CJEU C‑312/24 — Erasure vs legal obligation: a relative right

CJEU C‑312/24 (4 June 2026) — Erasure vs. legal obligation. The Court confirms the “right to be forgotten” (Art. 17 GDPR) is relative: where retention is necessary to comply with a clear, foreseeable and proportionate legal obligation, erasure may be refused. Once no longer necessary, erasure applies again. Full judgment (CJEU, 4 June 2026, C‑312/24, ECLI:EU:C:2026:449) on EUR‑Lex — 62024CJ0312.

The case

In C‑312/24, CL v Prokuratura na Republika Bulgaria (“Darashev”), information from a criminal investigation (suspect status) was filed in a police officer’s HR record. The data subject sought erasure under Article 17 GDPR.

• Filing criminal investigation information in HR is “processing” under the GDPR within a “filing system” (Art. 4). When the purpose is HR/discipline, the GDPR applies rather than Directive 2016/680.
• These qualify as “data relating to criminal convictions and offences” (Art. 10 GDPR), even absent a final conviction.
• Erasure (Art. 17(1)) may be set aside if retention is necessary to comply with a legal obligation (Art. 17(3)(b)), grounded in Art. 6(1)(c) and 6(3) GDPR and meeting clarity, foreseeability and proportionality.
• Beyond what is necessary, erasure becomes mandatory again (Art. 5(1)(e) and 17(1)(a)).

Official source: EUR‑Lex — 62024CJ0312. See in particular paras 81, 84, 89 and 106‑109, and the operative part.

Legal reasoning

1) Qualification of data and applicable regime

• The Court holds that “suspect status” entries are offence‑related data under Article 10 GDPR, “regardless” of the absence of a conviction (para 106). Consequence: a specific legal basis is required (under public authority control, or EU/Member State law with safeguards).
• When information initially collected by an investigative authority is filed in HR for employment/disciplinary purposes, the GDPR (HR purpose) applies rather than Directive 2016/680, triggering full application of Arts. 5, 6, 10 and 17 GDPR.

2) Legal basis: legal obligation (Art. 6(1)(c) and 6(3) GDPR)

• To retain such criminal data in HR, the employer‑authority must show a clear and precise legal obligation, foreseeable to data subjects, pursuing a public interest objective and proportionate (para 109). Otherwise, erasure is due (Art. 17(1)(d)).
• Core GDPR references: principles and legal bases, consolidated text. For implementation in practice, see our resources on Articles 5, 6, 10 and 17 and our certified DPO mandate services.

3) Right to erasure and exceptions (Art. 17)

• The Art. 17(3)(b) exception applies only if retention is necessary to comply with a legal obligation satisfying the above criteria. Even then, Art. 5(1)(e) (storage limitation) caps duration: once the obligation ends or the need lapses, erasure is again required.
• Supervisory views: the Luxembourg CNPD notes the right to erasure is not absolute and provides practical sheets and a model letter (updated 25/03/2026) — CNPD — Right to erasure. The EDPB’s 2026 CEF highlights recurring qualification issues and stresses traceability — EDPB — CEF 2026 “Right to be forgotten”.

What changes in practice

For executives, DPOs and CISOs in Luxembourg, including public sector and private entities with sectoral obligations, Darashev brings three practical shifts:

• HR files and discipline: investigation mentions (suspect status, implication) fall under Art. 10 GDPR. Retention in HR only if a “clear and precise” law mandates it and if proportionate to a public interest objective. Otherwise, erasure is due.
• Dynamic retention periods: even with a legal obligation, duration must be strictly limited. Implement automated purges and manual reviews aligned with Art. 5(1)(e) and 17(1)(a).
• Tooled erasure workflow: CNPD expects reasoned, traceable decisions without undue delay; EDPB finds recurrent process gaps. Build HR/Legal/DPO workflows (ticketing, execution evidence, decision logs). For local alignment, see our DPO Luxembourg guidance.

Use cases in Luxembourg

• Banks/PSFs: handling internal alerts and suspicions (AML/CFT) overlapping with discipline. Where law mandates retention for fitness and propriety, precisely define scope, duration and access.
• Public/para‑public sector: deontological or security duties (firearms, critical infrastructure). Retaining “suspect status” in HR cannot be general: it must rest on an explicit, proportionate and time‑bound legal basis.
• Large private companies: when internal/criminal investigation details surface in HR, career‑management use requires a robust legal basis; otherwise, prefer restriction (Art. 18) and controlled‑deadline erasure with logging.

Common pitfalls

1. Funneling everything into HR “for the record”: Art. 10 GDPR applies and requires a reinforced legal basis; “suspect ≠ convicted”. Without a clear and proportionate law, erasure is required.
2. Confusing “legal obligation” with “employer’s interest”: Art. 6(1)(c) needs a precise statutory basis under Art. 6(3) — not an internal policy.
3. Forgetting duration limits: even if a legal obligation exists today, once it ends, erasure is again due. Schedule purges and document reviews.
4. Late or unreasoned responses to erasure requests: CNPD sets procedural expectations (acknowledgment, reasoned decision, remedies). Without tooling, unproven refusals are sanctionable.
5. Neglecting traceability: EDPB CEF 2026 flags insufficient internal policies and evidence on Art. 17. Keep purge/retention logs and legal‑basis decisions.

Official sources

• CJEU, 4 June 2026, C‑312/24 — full text on EUR‑Lex
• GDPR (consolidated) — Articles 5, 6, 10, 17
• CNPD (Luxembourg) — Right to erasure
• EDPB — CEF 2026 report

Key takeaway for leaders

Audit how “investigation information” is handled in HR files. Without an explicit and proportionate legal basis, you must erase; with a legal basis, set a strictly necessary, provable duration. Need hands‑on support? Contact us.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.