4

I wasnt able to find an explanation inside the GDPR whether a data privacy officer (or similar responsible) is allowed or required to document cases where individuals claimed the right to be forgotten.

Is it against the law to document the individual cases? edit for clarification: Such as "on Feb 26th Mr. John Doe inquired via e-Mail and requested to purge all his data". Now there is another data set about John Doe, documenting his deletion request, whereas he initially inquired to have his data erased. Instead of being forgotten, he is now remembered in one extra data collection. /edit

On one hand documenting the process allows a company to prove they obeyed the law and the request, should this be questioned later on by the individual.

I can even imagine a former employee first claiming his right to be forgotten, and then - a week after getting the confirmation - claiming his right to receive a resumee (a right in existense in Germany), which a company would not be able to fulfill as it hasnt got any data to base the resumee on. In case they do not have documentation, that the former employee requested to be forgotten, they cannot tell this.

On the other hand documenting such cases is 180 degree against the original request to be forgotten, as the individual ends up being stored in yet another data processing process.

Improve this question

2 Answers 2

Reset to default
4

The "right to be forgotten" is not absolute. It is subject (Art. 17) to certain conditions, in particular the absence of "overriding legitimate grounds for the processing" (1(c)).

3(b) explicitly exempts data controllers from the erasure where needed "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject".

I can even imagine a former employee first claiming his right to be forgotten, and then - a week after getting the confirmation - claiming his right to receive a resumee (a right in existense in Germany), which a company would not be able to fulfill as it hasnt got any data to base the resumee on.

If the "right to receive a resumee" indeed exists in Germany and employers need to comply with it, that would be perfectly legitimate ground to only partially fulfil the request to be forgotten⁠ — forget everything but the resume.

Is it against the law to document these cases?

If you document "On 27 February 2020 John Smith requested to be forgotten so we deleted or anonymised all his records", you will effectively NOT forget him. If you actually had to forget him, it will therefore be against the law to document your forgetting that way.

Improve this answer
3
  • Thanks for your edit after my edit :) Now it actually answers my question, and your answer is what I assumed before asking the question. My opinion on the result: Being responsible for this kind of activity in my company it still "feels wrong" to spend hours working on certain cases and not to document anything about it. I feel someone will come around and ask "Did you obey to the request of Mr. Smith?" and me having to say "Mr. Smith? Never heard of him...".
    – modmatt
    Commented Feb 26, 2020 at 15:45
  • @modmatt "I feel someone will come around and ask 'Did you obey to the request of Mr. Smith?' and me having to say 'Mr. Smith? Never heard of him...'". Resorting to that kind of false representations is one logical & possible consequence of adopting the misleading/self-defeating approach of deleting the subject's request itself. The reason of being of the right to be forgotten is to dissociate a person's reputation and/or dignity from unfavorable or degrading events, not to make one's own name become a taboo in and of itself.
    – Iñaki Viggers
    Commented Feb 26, 2020 at 17:34
  • It's a good answer but just to add, all processing operations are not equal. Storing a log of requests for a limited time in a database, spreadsheet or software tool to which those involved in compliance and data protection have access, but which is not widely accessible, is not the same as the person being in your CRM, or having a personnel file potentially accessible by HR, managers, etc. @IñakiViggers is also on point, IMHO.
    – Sam_Butler
    Commented Feb 28, 2020 at 13:45
2

where individuals claimed the right to be forgotten. Is it against the law to document these cases?

The GDPR actually encourages properly documenting these cases, since that relates to the controller's ability to prove compliance with the GDPR.

See, for instance, recitals 74 and 77:

In particular, the controller should [...] be able to demonstrate the compliance of processing activities with this Regulation

[...]

Guidance [...] on the demonstration of compliance by the controller or the processor [...] could be provided in particular by means of approved codes of conduct [...] or indications provided by a data protection officer.

The right to erasure requests clearly is within scope of "processing activities" in the GDPR. See recitals 65, 66, 68, art. 4(2) (definition of 'processing'), art. 5.1(d), and elsewhere. Likewise, art. 5.2 provides that "[t]he controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')" (emphasis added).

Improve this answer
8
  • Documenting individual data handling cases is certainly not the only way compliance can be demonstrated. The GDPR does not directly encourage that sort of documenting.
    – Greendrake
    Commented Feb 26, 2020 at 15:05
  • 1
    @Greendrake The GDPR speaks for itself. The term "demonstra[ting] compliance of processing activities" nowhere excludes proof of compliance with individual requests and is nowhere limited to proof of controller's code of conduct.
    – Iñaki Viggers
    Commented Feb 26, 2020 at 15:35
  • 1
    Sure — compliance can be demonstrated by whatever means. But documenting individual cases effectively keeps personal data which, at the end of the day, demonstrates non-compliance.
    – Greendrake
    Commented Feb 26, 2020 at 16:43
  • 1
    @Greendrake "documenting individual cases effectively keeps personal data which, at the end of the day, demonstrates non-compliance". ... only if one's mindset is that logging a person's request for erasure equals the preservation of the actual data such person asked to erase. Someone with that [mis-]interpretation of the right to be forgotten would have to conclude, for instance, that the right is irreversibly preempted/stricken in Google Spain v. Costeja.
    – Iñaki Viggers
    Commented Feb 26, 2020 at 17:22
  • 1
    I think this is the correct answer. The Article 17 right is not absolute - it does not oblige controllers or processors to abide by an erasure request in any and all circumstance - and surely one can argue grounds for keeping a record of the request and its execution under 17 3(b) and 3(e). How for example would one maintain a 'suppression file' of persons who have requested erasure and to never be sent any marketing material in the future?
    – Lag
    Commented Feb 27, 2020 at 10:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .