Written by: Haim Ravia, Dotan Hammer
A new thematic digest released by the European Data Protection Board (EDPB) provides a comprehensive look at how the “right to object” and the “right to erasure” are being enforced across the European Union. The report analyzes years of “One-Stop-Shop” (OSS) decisions to identify emerging patterns and shortcomings in data protection.
The study examined a total corpus of 631 final decisions adopted through January 2026, comprising 551 cases related to Article 17 (erasure) and 80 related to Article 21 (objection) of the GDPR. While the frequency of “right to object” cases has remained relatively stable, the “right to erasure” saw a significant surge in 2022 and 2023—driven largely by cases involving the Irish Supervisory Authority—before beginning to normalize toward 2025.
The report identifies several systemic “shortcomings” in how companies handle data subject requests, specifically citing cumbersome procedures and errors in technical design. A recurring issue involves the identification of data subjects; many controllers have adopted a “strict approach,” systematically requiring official identity documents even when no risk of unauthorized disclosure exists. Regulators have clarified that while authentication is necessary for certain requests, requiring a national ID card by default for erasure or objection is often disproportionate and violates the principle of data minimization.
The digest also highlights a growing “instrumental use” or “weaponization” of the GDPR. Increasingly, individuals use the right to erasure to achieve indirect goals, such as removing references to old books, business activities, or aircraft tracking data, rather than strictly for privacy protection. Furthermore, many online account management disputes are being misclassified as erasure requests.
Despite these challenges, the report emphasizes that the majority of cases involve minor or “trivial” violations. Enforcement often prioritizes “spontaneous compliance” and “amicable settlements” over heavy financial penalties. Most resolved cases result in simple reprimands, reflecting a regulatory philosophy that favors the promotion of values and rights-oriented design over pure punishment.
Click here to read the One-Stop-Shop case digest on Right to object and right to erasure.
