Specificity of GDPR's right of erasure

Question

Article 17 of the GDPR states that:

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following grounds applies: [...]

   b. the data subject withdraws consent on which the processing is based [...]

What I haven't understood is how specific one can be regarding the data to be erased in such cases. May one request the deletion of a single data-point or must it be of entire data categories?

For instance, if I was friends with someone on Facebook, unfriended them, and for some reason wanted Facebook to erase its knowledge of our past friendship, is that permissible according to GDPR? As in, could I say

I hereby withdraw my consent for you to process any data regarding my past friendship with John Doe (including its very existence) and therefore demand its deletion.

Or, given that I haven't given Facebook consent to analyze each individual friendship but to analyze all my friendships, would the request have to be far broader:

I hereby withdraw my consent for you to process any data regarding my friendships (including their very existence) and therefore demand its deletion.

(which would be almost flipping a reset switch on my Facebook account)?

Answer 1

b. the data subject withdraws consent on which the processing is based [...]

That refers to Article 6(1)(a):

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

   a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

Article 7 contains the conditions for consent.

As far as I know, Facebook has never requested consent as specified in Article 7. You have accepted the Terms of Service, but that does not count as also explained in recital 43

Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

So because you have not given consent as defined in the GDPR, you cannot withdraw consent.

But even if you can withdraw consent, it would only apply to data processing based on Article 6(1)(a). Facebook would not base the processing of data regarding friendships on Article 6.1a, because it looks to me that is a key feature of Facebook. Even regarding the past friendship with John Doe, processing would probably be based on Article 6.1f, for example because John Doe has interests in keeping that data.

Only if for example the knowledge of that past friendship is used to display an ad, it would be possible to withdraw consent of that data processing, but that would not lead to deleting any data. Facebook would still know about that friendship, you would still see an ad, but which ad is shown, would not be based on that past friendship.