Right to erasure
In certain cases, the data subject has the right to have the controller erase data concerning him or her without undue delay. This right is also known as the right to be forgotten.
The controller is obligated to erase the personal data without undue delay if
- the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed
- the data subject withdraws the consent on which the processing was based and there is no other legal basis for the processing
- the data subject objects to the processing of his or her data for purposes of direct marketing or otherwise exercises the right to object and there is no other justified reason for the processing
- the personal data has been processed unlawfully
- the personal data has to be erased for compliance with a legal obligation to which the controller is subject
- a child's personal data have been collected in connection with the provision of information society services.
The right to erasure does not apply, if the processing of the data is necessary
- for exercising the right of freedom of expression and information
- for compliance with a legal obligation
- for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- for reasons of public interest in the area of public health
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes insofar as the erasure of the data is likely to render the activity impossible or seriously impair it
- for the establishment, exercise or defence of legal claims.
How quickly is the controller required to reply to the data subject’s request?
The controller must respond to the data subject without undue delay and not later than in one month from receiving the request. In the reply, the controller shall indicate the measures it has taken due to the request.
If the requests are numerous or complex, the controller can reply that it needs more time to process them. In such cases, the deadline can be extended by a maximum of two months. Justifications must be provided for the extension.
Is it possible to charge a fee from the data subject?
As a rule, the exercise of rights is free of charge. If the requests are manifestly unfounded or excessive, the controller can either charge a reasonable fee from the data subject or refuse the request.
Requests can be considered manifestly unfounded or excessive particularly if they are made repeatedly. The controller bears the burden of demonstrating the manifestly unfounded or excessive nature of the request.
The administrative costs of supplying the information or messages or carrying out the requested measure must be taken into account when determining the amount of possible fee.
Can the request be refused?
The controller evaluates whether or not the conditions for erasure are met. If the controller finds that the right to erasure does not apply, it is entitled to refuse the request, and the data subject can then refer the matter to the Data Protection Ombudsman.
If the data subject’s requests are manifestly unfounded or excessive, the controller can either refuse the request or charge a reasonable fee for fulfilling it.
If the controller refuses the request, it must notify the data subject of this within one month of receiving the request. The refusal must be justified. In addition, the controller must also inform the data subject of the possibility of lodging a complaint with the supervisory authority and the availability of judicial remedies.
Inform recipients of the erasure of personal data
Where viable, the controller must inform each recipient to whom the personal data has been disclosed of the erasure of the personal data. The controller is required to notify the data subject of these recipients if so requested by him or her.
If the controller has made the personal data public and is obliged to erase the personal data at the data subject's request, it shall take reasonable steps to inform organisations processing the personal data that the data subject has requested them to erase any links to the personal data or copies thereof. Reasonable steps include technical measures. The available technology and costs of the measures are taken into account in the evaluation of this obligation.
Confirming the identity of the data subject
The controller must be able to confirm the identity of the data subject exercising his or her data protection rights. If the controller has reasonable doubts concerning the identity of the person who made the request, it can request the provision of additional information necessary to confirm his or her identity.
The GDPR does not provide for the methods of confirming the data subject’s identity. The principle of data minimisation must be followed in the confirmation of identity, and as a rule, no more data may be collected for the purpose of confirming identity than the controller already has in its possession.
If the controller is unable to identify the data subject, it must notify him or her of this if viable. If it refuses the data subject’s request due to not being able to identify the data subject, it must demonstrate that this is the case.
If the data subject cannot be identified, he or she cannot exercise the right
- of access to data
- to rectification of data
- to erasure of data
- to restrict the processing of data or
- to data portability.
When is confirming the data subject's identity not necessary?
Personal data may be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing.
If the personal data that permit the identification of the data subject is not necessary for the purpose of processing, the GDPR does not obligate controllers to keep, obtain or process such additional data solely for the purpose of compliance with the GDPR.
Appropriate procedures for verifying identity often already exist in the organisation. The controller may have verified the identity of the data subject, for example, before concluding the contract or requesting consent for the processing of personal data. In this case, the identity can be confirmed by comparing the data of the person who made the request with data already in the controller’s possession regarding the data subject. The request for additional information shall not lead to the collection of irrelevant or unnecessary personal data.
The controller is obliged to facilitate the exercise of the data subject’s rights. Confirmation of identity must not lead to difficulties in the exercise of rights. For example, the controller cannot, as a rule, demand that a request be made on site at the controller’s office. The use of identity cards to verify identity must be carefully considered. Primarily, the identity should be confirmed by other means.
