An organisation runs some public email lists. These are archived, and the archives are also publically available from its website.

A user of the mailing list asserts their "right to be forgotten" and asks that all personal data held by the organisation be deleted.

The organisation redacts all references to A. Person having email address a.person@example.com (as well as other identifying header information like IP addresses) in the list archives, replacing them with Anonymous 12345, anon-12345@example.org, and so on, and retains no record of the mapping.

Would this comply with the request?

The organisation itself has no way to reverse the mapping, but clearly anyone who has received a copy of the message is able to do so.

I am considering this in respect to Recital 26.

If not acceptable, presumably there is no way to allow for archives to be maintained in the face of such a request other than by claiming exemption? (Is this perhaps stackexchange's approach? ie. delete personal data (accounts) on request but claim exemption on supplied content.)

For electronic mailing list archives, one might also substitute tournament results; or the timetable of a conference that the person attended as a speaker.

  • 1
    It's worth noting that exercising the "right to be forgotten" can apply not only to the metadata of this archive (e.g. Sent / Received fields) but also to message context. It may well be the case that John Doe never was a user of your mailing list, but found that your archive publishes a thread where two unrelated users are talking about John Doe, exposing his private information, and requests that information to be redacted. The request might or might not be binding, depending on all kinds of circumstances, but you certainly may get such a request. – Peteris Feb 17 at 14:57

I agree with Ben that there are many exemptions to the right to be forgotten. For example if messages are removed from a mailing list archive, the replies to deleted messages will become useless. That would impact the right of freedom of expression and information of those authors. That is one of the exemptions to the right to be forgotten. So there is no right to delete complete messages. Replacing references to names and email addresses, is a very good solution.

It must not be possible to de-anomize the data. So having anon-20190213-123@example.org, it must not be possible to get back A. Person <a.person@example.org>.

Sure, everyone who received a copy of those messages can find that message in their own archive, and see the author that way. But that is because they simply have a copy of the full archive. The right to be forgotten is independent of someone else having the same information you request to delete. For example google removes search results in its index, even though the same information can still be found on the original website. To fully exercise the right to be forgotten, you have to make a request to everyone who has that data.

In Austria there is a recent case (ECLI:AT:DSB:2018:DSB.D123.270.0009.DSB.2018) (available only in German) where someone's data was anonymized after asserting his "right to be forgotten". He did not agree and wanted his data to be fully deleted, so he filed a complaint at the Austrian DPA. The DPA denied his request.

I have tried to make a translation of the relevant part of the judgment, note that many references are to other Austrian judgments or books (where I listed the ISBN instead).

D.1 The binding part of the GDPR does not contain the term "anonymisation". Only recital 26 states that the GDPR does not apply to anonymous data.

D.2 The term "erasure of personal data" as used in Art. 17 is neither found in the binding part nor in the recitals. In Art. 4(2) erasure and destruction are listed as alternative forms of processing which are not necessary identical. This means that erasure does not necessarily requires final destruction. (cf. K121.375/0012-DSK/2008, with regard to Directive 95/46/EC, where also a distinction was made between erasure and destruction; cf. ISBN 978-3-406-72006-2). Such a differentiation also results from the case-law of the Constitutional Court (cf. VfSlg. 19.937/2014).

Therefore, the person in charge is entitled to make a choice with regard to the means - i.e. the manner in which the data is deleted - (cf. again ISBN 978-3-406-72006-2, according to which reference is made to the destruction of keys or other decryption devices without the removal of the data itself; cf. in this sense also ISBN 978-3-406-71932-5, which refers to the impossibility of perceiving the information previously embodied in the data to be deleted; cf. also ISBN 978-3-406-72007-9, according to which deletion is to be understood as any kind of conceilment of stored personal data; cf. also Warter, Dako 2/2018, 39 [40], according to which the result of the deletion action is decisive).

The removal of the personal reference from personal data ("anonymisation") can thus in principle be a possible means of deletion within the meaning of Art. 4(2) in conjunction with Art. 17(1) GDPR. However, it must be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort (cf. RS0125838, according to which it is not sufficient to merely change the data organisation in such a way that "targeted access" is not possible any more; cf. also the judgment of the CJEU of 19 October 2016, C-582/14, 45 ff.). Only if the person responsible aggregates the data in a way that no data can be identified, can the resulting data stock be described as anonymous (i.e. without personal reference) (see Opinion 05/2014 on Anonymisation Techniques of the former Art. 29 Data Protection Working Party, WP216, p. 10).

The Administrative Court has also ruled - with regard to the comparable legal situation under the DSG 2000 - that a redaction (blacking out), for example, can be regarded as a form of deletion. By making the name of the data subject and all other data relating to him or her unrecognisable, his or her request for deletion is complied with (cf. the decision of 23 November 2009, 2008/05/0079).

So anonymisation is sufficient to comply with a right to be forgotten request.

  • Thanks. "redaction" looks like much more accurate word than "anonymisation". Should I retitle my question perhaps? – jhnc Feb 16 at 23:22
  • English is not my native language, so I don't know what is best. But the Art.29 WP Opinion on Anonymisation Techniques does not use the word "redaction". – wimh Feb 16 at 23:46

There are a number of loopholes in GDPR Article 17 which may exempt the organization from having to comply with the right to be forgotten request. For example, if the organization is a public body with open records obligations, then it may not be permitted to delete or modify email records. Or if the public email lists are "exercising the right of freedom of expression and information" then that would override the data subject's request as well. There are also several other grounds for refusing a right to be forgotten request.

Also note that there's nothing in Article 17 that suggests anonymizing or pseudonymizing the data is sufficient to comply with a right to be forgotten request. The "right to erasure" means just that: erasure.

I've previously written this explainer on the right to be forgotten that might be helpful.

  • When I say anonymising I am expecting that the personal data is deleted. Compare stackexchange where you can delete your account, but the articles will remain. Has this approach been tested in law? I agree there are exemptions, but in the case where the controller chooses to delete the personal data but retain linked information, how anonymous is anonymous? – jhnc Feb 14 at 15:49
  • I can't find any examples where this question has been tested with a data protection authority. If the organization chooses to delete the personal data but retain linked information, provided that information cannot be used "by reasonable means" to identify the person, then it seems the organization will have obliged the request. There may also be clues for you in Article 17(2), which requires the controller to "take reasonable steps" to inform other controllers of the erasure request. The ICO interprets this as relevant to "social networks, forums or websites." – Ben Wolford Feb 14 at 16:30
  • Thanks for looking. Yes, I may have another question about reasonable steps later - in this interconnected world, what is reasonable? A notice on a website saying "A Person and B Persson have requested that you delete all personal data that you hold about them" seems problematic... – jhnc Feb 14 at 17:12
  • @jhnc the reference to "other controllers" refers not to random physical persons who might have seen the data, but to other controllers and processors of personal data (as defined by GDPR) to whom you gave this data. As you're only allowed to transfer this data if you have a legal agreement with them about how they'll meet GDPR obligations (including the right to erasure), and you're required to have an exhaustive list of such controllers (e.g. so you can provide it to the users if they ask where their data has been transferred), it should be trivial to inform other controllers and processors. – Peteris Feb 17 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.