Get exclusive insights on privacy laws, compliance strategies, and product updates delivered to your inbox
The awareness around personal data privacy has increased in recent years, and as a result, the number of data subject requests has also steadily increased. Many businesses receive these requests and need to learn how to handle them. Learn how to respond to GDPR right to erasure request.
So, you received an erasure request, and now you wonder what it means and what you need to do. Or you want to learn more about it because you know that businesses increasingly receive such requests from random users on the internet. Whatever situation you’re in, by the end of this article, you’ll know what to do next.
The General Data Protection Regulation (GDPR) of the European Union equipped internet users with individual rights to defend their data privacy. These rights have also been embedded into national laws—the UK has passed the Data Protection Act 2018 and the UK GDPR, Denmark passed their own Data Protection Act, and so on.
The awareness around personal data privacy has increased in recent years, and as a result, the number of data subject requests has also steadily increased. Many businesses receive these requests and need to learn how to handle them.
In this article, we will dive deep into the following:
The GDPR right to erasure gives individuals the right to request the deletion of parts or all of their personal data that you process. It is widely known as the “right to be forgotten.”
The right to be forgotten is part of the GDPR data subject rights, a key instrument of Privacy by Design principles, which also include the right to access, the right to correct, the right to object, the right to object to being subject to automated decision-making and profiling, the right to data portability, and more.
The right is defined by GDPR Article 17 and Recitals 65 and 66.
It applies only to the personal information you hold at the moment of request, and when a user asks you to erase their data, you need to comply with it in most situations.
Unlike some GDPR individual rights, the right to erasure is not an absolute right, which means that there are situations where you must comply with the requests, but there are some exemptions to the rule where you don’t have to comply with them.
You must respond and comply with a deletion request every time no exemption applies, and that’s most situations you’ll face.
Remember that exemptions apply in rare cases and that the general rule exists for a good reason.
Article 17(1) of the GDPR says that you must honor a request to erase data when:
You don’t have to erase the user’s data in any of the following situations:
Yes, you can refuse an erasure request if it is unfounded or excessive.
The request is unfounded if the intent of the data subject is not to have their data deleted but something else. Some examples of unfounded requests include:
Requests are too many if they are about the same thing as other requests or if they overlap with other requests.
You can refuse unfounded or excessive requests. You still need to respond within one month of receiving it. In the response, explain to the user why the request has been refused.
In the case of doubt, seek legal advice or advice from the supervisory authority.
So, you’ve got a data subject erasure request. What should you do now?
Before explaining the process, it is essential to understand two things:
The process is simple. It involves the following steps:
Let’s dive into each step, one at a time. To explain them better, we’ll use an imaginary request for the erasure of an email address.
The GDPR obliges you to determine a method for receiving requests. It also obliges you to receive and accept any data subject request as if it has been submitted according to the designated method.
So, if you have a data subject request form on your website but the data subject submitted the request via email, you need to behave as if they contacted you through the request form.
Once you receive the erasure request, you have to respond to it without undue delay. It is good practice to inform the user that you have received it and that it will be answered within the 30-day deadline. You don’t have to give them any specific receipt for the request. Any piece of communication would do.
Then you can move to the next step.
You don’t want to delete the wrong person’s data because that would put you in legal trouble. That’s why you need to verify the data subject’s identity first.
If the user has a user account on your website, they could quickly delete personal information. Moreover, it would be easy for you to confirm their identity through their account.
However, that is not always this easy. Sometimes, verifying a user’s identity requires more effort from your side, so you can ask the data subject to take some reasonable steps to confirm who they are.
For example, deleting their phone number could involve sending them an SMS code. Deletion of an email address could include sending a code via email. You can choose your tools for identity verification depending on the data that needs to be deleted.
In our example, you can assume their identity if they contacted you via the same email address. Or you can send them an email code for better security.
In this step, you need to make sure that the erasure request:
If all three are true, continue to step 4.
Here is where you look at the data to find the exact pieces of personal information you need to delete.
To delete an email address from your CRM, you must log in to your CRM, find the email, and delete it. The same goes for deleting an address from email automation software.
Once you have found the required personal data, you can delete it. It is good practice to inform the data subject about it.
Once you delete the data, inform your data processors about the deletion. You’ll be liable if they keep processing the data you had to delete in case it somehow remained on their servers.
Not conforming to erasure requests means a violation of the GDPR. Violation of the GDPR means penalties.
To give you an idea of what may follow a violation, the procedure goes like this:
The third step, where the data protection agency investigates the case, is where things could get worse for you. When the DPA investigates a complaint, they do not examine only the data subject’s complaint. They can explore all your data privacy practices.
A complaint for refusing an erasure request may result in a decision that you have declined a request unlawfully, that you do not obtain valid consent, your privacy notice is not compliant, you do not log consent, you do not employ sufficient data security measures, etc. You get the idea.
If you don’t comply with a single request to delete data, the supervisory authorities may look at your company and find many other GDPR violations.
As we mentioned above, GDPR violations mean GDPR penalties. Some companies get away with orders and reprimands, but some pay hefty fines. Here are a few examples to get the big picture:
Businesses that know how to handle data privacy can quickly delete information when asked to do so.
At a minimum, you should do the following to streamline the process:
Book a call today if you would like more information about Secure Privacy and GDPR Cookie Consent compliance, or if you would like our data protection expert to perform a quick 'check-up' of your website, cookie consent banner, or cookie policy.
Explore more privacy compliance insights and best practices
