anonymisation/redaction of public website content as response to 'right to erasure'

Question

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website.

A user of the mailing list asserts their "right to be forgotten" and asks that all personal data held by the organisation be deleted.

The organisation redacts all references to A. Person having email address [email protected] (as well as other identifying header information like IP addresses) in the list archives, replacing them with Anonymous 12345, [email protected], and so on, and retains no record of the mapping.

Would this comply with the request?

The organisation itself has no way to reverse the mapping, but clearly anyone who has received a copy of the message is able to do so.

I am considering this in respect to Recital 26.

If not acceptable, presumably there is no way to allow for archives to be maintained in the face of such a request other than by claiming exemption? (Is this perhaps stackexchange's approach? ie. delete personal data (accounts) on request but claim exemption on supplied content.)

For electronic mailing list archives, one might also substitute tournament results; or the timetable of a conference that the person attended as a speaker.

Answer 1

I agree with Ben that there are many exemptions to the right to be forgotten. For example if messages are removed from a mailing list archive, the replies to deleted messages will become useless. That would impact the right of freedom of expression and information of those authors. That is one of the exemptions to the right to be forgotten. So there is no right to delete complete messages. Replacing references to names and email addresses, is a very good solution.

It must not be possible to de-anomize the data. So having [email protected], it must not be possible to get back A. Person <[email protected]>.

Sure, everyone who received a copy of those messages can find that message in their own archive, and see the author that way. But that is because they simply have a copy of the full archive. The right to be forgotten is independent of someone else having the same information you request to delete. For example google removes search results in its index, even though the same information can still be found on the original website. To fully exercise the right to be forgotten, you have to make a request to everyone who has that data.

In Austria there is a recent case (ECLI:AT:DSB:2018:DSB.D123.270.0009.DSB.2018) (available only in German) where someone's data was anonymized after asserting his "right to be forgotten". He did not agree and wanted his data to be fully deleted, so he filed a complaint at the Austrian DPA. The DPA denied his request.

I have tried to make a translation of the relevant part of the judgment, note that many references are to other Austrian judgments or books (where I listed the ISBN instead).

D.1 The binding part of the GDPR does not contain the term "anonymisation". Only recital 26 states that the GDPR does not apply to anonymous data.

D.2 The term "erasure of personal data" as used in Art. 17 is neither found in the binding part nor in the recitals. In Art. 4(2) erasure and destruction are listed as alternative forms of processing which are not necessary identical. This means that erasure does not necessarily requires final destruction. (cf. K121.375/0012-DSK/2008, with regard to Directive 95/46/EC, where also a distinction was made between erasure and destruction; cf. ISBN 978-3-406-72006-2). Such a differentiation also results from the case-law of the Constitutional Court (cf. VfSlg. 19.937/2014).

Therefore, the person in charge is entitled to make a choice with regard to the means - i.e. the manner in which the data is deleted - (cf. again ISBN 978-3-406-72006-2, according to which reference is made to the destruction of keys or other decryption devices without the removal of the data itself; cf. in this sense also ISBN 978-3-406-71932-5, which refers to the impossibility of perceiving the information previously embodied in the data to be deleted; cf. also ISBN 978-3-406-72007-9, according to which deletion is to be understood as any kind of conceilment of stored personal data; cf. also Warter, Dako 2/2018, 39 [40], according to which the result of the deletion action is decisive).

The removal of the personal reference from personal data ("anonymisation") can thus in principle be a possible means of deletion within the meaning of Art. 4(2) in conjunction with Art. 17(1) GDPR. However, it must be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort (cf. RS0125838, according to which it is not sufficient to merely change the data organisation in such a way that "targeted access" is not possible any more; cf. also the judgment of the CJEU of 19 October 2016, C-582/14, 45 ff.). Only if the person responsible aggregates the data in a way that no data can be identified, can the resulting data stock be described as anonymous (i.e. without personal reference) (see Opinion 05/2014 on Anonymisation Techniques of the former Art. 29 Data Protection Working Party, WP216, p. 10).

The Administrative Court has also ruled - with regard to the comparable legal situation under the DSG 2000 - that a redaction (blacking out), for example, can be regarded as a form of deletion. By making the name of the data subject and all other data relating to him or her unrecognisable, his or her request for deletion is complied with (cf. the decision of 23 November 2009, 2008/05/0079).

So anonymisation is sufficient to comply with a right to be forgotten request.

Answer 2

There are a number of loopholes in GDPR Article 17 which may exempt the organization from having to comply with the right to be forgotten request. For example, if the organization is a public body with open records obligations, then it may not be permitted to delete or modify email records. Or if the public email lists are "exercising the right of freedom of expression and information" then that would override the data subject's request as well. There are also several other grounds for refusing a right to be forgotten request.

Also note that there's nothing in Article 17 that suggests anonymizing or pseudonymizing the data is sufficient to comply with a right to be forgotten request. The "right to erasure" means just that: erasure.

I've previously written this explainer on the right to be forgotten that might be helpful.