You don't delete the article, you delete the name

On 5 August 2026 the CNIL published guidance on a request that press organisations receive constantly: an individual asking for their personal data to be removed from an article published online.

Which rights survive against the press

Art. 85 GDPR requires Member States to reconcile data protection with freedom of expression. In France, Art. 80 of the Data Protection Act disapplies, for professional journalistic processing and to the extent the derogation is necessary, the rights to information, access, rectification and restriction. The right to object under Art. 21 and the right to erasure under Art. 17 remain applicable.

There is a limit worth stating to the applicant at the outset: these provisions do not allow a request for the removal of the article in its entirety. They cover only the data that make the person identifiable.

Nor are they absolute. The controller may refuse if it demonstrates compelling legitimate grounds overriding the data subject's rights (Art. 21), or that the processing is necessary for exercising the right to freedom of expression and information (Art. 17).

The ECtHR balancing criteria

The European Court of Human Rights requires a case-by-case balancing exercise and has published a non-exhaustive set of criteria that media handling such requests may usefully refer to:

• the nature of the information at issue
• the time elapsed since the events, since first publication and since the article was put online
• the current interest of the information and the publication's contribution to a debate of general interest
• the applicant's public profile
• the applicant's prior conduct, in particular their attitude towards the media
• any adverse consequences for them of continued dissemination
• the accessibility of the content online

A refusal must be reasoned in concrete terms

Art. 12 requires any refusal to be reasoned, and the CNIL specifies that general, theoretical reasoning is not enough: the outlet must demonstrate concretely, against the applicant's arguments and the circumstances of publication, why that processing is necessary. Formulas such as 'we cannot grant your request in the name of the right to information', 'we do not delete articles, save for manifest error', 'the information about your case is of interest to the public' and 'we contribute to writing local history' are named as inadmissible.

If the request is granted: anonymisation

Granting the request does not mean withdrawing the article, but removing the identifying elements, both direct (first and last name) and indirect (the chair of association W, the head of the municipal police of town X, the winner of race Y, the only resident of the building at address Z). In practice this is an anonymisation of the published article.

And it does not end there. Art. 17 obliges the outlet to inform other controllers processing those data: companies to which the article was contractually supplied, such as titles in the same group or content aggregators, and search engine operators, so that they update the results pointing to the amended content.