I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/Surname, job Title and the mailing address I had. They are at the end of some pdf document as a contact. This is not a big concern, but I would rather make those disappear. I really don't like to be exposed on internet. I already emailed them few times, they answered "Yeah, will do it!" but then did nothing, all the data is still on their website.

  1. Can they publish this kind of data?
  2. Can I force them to remove it using RGPD (also called GDPR)?
  • 3
    See also my answer on this question, if they said they would delete it, they basically admit they have no purpose or legal basis any more for the processing. So they have to comply with your request within a month after you made the (first) request. (The french DPA is cnil.fr if you want to make a complaint).
    – wimh
    Apr 3, 2019 at 20:40

1 Answer 1

  1. A controller may have a good reason to publish or otherwise process information about a person even where that person has made a lawful request for erasure, restriction of processing, etc. However, the continued processing must itself be lawful. The many permutations do not permit a clear-cut answer to this question.
  2. You have the right to request that personal data be erased (Art. 17), and to object to its processing (Art. 21). As per the answer wimh linked to in their comment, if the request is not complied with you have a judicial remedy by which to potentially "force" the controller to remove your personal data, and can make a complaint to the supervisory authority at any time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .