Right to be forgotten - Eliminating traces on the internet

The right to be forgotten is becoming increasingly important in the age of digitalisation. It is intended to ensure that personal data is not available on the internet for all eternity and gives you the opportunity to have various information about yourself deleted.

The following article explains exactly how to proceed and under what conditions deletion is possible.

Content

• Can I request that my data be deleted?
• What does the so-called right to be forgotten mean?
• When is there no right to erasure?
• How do I request the deletion of my data?
• Which data must be deleted?
• How long may data be stored?
• Conclusion - How to enforce your right to be forgotten

Can I request that my data be deleted?

Since May 2018, the General Data Protection Regulation (GDPR) has guaranteed uniform data protection throughout Europe. The aim is to create more transparency in the processing of data. Companies must provide various information on data processing upon request.

This includes, for example, information about which personal data has been stored, for what purpose and for how long.

Article 17 of the GDPR also provides for the right to erasure. Under certain circumstances, companies are obliged to delete your data. This is the case if

• your data is no longer necessary for the purposes for which it was collected or otherwise processed.
• your data was not processed lawfully from the beginning.
• you have revoked the consent you previously gave to the processing of your data.
• you have objected to the processing of your data and the controller cannot give any legitimate reasons for processing it
• deletion of your data is required due to another legal basis.
• a minor has registered with a social network or information society services and data relating to the services offered have been collected from him or her here.

What does the so-called right to be forgotten mean?

In addition to the right to erasure, the right to be forgotten is a special feature of the GDPR. Through Art. 17 (2) of the GDPR, your request to have your data removed affects not only the controller itself, but also third parties.

Thus, the controller who has published data about you is obliged to do everything reasonable to remove your "traces" on the internet. He must ensure that third parties are informed of your intention to delete and that they delete the links to your data.

Example: X is a search engine operator who has processed Y's data. Y has exercised his right to be forgotten and has asked him to delete his data. X must now delete all search results on Y and inform all operators of other websites to which his search engine links about Y's deletion request. They must then also take action.

When is there no right to deletion?

There are exceptional cases in which there is no right to deletion. This is the case if

• your data is still being used and is necessary for processing.
• the data processing serves the assertion, exercise or defence of legal claims.
• your data is used to exercise the right to freedom of expression. This is the case, for example, on social networks or rating portals.
• Your data are processed to fulfil a legitimate public task or the public interest. This is especially possible in the context of public health.
• the processing of the data is necessary for the purposes of research, science or statistics and deletion could seriously impair this or make it impossible.

How do I request the deletion of my data?

In order to be able to request the deletion of your data, it is first advisable to find out what personal data has been stored about you at all. Here, the free right to information via Art. 15 of the GDPR will help you.

According to Art. 15 DSGVO, you can request

• that the controller informs you whether personal data have been processed.
• that the controller informs you what has been stored. If no data has been processed, he must provide you with so-called negative information to the effect that no data has been processed.
• that you receive a copy of the stored data. This will help you to proceed further with the deletion.

No particular form has to be adhered to, but for evidence purposes, it is advisable for requests for information to be in writing (e-mail or letter). Some platforms such as Facebook also have ready-made templates and menu items that you can use to request information.

Example of a cancellation request

Sender: XXX

To: XXX

Deletion of personal data according to Art. 17 DSGVO

Please state customer no. or e-mail address if this has been deposited with the person responsible.

Dear XXX,

You have stored personal data of mine (XXX - indicate here the data previously identified and to be deleted).

It is unlawful to store this data because I have not given you effective consent for data processing (XXX - at this point you can give one of the reasons explained earlier in this guide).

For this reason, I request that you delete my personal data immediately.

If you have disclosed my personal data to other third parties, I also request that you inform them of the deletion of my personal data. Please confirm the deletion of my personal data and that third parties have been informed of my request for deletion.

If you do not comply with my request for deletion, I request that you disclose the reasons.

Yours sincerely

XXX

What data must be deleted?

All personal data must be deleted. By "personal" we mean everything that has been stored and is related to your person. This includes, for example, your name, address or posts you have shared on social media platforms.

The person responsible must then delete these without delay. This means that he must act as soon as possible after he has learned of your wish to delete. He must not let time pass unnecessarily.

If he does not respond to your request for erasure, he must inform you at the latest one month after the request has been made why he will not take any action (Art. 12 III GDPR). An extension of this deadline is possible by way of exception if, for example, the number of requests for deletion leads to organisational problems for the controller.

How long may data be stored?

In addition to the above-mentioned cases in which deletion is possible, the principle applies that data may only be stored for as long as is necessary and appropriate for the agreed purpose. If this purpose ceases to apply, the data controller must delete the data.

Example: Employer X stores the data of applicant Y for the purpose of applying for a job in his company. Within the application procedure, Y is rejected. In itself, the purpose of the data processing would have ceased to exist. However, case law gives X the authority to store applicant data for up to six months after rejection. The reason is that applicant Y could legally defend herself against the decision. For example, if you feel you were treated unfairly and discriminated against in the application process.

Conclusion - How to enforce your right to be forgotten

• The GDPR gives you the right to have your personal data deleted (Art. 17 GDPR).
• Upon your request, the controller must delete your personal data.
• The right to be forgotten is an "extension" and obliges the controller who published your data to inform all third parties of your request for erasure and to require them to remove the link to your data.
• A right to erasure exists when the purpose for processing the data no longer applies. There are also other options, such as revoking your consent to data processing or if data has been processed unlawfully.

Picture credits: SvetaZi | panthermedia.net