THE RIGHT TO BE FORGOTTEN

30 July 2018

• GDPR
• general data protection regulation
• personal data
• data privacy
• Solicitors Liverpool
• GDPR liverpool
• SAR
• Subject Access Request
• data subject
• The right to be forgotten
• Data protection act 2018
• Right of Erasure
• anonymisation
• GDPR ARTICLE 17

Companies need to consider what technical measures they can take in an effort to adhere to the data subject's right to erasure, or 'right to be forgotten'.

Anonymisation ensures that the anonymised data is no longer identifiable to a person. Therefore, it is no longer considered personal data under GDPR. Where anonymisation has been done, and a subject access request (SAR) follows, you would be then able to explain that you no longer have personal data related to that subject on your database. That said, anonymised data is very hard to achieve perfectly and leaves some risk unless performed properly.

Of course, there may often be good grounds for keeping personal data for historical, statistical or research purposes. The Data Protection Act enabled personal data held for these purposes to be kept indefinitely as long as it was not used in connection with decisions affecting particular individuals, or in a way that is likely to cause damage or distress. GDPR continues this, as long as the data is deleted when there is no longer a lawful basis of retention. GDPR Article 17 deals with the data subject’s right to erasure, and specifically gives grounds as “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed”.

However, it may be necessary to process the data in order to fulfil a legal obligation. The retention of an identifier or even pseudonymisation would help, as long as the algorithms are secure.

In respect of deletion, technical measures are relatively simple but depend on the platform, nature of processing, basis for processing and many other things.

Many systems operate with a "soft delete" delete function, such as marking data which is deleted without actually removing it, but this is not erasure.

It must be also be appreciated that a person can have more than one interaction at the same time. For example, a person who works for Sky can be a customer as well as an employee. This would therefore require careful planning as opposed to a 'simple' deletion exercise, and similar complexities will undoubtedly occur for objections and SAR's.