive legal framework for data erasure requests throughout the European Union.

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay" Everything you need to know about the "Right to be forgotten" - GDPR.eu when specific conditions are met, as outlined in Article 17 of the GDPR. The regulation further stipulates that organizations must respond to erasure requests within approximately one month, setting clear expectations for timely compliance.

When RTBF Applies

Understanding when the Right to Be Forgotten applies is crucial for implementing proper compliance mechanisms. According to the GDPR, individuals can request data erasure under several circumstances:

  1. When personal data is no longer necessary for the original purpose of collection or processing

  2. When an individual withdraws consent that served as the lawful basis for processing

  3. When an individual objects to processing based on legitimate interests, and there are no overriding legitimate grounds to continue processing

  4. When personal data has been processed unlawfully

  5. When erasure is necessary to comply with a legal obligation

  6. When data was collected in relation to the offer of information society services to a child

Organizations must carefully assess each erasure request against these criteria to determine whether the right applies in each specific case. This assessment requires thorough understanding of both the regulation and the specific context of data processing within the organization.

Limitations and Exemptions

While the Right to Be Forgotten empowers individuals, it is not absolute. The GDPR recognizes several important exemptions where organizations may legitimately deny erasure requests. These exemptions include:

  1. Processing necessary for exercising the right of freedom of expression and information

  2. Compliance with legal obligations or performance of tasks in the public interest

  3. Public health purposes in the public interest

  4. Archiving, scientific or historical research, or statistical purposes when erasure would seriously impair these objectives

  5. Establishment, exercise, or defense of legal claims

These exceptions highlight the careful balance the GDPR strikes between individual privacy rights and other important interests, including freedom of expression, scientific advancement, and public health. Organizations must develop clear frameworks for evaluating how these exemptions apply to their specific data processing activities.

Implementation Challenges

Technical Complexities

Implementing the Right to Be Forgotten presents significant technical challenges for organizations of all sizes. One major challenge is that when information is deemed no longer necessary, it "must be deleted from every public, or business, database - including backup systems." GDPR right to be forgotten – what makes it tough? This comprehensive deletion requirement creates numerous technical difficulties:

  1. Data Discovery and Mapping: Before data can be deleted, it must be located. Many organizations struggle with limited visibility into where personal data resides across complex IT ecosystems that may include legacy systems, cloud services, local databases, archives, and third-party processors. Creating and maintaining accurate data maps is essential but resource-intensive.

  2. Backup and Archive Systems: These systems are typically designed for disaster recovery, not selective data deletion. Modifying backup files to remove specific individual records without compromising data integrity presents significant technical challenges and may require redesigning backup procedures.

  3. Distributed Data Architectures: Modern organizations often employ distributed data storage across multiple systems, locations, and cloud providers. Ensuring complete data erasure across these distributed environments requires sophisticated coordination and verification processes.

  4. Data Interdependencies: Personal data often exists within complex relational databases where deletion may impact system integrity or create orphaned records. Organizations must carefully manage these interdependencies when implementing erasure mechanisms.

Legal and Regulatory Complexities

Beyond technical challenges, organizations face significant legal and regulatory complexities when implementing RTBF:

  1. Conflicting Legal Obligations: Organizations frequently encounter situations where GDPR erasure requirements conflict with other legal obligations, such as financial record-keeping requirements, employment law, or industry-specific regulations. Navigating these conflicts requires careful legal analysis and documentation.

  2. International Data Transfers: For multinational organizations, determining how RTBF requirements apply across different jurisdictions can be challenging. While the GDPR has established a robust framework within the EU, other regions have varying approaches to data erasure rights, creating compliance complexity for global operations.

  3. Identity Verification: Organizations must verify the identity of individuals making erasure requests while avoiding excessive data collection that would contradict data minimization principles. This balancing act requires thoughtful verification procedures that are both secure and privacy-preserving.

  4. Record-Keeping Requirements: While implementing erasure, organizations must maintain appropriate documentation of requests and responses without retaining unnecessary personal data, creating another careful balancing act for compliance teams.

