5.a) Duty to erase
You may request the controller to erase your personal data without undue delay. The controller is obliged to erase this data without undue delay if one of the following reasons applies:
(1) the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed;
(2) you withdraw your consent, on which the processing was based and there is no other legal basis for the processing;
(3) you lodge an objection against the processing and there are no compelling legitimate grounds for the processing;
(4) the personal data concerning you have been processed unlawfully;
(5) the deletion of personal data concerning you is necessary in order to fulfil a legal obligation under any law to which the controller is subject to; or
(6) the personal data concerning you were collected in relation to information society services offered pursuant to Art. 8(1) GDPR.
b) Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase it, the controller, taking account of available technology and reasonable cost of implementation, will take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
c) Exceptions
The right to erasure does not exist insofar as the processing is necessary:
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR in so far as the right referred to in paragraph (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.