The Regulation introduces, among others, the right
to erasure of personal data, also known as the
“right to be forgotten”. In theory, this means that
the data subject has the right to request the
controller to erase his or her personal data without undue delay, and the controller has the obligation
to erase all the personal data without undue delay
if one of the grounds listed in the Regulation
applies. The controller is required to erase personal
data at the request of the data subject, among
others, when:
– the personal data is no longer necessary in
relation to the purposes for which it was collected
or otherwise processed;
– the data subject withdraws consent on which the
processing is based and there is no other legal
ground for the processing;
– the data subject objects to the processing of his
or her personal data;
– the personal data has been unlawfully processed.
It is also the controller’s obligation under the
Regulation to ensure that all the copies,
replications, or other references (e.g. online links
to the data) are erased. It is not enough to merely
deactivate the data, the data should be completely
erased. The Regulation also makes the controller
responsible for erasure of any data retained by
third parties. The controller is also under an
obligation to inform controllers processing personal
data that the data subject has requested erasure of
his or her personal data. The right to be forgotten
is relevant in particular where the data subject has
consented to the processing of his or her personal
data as a child or was not fully aware of the risks
involved by the processing and would subsequently
wish to erase his or her personal data.
The Regulation also introduces exclusions from the
right to be forgotten. The right does not apply to
the extent that data processing is necessary:
– for exercising the right of freedom of expression
and information;
– for compliance with a legal obligation which
requires processing by European Union or
Member State law to which the controller is subject
or for the performance of a task carried out in the
public interest or in the exercise of official
authority vested in the controller;
– to safeguard the objectives of health and public
interest in the area of public health;
– for archiving purposes in the public interest,
scientific or historical research purposes or
statistical purposes;
– for the establishment, exercise or defence of legal
claims.
The controller may refuse to erase personal data on
the grounds of the above exclusions. Under such
circumstances, while failure to erase the data
should be deemed lawful, it is the controller’s
obligation to inform the data subject of the reasons
for the refusal.
The amendment of the law poses many challenges
to controllers of personal data and processors that
process the data at controllers’ request. Under pain
of financial liability, controllers will need to realign
their internal procedures with the purposes of
protection of the rights vested in data subjects.
Ensuring a fast and effective response to the
request for erasure of personal data can become
the main issue. Many enterprises retain massive
amounts of personal data. Thus, organisational and
technical obstacles can prove a material hindrance
to the processing of a large number of such
requests in a short period of time. In practice,
enforcing the effectiveness of a request for erasure
of personal data may prove very difficult indeed.
MILLER, CANFIELD,
W. BABICKI, A. CHEŁCHOWSKI I WSPÓLNICY SP.K.
ul. Batorego 28-32
81-366 Gdynia
Tel. +48 58 782-0050
Fax +48 58 782-0060
gdynia@pl.millercanfield.com
ul. Nowogrodzka 11
00-513 Warszawa
Tel. +48 22 447-4300
Fax +48 22 447-4301
warszawa@pl.millercanfield.com
ul. Skarbowców 23a
53-125 Wrocław
Tel. +48 71 780-3100
Fax +48 71 780-3101
wroclaw@pl.millercanfield.com
Disclaimer: This publication has been prepared for clients and professional associates of Miller Canfield. It is intended to provide only a summary of
certain recent legal developments of selected areas of law. For this reason the information contained in this publication should not form the basis of any
decision as to a particular course of action; nor should it be relied on as legal advice or regarded as a substitute for detailed advice in individual cases.
The services of a competent professional adviser should be obtained in each instance so that the applicability of the relevant legislation or other legal
development to the particular facts can be verified.