Organizational and Resource Challenges

Implementing effective RTBF processes also presents organizational challenges:

  1. Cross-Functional Coordination: Effective RTBF implementation requires cooperation across multiple departments, including IT, legal, compliance, customer service, and business units. Establishing clear roles, responsibilities, and communication channels is essential but often difficult.

  2. Resource Allocation: For many organizations, especially smaller ones, dedicating sufficient resources to RTBF compliance competes with other business priorities. Determining appropriate investment levels requires careful risk assessment and strategic planning.

  3. Staff Training and Awareness: Organizations face "a challenge as any of [their] employees could receive a valid verbal request." Right to erasure | ICO This necessitates comprehensive training to ensure all staff who interact with customers can recognize and properly handle erasure requests.

  4. Balancing Efficiency and Thoroughness: Organizations must develop processes that are both efficient enough to meet regulatory timelines and thorough enough to ensure complete compliance, creating tension between speed and comprehensiveness.

Implementation Best Practices

Developing a Comprehensive RTBF Framework

A successful RTBF implementation begins with establishing a comprehensive framework that addresses all aspects of compliance:

  1. Policy Development: Create clear, documented policies that define how your organization handles erasure requests, including eligibility criteria, verification procedures, assessment methodologies, response processes, and exceptions handling. These policies should be reviewed regularly and updated as regulatory interpretations evolve.

  2. Request Intake System: Implement user-friendly mechanisms for individuals to submit erasure requests through multiple channels, including online forms, email, telephone, and in-person interactions. Each channel should feed into a centralized tracking system to ensure consistent handling regardless of submission method.

  3. Identity Verification Protocols: Develop robust procedures for confirming requesters' identities while respecting data minimization principles. These protocols should be proportionate to the sensitivity of the data involved and the risk of inappropriate disclosure.

  4. Assessment and Decision Framework: Establish structured evaluation criteria for determining when the right to erasure applies and when exemptions are relevant. This framework should guide consistent decision-making while allowing for case-specific considerations.

Technical Implementation Strategies

Effective technical implementation requires a systematic approach to data management:

  1. Data Inventory and Mapping: Conduct thorough data discovery exercises to identify all locations where personal data resides. Document data flows, storage locations, retention periods, and access controls to create a comprehensive data map that serves as the foundation for erasure capabilities.

  2. Centralized Data Management: Where feasible, implement centralized data management systems that enable efficient identification and erasure of personal data across multiple systems. These solutions can significantly streamline compliance by providing a single point of control.

  3. Differential Privacy Design: Incorporate privacy by design principles into system architecture, using techniques like data pseudonymization, purpose limitation, and data minimization to reduce erasure complexity from the outset.

  4. Automated Erasure Workflows: Develop automated workflows that can execute erasure requests across multiple systems while maintaining appropriate audit trails. These workflows should include verification steps to confirm complete data removal.

  5. Technical Solutions for Backup Systems: Implement innovative approaches to backup system management, such as creating erasure logs that are applied when backups are restored or developing capabilities for selective restoration that exclude erased data.

Cross-Organizational Implementation

Successful RTBF implementation requires coordination across the entire organization:

  1. Cross-Functional Governance: Establish a privacy governance committee with representatives from key departments (IT, legal, compliance, business units) to oversee RTBF implementation and ongoing compliance. This committee should meet regularly to address emerging challenges and review effectiveness.

  2. Staff Training Programs: Develop comprehensive training for all relevant personnel, with role-specific modules addressing different aspects of RTBF compliance. Training should cover request recognition, handling procedures, technical processes, and decision-making frameworks.

  3. Third-Party Processor Management: Implement robust contractual provisions and operational controls for third-party data processors, ensuring they can support your organization's RTBF obligations. Regularly audit their compliance capabilities and performance.

  4. Documentation and Accountability: Maintain comprehensive records of all erasure requests, decisions, actions taken, and rationales for exemptions applied. This documentation demonstrates accountability and provides evidence of compliance if questioned by regulators.