The methods of confirming identity must also take into account the different situations of the data subjects: for example, the possibilities of older people or persons in a vulnerable position to visit an organisation’s office or use electronic systems may be limited. Children also have the right to access information concerning them, but they may not have the tools needed for electronic identification. In other words, the controller must assess how it is able to take different people into account and implement their rights as comprehensively as possible.
Good practices for implementing the right to erasure
The European Data Protection Board has drawn up guidelines and good practices for implementing the right to erasure.
Establish internal procedures which define clear processing steps and deadlines for requests and keep those procedures up to date.
Assign responsibilities for handling and documenting erasure requests within your organisation.
Map the personal data and its storage locations in your organisation’s systems with the help of a record of processing activities. This way, you can get a clear picture of which data should be erased on request and where those data are located.
Larger organisations in particular may find it useful to apply for certifications to demonstrate compliance with globally established ISO standards. These include the ISO/IEC 27001 standard, which contains recommendations for the organisation’s information security management, risks and control, and the ISO 9001 standard, which contains requirements for building and developing the organisation’s quality management system. Even if your organisation will not apply for certification, standards can be good source material for additional internal guidelines and the improvement of internal processes.
In addition, consider whether your organisation could draw up a code of conduct that defines procedures for the effective implementation of the right to erasure. Read more about codes of conduct.
Ensure that your organisation's personnel receives appropriate orientation and has the tools for handling requests for erasure. The processes must comply with the General Data Protection Regulation.
It may be a good idea to organise a test at the end of the orientation to ensure that your staff has understood the procedures. It is also good practice to arrange a practical exercise or simulation on the processing of an erasure request.
If possible, you can also create templates for responding to different types of erasure requests for your staff.
Evaluate the content of your organisation’s privacy statement(s) and, if necessary, supplement them with information on the right to erasure. Ensure that information on exercising the right to erasure is provided to the data subjects in a clear and easily understandable form.
When it is not possible to fully implement the right to erasure, the statements should describe the data to which the right applies.
Provide the data subject with the possibility to first submit a request to review their data so that they can confirm which personal data should be erased.
Also inform the data subjects of the consequences of erasing the data (e.g. impact on service use or the marketing prohibition).
Specify storage periods for all personal data in your organisation. For example, you can use a table that contains the personal data being processed, the legal basis for the processing and the corresponding storage periods.
Document the storage periods and grounds for processing personal data in the record of processing activities. Also describe the legal obligations on which the storage periods are based (e.g. data storage requirements provided for in the Accounting Act, the Working Time Act and anti-money laundering regulation).
Keep the storage periods up to date in the record of processing activities.
Improve the transparency of your organisation’s operations by also describing the storage periods of personal data in the privacy statement or, if this is not possible, the criteria by which they are determined.
Anonymisation refers to the processing of personal data in such a way that individuals can no longer be directly or indirectly identified from them (e.g. abstracting the data to a general level or statistical form). The right to erasure can be implemented by anonymising personal data. Effectively anonymised data are no longer personal data.
It is essential for the controller to ensure that the anonymisation is carried out in a technically efficient manner so that the individual cannot be effectively identified from the data anymore. Identification must be irreversibly prevented so that other parties can no longer connect the data to the person either.
Pseudonymisation means processing personal data so that they can no longer be linked to a specific individual without additional information. Pseudonymised data can still be personal data, in which case data protection regulations must be followed when processing them. The question of whether the data still constitute personal data must always be approached separately from the perspective of each organisation processing the data. As a rule, the right to erasure of personal data cannot be implemented through pseudonymisation.
More information on pseudonymisation and anonymisation
CJEU Decision C-413/23 P on pseudonymisation, EDPS v. SRB, in the EUR-Lex service
Ensure that your compliance or legal departments are involved in the procedures and decision-making when the erasure of data is refused or the implementation of an erasure request is postponed.
In such situations, employ technical and organisational measures such as anonymisation of personal data, encryption or restriction of access to the data.
Follow established technical standards to ensure the secure and structured erasure and destruction of data.
Make sure that the personal data are erased and destroyed in a manner that can be demonstrated afterwards.
The effect of erasure on backups can be limited, for example, by replacing the data to be erased with random character strings.
Positive experiences have been gained from software that automatically extracts all personal data related to a particular data subject from the controller’s internal systems and transfers them to backups that employees cannot access. In such cases, it should nevertheless be ensured that the personal data is either erased or fully anonymised afterwards, so that they can no longer be connected to an individual.