The Right of Erasure (The Right to be Forgotten)

Individuals have the right to have data about them deleted if the data is no longer necessary for the purpose it was collected for. This right designed to protect people from having their data held long after it was collected.

The right to erasure is not an absolute right however. Where there is a lawful basis of processing, it may not always be appropriate for organisations to delete personal data when requested.

The approach to erasure depends on the basis of processing that exists. If the processing is for Legal or Contractual reasons, it is likely that a request for erasure should be refused as it would be against the law or would mean that a contract can’t be fulfilled.

If processing under Legitimate Interests, it is possible that a request could be refused if the organisation was sure of its grounds for retaining the data and the organisations interests are considered more important than the impact of processing on the individual.

It is unlikely that a request would be refused where data is processed with the consent of the individual. This is because the act of requesting erasure is a clear signal that consent has been withdrawn.

As the right to erasure applies where an overriding basis of processing does not exist or where processing was based on consent and that consent is withdrawn, the simplest approach for any organisation is not to process data without a robust basis of processing that is in line with the customer’s wishes.

If you found this article useful and want to know more, you should consider our course "GDPR - The Basic Facts" which introduces the key features of the GDPR and covers the other enhanced rights that data subjects may invoke.