Balancing RTBF with Other Obligations

Legitimate Interest Assessment

Organizations must develop methodologies for balancing RTBF requests against legitimate interests for continued processing:

  1. Structured Assessment Process: Implement a structured process for evaluating whether legitimate interests override erasure rights in specific cases. This process should consider the nature of the data, the purpose of processing, the impact on the individual, and safeguards in place.

  2. Documentation of Reasoning: When denying erasure requests based on legitimate interests, maintain detailed documentation of the assessment conducted, including factors considered and the balancing test applied. This documentation demonstrates the reasoned approach taken if challenged.

  3. Regular Review of Legitimate Interests: Periodically reassess previously identified legitimate interests to ensure they remain valid as circumstances change. What constitutes a legitimate interest today may not remain so indefinitely.

Reconciling RTBF with Data Retention Requirements

Many organizations face conflicts between erasure requests and legal requirements to retain certain data:

  1. Granular Data Management: Implement systems capable of partial erasure, where some elements of an individual's data are deleted while others required for legal compliance are retained with appropriate access restrictions.

  2. Data Isolation Techniques: Where complete erasure is not possible due to legal retention requirements, employ data isolation techniques that remove data from active systems while preserving legally required records in restricted-access storage.

  3. Clear Communication: When denying erasure requests due to legal retention requirements, provide clear explanations to individuals about the specific legal obligations necessitating continued data storage and the safeguards applied to their data.

Balancing RTBF with Freedom of Expression

In some contexts, particularly for media organizations or platforms hosting user-generated content, RTBF requests must be balanced against freedom of expression rights:

  1. Contextual Evaluation Framework: Develop frameworks for evaluating the public interest value of information against privacy considerations, considering factors such as the individual's role in public life, the nature of the information, and the time elapsed.

  2. Content Moderation Policies: Establish clear policies governing when content will be removed or delisted in response to RTBF requests, ensuring consistent application while protecting legitimate public interest information.

  3. Partial Remedies: Consider intermediate solutions such as de-indexing content from search engines while maintaining the original content, or anonymizing rather than completely removing information with legitimate public interest value.

Industry-Specific Implementation Approaches

Financial Services Sector

The financial services industry faces unique RTBF implementation challenges due to extensive regulatory record-keeping requirements and complex data ecosystems:

  1. Regulatory Conflict Analysis: Financial institutions must conduct thorough analyses of where GDPR erasure rights conflict with financial regulations such as anti-money laundering laws, Know Your Customer requirements, and transaction monitoring obligations. This analysis should be documented and regularly updated as regulations evolve.

  2. Data Classification Systems: Implement sophisticated data classification systems that distinguish between data subject to mandatory retention and data eligible for erasure. This classification enables targeted erasure while maintaining regulatory compliance.

  3. Customer Communication Strategies: Develop clear communication templates explaining to customers when financial regulatory requirements prevent complete erasure of their data, detailing which data elements must be retained, for what purpose, and for how long.

  4. Legacy System Management: Many financial institutions operate complex legacy systems that were not designed with data erasure capabilities. Develop technical approaches for managing erasure across these systems, possibly including data virtualization layers or controlled access restrictions.

Healthcare and Life Sciences

Healthcare organizations manage highly sensitive personal data subject to both privacy rights and critical healthcare purposes:

  1. Patient Rights Framework: Develop comprehensive frameworks for balancing patient erasure rights against medical necessity, research value, and public health interests. These frameworks should incorporate both legal analysis and ethical considerations specific to healthcare contexts.

  2. Research Data Protocols: Establish protocols for managing erasure requests related to clinical trial data or other research information, considering approaches such as anonymization or aggregation rather than complete deletion when research integrity would be compromised.

  3. Electronic Health Record Strategies: Implement technical solutions for managing erasure within electronic health record systems that were often designed for permanent record retention rather than selective erasure. This may involve flagging certain data for non-use rather than physical deletion.

