Zum Hauptinhalt
Textseite

Deletion periods

Abschlussbedingungen

Deletion periods


The "right to be forgotten" obliges the controller to delete personal data as soon as the original purpose for the data processing no longer applies. However, other legal requirements must also be taken into account, such as retention periods under tax law. 


Art. 17 GDPR Right to erasure (‘right to be forgotten’)

1) […] the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b. the data subject withdraws consent […].

c. the data subject objects to the processing pursuant to Article 21(1) […]

d. the personal data have been unlawfully processed;

e. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

f. he personal data have been collected in relation to the offer of information society services referred to in Article 8(1).



Example

If a training company collects data from participants for support during the training, this data should actually be deleted at the end of the training programme, as the original purpose no longer applies. 

The company may now only store this data if there is another legal basis for doing so. For example, there could be a legal obligation for the company to retain information on training participants for tax reasons. In any case, check whether all the data collected is necessary or whether at least some of the data can be deleted. 

The argument "The person took part in our training programme and we want to contact them in the future, e.g. to offer them new training courses" is not valid here. The company requires the data subject's separate consent for this.


Source: OpenIcons on Pixabay