GDPR - Right to erasure - Conflicting laws

Question

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to as "Forget me".

My assumption is that the functionality will have to consist of a mix of deletion of records and anonymization. Especially where there are transactional data that cannot be deleted or for that sake cannot be legally deleted.

Another assumption about the procedures is that the end-user will have to be notified in advance about the "Forget me" job with a date and time. It would be impossible to notify after the job has been done, because then you would need the information that has just been erased. Of course if the customer calls at the date given then customer service would have no records of this customer and would not be able to search by any information given.

Accountability?

In this respect what about all logs of work done? Emails sent would necessarily have the mail-to address stored. I believe there is a conflict of laws, you are legally bound to keep log of messages since it documents work done, but on the other hand you cannot know who this person is. You could anonymize the email address, but then again what about the content of the communication?

Backups?

Does the law also mean that backups will have to "Forget"? That would be very impractical with write-once or streaming type media. How about backups prior to 2018? Backups may legally have to be stored for 10 years, but some would want to store them even longer.

Answer 1

Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions.

Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion.

For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail.

The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer".

GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.

Answer 2

From discussions and training I have some extra information that somewhat answers my question by further complicating it.

Article 30 Records of Processing

You are required to keep records of all processing and transfer of information. In the event of data breach the subject has to be communicated to, regardless if he has previously wanted to be forgotten. Likewise you can communicate that their data has been erased.

Practically I would think this needs to be a separate restricted system.

Backups

Backups cannot be used as archives, they are purely for a system restore in the event of crash. There may be little reason to keep backups for very long. On the other hand archiving may also need to be a separate restricted system.