  4. Cross-Border Health Data Management: Develop approaches for handling health data transfers across jurisdictions with different erasure right frameworks, ensuring appropriate safeguards are in place regardless of data location.

Technology and Online Services

Technology companies and online service providers often process vast quantities of personal data across globally distributed infrastructure:

  1. Scaled Request Processing: Implement scalable systems capable of handling large volumes of erasure requests efficiently, including automated verification, assessment, and execution workflows appropriate for high-volume environments.

  2. Global Data Location Tracking: Develop sophisticated capabilities for tracking personal data across globally distributed infrastructure, ensuring complete erasure across all relevant systems regardless of geographic location.

  3. Product Design Integration: Incorporate RTBF considerations into product design processes, ensuring new products and features are built with erasure capabilities from inception rather than retrofitted later.

  4. User-Facing Controls: Implement user-friendly self-service tools that allow individuals to view their data and initiate erasure requests through intuitive interfaces, reducing friction in the erasure process while maintaining appropriate security.

Monitoring, Measuring and Improving RTBF Compliance

Compliance Metrics and KPIs

Organizations should establish robust metrics to monitor RTBF compliance effectiveness:

  1. Request Processing Metrics: Track key performance indicators such as request volumes, processing times, completion rates, and exception percentages to identify trends and potential compliance gaps. Regular reporting on these metrics to privacy governance committees enables ongoing program evaluation.

  2. Quality Assurance Sampling: Implement regular quality assurance reviews of completed erasure requests, randomly sampling cases to verify proper handling, documentation, and complete execution across systems. These reviews can identify process weaknesses before they become compliance issues.

  3. Cost and Resource Tracking: Monitor resources devoted to RTBF compliance, including staff time, technology investments, and third-party costs. This tracking enables cost-benefit analysis and more efficient resource allocation over time.

  4. Regulatory Engagement Metrics: Track interactions with data protection authorities regarding erasure requests, including inquiries, complaints, and resolution outcomes. These metrics provide valuable insights into regulatory expectations and potential areas for improvement.

Continuous Improvement Processes

Effective RTBF implementation requires ongoing refinement and adaptation:

  1. Regular Policy and Process Reviews: Schedule periodic reviews of RTBF policies, procedures, and technical implementations to identify improvement opportunities and ensure alignment with evolving regulatory guidance and case law. These reviews should occur at least annually and after significant regulatory developments.

  2. Feedback Integration Systems: Establish mechanisms to collect feedback from individuals making erasure requests, staff processing requests, and technical teams implementing erasure. This multifaceted feedback provides valuable insights for process refinement.

  3. Regulatory Monitoring Program: Develop a systematic approach to monitoring regulatory guidance, enforcement actions, and court decisions related to the Right to Be Forgotten. This monitoring enables proactive adaptation to evolving interpretations.

  4. Tabletop Exercises and Simulations: Conduct regular scenario-based exercises to test RTBF response capabilities, especially for complex or unusual request types. These exercises identify process weaknesses in a controlled environment where they can be addressed without compliance consequences.

Leveraging Technology for Compliance Improvement

Advanced technologies can significantly enhance RTBF compliance capabilities:

  1. AI and Machine Learning Tools: Implement AI-powered solutions to improve data discovery, classification, and mapping. These tools can identify previously unknown or unclassified personal data repositories and improve erasure completeness.

  2. Blockchain for Compliance Records: Consider blockchain technology for maintaining tamper-proof records of erasure requests and actions taken, providing immutable evidence of compliance efforts while protecting the privacy of requesters.

  3. Privacy Enhancing Technologies: Explore emerging privacy-enhancing technologies such as federated learning, homomorphic encryption, and distributed privacy systems that can reduce compliance burdens by minimizing unnecessary data collection and storage.

  4. Automation of Compliance Workflows: Invest in automation technologies that can reduce manual handling of erasure requests, improving consistency, reducing human error, and accelerating processing times while maintaining appropriate human oversight for complex cases.

