GDPR Jargon Buster - The right to be forgotten

GDPR Jargon Buster - The right to be forgotten

GDPR Jargon Buster: Accountability

The “right to be forgotten”, referred to in law as the right to erasure, is a data subject right provided by the General Data Protection Regulation (UK GDPR). This right empowers individuals (data subjects) to request the removal of their personal data from the records of organisations that process their information. 

Under Article 17 of the UK GDPR:

Data subjects can request the erasure of their personal data at any time, verbally or in writing, but a controller only has to fulfil the request in certain circumstances, including:

  • Because the data is no longer necessary for the purposes it was collected for
  • When “consent” was the lawful basis of processing and this is withdrawn, and there is no other lawful basis
  • When a person exercises their right to object to processing for marketing purposes

Controllers have one month to respond to requests.

A qualified right

However, even if the right appears to apply, it is not absolute, and organisations may refuse erasure requests in certain situations, such as where the processing is required:

  • To comply with a legal obligation
  • To exercise freedom of expression and information
  • For the performance of a public interest task or in the exercise of official authority
  • For public interest archiving or research purposes, where erasure is likely to seriously impair that processing

How to comply

Erasure must be effected across all of the controller’s systems - live and archived or backup. Individuals must be informed if there will be delay in making erasures from backup systems. In any event, data in backup systems must be put beyond use until it is erased.

If a controller has disclosed data to another controller, it must, taking account of available technology and the cost of implementation, take reasonable steps to inform recipient controllers of the erasure request. ICO guidance states this is not required if it is impossible or involves disproportionate effort.

For more information or advice on data protection compliance, please contact Beverley Flynn or any member of the commercial and technology team.

Contact our experts for further advice

Search our site