Article 17 of the GDPR states that:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following grounds applies: [...]
b. the data subject withdraws consent on which the processing is based [...]
What I haven't understood is how specific one can be regarding the data to be erased in such cases. May one request the deletion of a single data-point or must it be of entire data categories?
For instance, if I was friends with someone on Facebook, unfriended them, and for some reason wanted Facebook to erase its knowledge of our past friendship, is that permissible according to GDPR? As in, could I say
I hereby withdraw my consent for you to process any data regarding my past friendship with John Doe (including its very existence) and therefore demand its deletion.
Or, given that I haven't given Facebook consent to analyze each individual friendship but to analyze all my friendships, would the request have to be far broader:
I hereby withdraw my consent for you to process any data regarding my friendships (including their very existence) and therefore demand its deletion.
(which would be almost flipping a reset switch on my Facebook account)?