Future Trends and Evolving Compliance Landscape

Regulatory Evolution

The regulatory landscape governing the Right to Be Forgotten continues to evolve:

  1. Global Expansion of Erasure Rights: The concept of data erasure rights is expanding beyond Europe, with similar provisions appearing in regulations worldwide, including Brazil's LGPD, California's CCPA/CPRA, and other emerging privacy frameworks. Organizations should monitor this global expansion and adapt compliance programs accordingly.

  2. Regulatory Harmonization Efforts: Initiatives to harmonize data protection approaches across jurisdictions may simplify compliance for global organizations but will require careful monitoring and adaptation as new frameworks emerge. Participating in industry associations can provide early insights into harmonization trends.

  3. Enforcement Trends: Data protection authorities are increasingly focusing on effective implementation of data subject rights, including the Right to Be Forgotten. Organizations should monitor enforcement actions and penalties to understand regulatory priorities and compliance expectations.

  4. Sector-Specific Guidance: Regulators are developing more granular, sector-specific guidance on RTBF implementation, acknowledging the unique challenges in different industries. Organizations should engage with these developments through industry associations and regulatory consultations.

Technological Developments

Emerging technologies are reshaping both the challenges and opportunities in RTBF compliance:

  1. Artificial Intelligence and Automated Decision-Making: As AI systems become more prevalent, erasure rights will need to extend to personal data used for algorithmic training and decision-making, presenting novel implementation challenges. Organizations should develop specific approaches for managing erasure requests related to AI systems.

  2. Decentralized Data Architectures: The rise of decentralized technologies and edge computing creates new complexities for data erasure. Organizations adopting these architectures should design erasure capabilities from inception rather than retrofitting compliance later.

  3. Privacy-Preserving Computation: Technologies enabling data analysis without data exposure, such as secure multi-party computation and trusted execution environments, may reduce erasure complexities by limiting data proliferation. Organizations should explore these technologies as part of long-term compliance strategies.

  4. Quantum Computing Implications: In the longer term, quantum computing may create both threats to current data protection mechanisms and opportunities for more sophisticated privacy protections. Organizations should monitor these developments and incorporate quantum considerations into future compliance planning.

Strategic Positioning

Forward-thinking organizations are transforming RTBF compliance from a regulatory burden to a strategic advantage:

  1. Privacy as a Competitive Differentiator: Organizations that implement superior erasure capabilities can position privacy respect as a competitive advantage, building trust with privacy-conscious consumers and business partners. This positioning should be integrated into broader brand and marketing strategies.

  2. Data Minimization Culture: Leading organizations are moving beyond compliance to embrace data minimization as a core principle, reducing RTBF compliance burdens while simultaneously decreasing data security risks and storage costs. This cultural shift requires executive sponsorship and cross-organizational engagement.

  3. Proactive Relationship Management: Rather than treating erasure requests as adversarial, progressive organizations view them as opportunities to enhance customer relationships through responsive, transparent handling. This approach transforms compliance from a cost center to a relationship-building opportunity.

  4. Privacy Innovation Leadership: Organizations at the forefront of RTBF compliance are contributing to the development of industry standards, technologies, and best practices, positioning themselves as thought leaders while ensuring regulatory frameworks reflect operational realities. Engagement with standards bodies and industry associations enables this leadership positioning.

Conclusion

The Right to Be Forgotten represents both a significant compliance challenge and an opportunity for organizations to demonstrate their commitment to data subject rights. Successful implementation requires a multifaceted approach that addresses legal, technical, and organizational dimensions while balancing competing obligations and interests.

Organizations that invest in comprehensive RTBF frameworks not only mitigate regulatory risks but also build trust with individuals increasingly concerned about their digital privacy. This trust translates into stronger customer relationships and potential competitive advantages in an era where privacy has become a key differentiator.

As the regulatory landscape continues to evolve and new technologies reshape data processing paradigms, maintaining effective RTBF compliance will require ongoing adaptation and innovation. Forward-thinking organizations will embrace this evolution, treating privacy rights not merely as compliance requirements but as fundamental principles guiding their data governance approach.

