In the previous articles, we have analysed the various rights that a data subject can exercise under the provisions of GDPR. The first right which opens the way to the others is the right to access the personal data submitted to the data controller for the purpose of processing. However, just access is not enough. The framers of GDPR understand this and hence have also provided for the right to rectification and the right to erasure.
In this article we shall discuss the various provisions pertaining to the Right to Erasure which is also known as the Right to be Forgotten.
So what exactly does right to be forgotten mean? It means what it states. The right to not be remembered… It would seem strange to be forgotten but it does have relevance in today’s times when everything can be so easily found by tapping a few buttons on our keyboards and many a times, the information that is found on the internet is not always favourable for the reputation of the individual who is being searched. To protect the individual’s reputation and safety and more importantly to reinforce the right of the individual to not reveal to the world his/her data which is no longer relevant or to do with his/her past, GDPR comes into the picture.
The following provisions are a part of Article 17:
- The data subject shall request the data controller to erase his/her personal data and the data controller must comply within one month of the request if the following grounds apply:
-The personal data is no longer necessary for the original processing purpose
-The data subject has withdrawn consent and also there is no legal ground for processing
-The personal data has been unlawfully processed
-The personal data has to be erased to conform to the Union or Member State laws
-The personal data had been collected to offer services to a child
- When the personal data has been made public, it is the responsibility of the data controller to inform the data processors about the data erasure request. This shall be done taking into account the available technology and the cost of implementation. The data processors shall in turn ensure that the publicly available personal data is not replicated.
Notwithstanding the above, the data controller shall not concede to the data erasure request in case of the following:
- If the data processing is integral to the freedom of expression and information
- If the processing is necessary to be compliant with the Union or Member State law
- In the case of public interest especially public health
- If the data is in use for archiving purposes in public interest, scientific, historical or statistical research purpose
- If the data is processed to establish, exercise or defend legal claims