The classic trap
Recital 66 clarifies Article 17(2) and imposes an obligation most controllers overlook: when you have made personal data public (indexed blog post, corporate LinkedIn post, press release, employee profile, event photo), an erasure request requires you to actively notify third parties who reproduced that data (search engines, archives, aggregators, mirror sites). The CNPD and CNIL regularly sanction organisations that simply delete their own copy without reaching out to Google, Bing, Wayback Machine or republishers. The EDPB (guidelines 5/2019 on dereferencing) confirmed that reasonable diligence is measured against available technology, not declared good intentions.
The 'reasonable steps' test: what the CNPD actually expects
Recital 66 introduces a conduct standard, not an outcome obligation. But to pass the test before the authority, you must document a structured workflow:
- Map where the data was originally published (website, social networks, press, partners) before acting.
- Identify likely republishers through reverse search (Google, Bing, Yandex, Wayback Machine, national archives).
- Send a written and traceable notification to each third-party controller, explicitly citing Article 17 GDPR and the data subject's request.
- Submit the URLs to Google Search Console, Bing Webmaster removal forms, and request cache deletion.
- Keep proof of each step (timestamp, acknowledgement, screenshot) for at least 3 years, enforceable in case of complaint.
- Recheck 30 and 90 days after the request that the links have effectively disappeared from public indexes.
How Luxgap automates this risk
Our Luxgap Erasure Propagation Agent turns the vague obligation of recital 66 into a traceable, enforceable chain of actions. As soon as an erasure request is validated in your GDPR back-office, the AI agent automatically scans Google, Bing, Yandex, Wayback Machine, Common Crawl and the main LinkedIn / Facebook / X aggregators to identify every republication of the data, and triggers third-party notifications without a single employee drafting an email.
- Detects in real time every public URL containing the data to be erased through a multi-engine crawl launched within 5 minutes of request validation.
- Automatically generates timestamped Article 17(2) notifications, electronically signed, sent to identified third-party controllers with traced delivery receipts.
- Submits URLs to official dereferencing tools (Google Removal Tool, Bing Content Removal, Wayback exclusion) via API and stores the request IDs.
- Automatically rechecks at D+30 and D+90 that links have disappeared from indexes, and escalates non-compliant third parties through formal channels.
- Produces a cryptographically sealed PDF dossier, enforceable before the CNPD, demonstrating reasonable diligence under recital 66 for every request handled.
- Predicts residual republication risk (score 0-100) by correlating source site history, popularity and data profile.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request your demonstration and our teams will run a free scan within 48h on three public data points of your choice, to measure your real exposure to the right to be forgotten before any engagement.