By developing robust erasure mechanisms, clear decision frameworks, and transparent communication processes, organizations can transform RTBF compliance from a regulatory burden into a strategic asset that supports both compliance objectives and broader business goals. In this transformation lies the true value of mastering the Right to Be Forgotten.

What exactly is the Right to Be Forgotten under GDPR?

The Right to Be Forgotten (also called the right to erasure) is established in Article 17 of the GDPR. It gives individuals the right to request deletion of their personal data when certain conditions are met, such as when data is no longer necessary, consent is withdrawn, or there's no legitimate interest for continued processing.

Can organizations refuse a Right to Be Forgotten request?

Yes, organizations can refuse RTBF requests when specific exemptions apply. These include processing necessary for freedom of expression, legal obligations, public interest tasks, public health purposes, scientific/historical research, or the establishment of legal claims.

How quickly must organizations respond to erasure requests?

Under GDPR, organizations must respond to erasure requests "without undue delay" and within one month of receipt. This period may be extended by up to two additional months for complex requests, provided the individual is informed of the extension within the first month.

What are the biggest technical challenges in implementing RTBF?

The major technical challenges include: locating all instances of personal data across systems; handling erasure in backup and archive systems; managing data interdependencies; coordinating deletion across distributed architectures; and ensuring complete verification of erasure across all systems.

How should organizations handle RTBF requests that conflict with legal retention requirements?

When legal retention requirements conflict with erasure requests, organizations should document the specific legal basis for retention, restrict access to the retained data, implement data isolation techniques, and clearly explain to the individual why complete erasure isn't possible and how long the data must be retained.

Do RTBF obligations extend to third-party processors?

Yes, RTBF obligations extend to third-party processors. Organizations must inform all processors handling the relevant personal data about erasure requests and ensure they comply with the erasure requirements. This should be covered in data processing agreements with all processors.

What documentation should organizations maintain for RTBF requests?

Organizations should document receipt of requests, identity verification procedures, assessment of whether RTBF applies, actions taken to implement erasure, justifications for any refusals, communications with the individual, and verification of erasure completion across all relevant systems.

How does the Right to Be Forgotten differ across jurisdictions?

While GDPR provides the most comprehensive RTBF framework, similar rights exist in other privacy regulations with varying scopes and limitations. Organizations operating globally must understand these differences and implement jurisdiction-specific processes while maintaining a consistent overall approach.

What steps should an organization take when first implementing RTBF compliance?

Key initial steps include: conducting data mapping to identify where personal data resides; developing formal RTBF policies and procedures; creating request intake systems; establishing identity verification protocols; implementing technical erasure capabilities; training staff; and establishing monitoring mechanisms.

How can organizations verify that data has been completely erased across all systems?

Verification requires systematic processes including confirmation checks across all identified data repositories, automated verification tools, post-erasure search testing, third-party processor confirmations, and comprehensive documentation of verification steps to demonstrate due diligence.

Additional Resources

For readers seeking more in-depth information on RTBF implementation, the following resources provide valuable guidance:

  1. European Data Protection Board (EDPB) Guidelines on the Right to Erasure: Comprehensive regulatory guidance on interpreting and implementing Article 17 of the GDPR, including case studies and practical examples.

  2. "Implementing the Right to Be Forgotten: Technical Approaches and Challenges" (International Association of Privacy Professionals): A technical whitepaper exploring architectural and system design considerations for effective erasure capabilities.

  3. ISO/IEC 27701:2019 – Privacy Information Management: International standard providing guidance on implementing privacy controls, including erasure mechanisms, within information security management systems.

  4. "GDPR Implementation and Compliance Handbook" (Datasumi Compliance Advisory): A practical guide to GDPR implementation with significant coverage of data subject rights including the Right to Be Forgotten. Visit Datasumi Compliance Advisory for more information.

  5. "Balancing Privacy Rights with Competing Obligations: A Legal Framework" (International Review of Law and Technology): Academic analysis of approaches to reconciling erasure rights with other legal and ethical considerations.