2

I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data.

Some things are obvious to me: personal information like name, email and any text/images/content they added etc.

What's less obvious to me:

  • Do I have to delete our internal user ID (never shown to anyone on the platform, except possibly to the user themselves)?
  • Do I have to delete statistics about how this - after deletion anonymous - user used the platform, e.g. which pages they visited? They're on our own server.
Improve this question

2 Answers 2

Reset to default
5

Art. 17 GDPR, Right to erasure (‘right to be forgotten’) requires “erasure of personal data concerning him or her”. That’s all personal data.

However, this only applies when this article applies. Section 1 details when this is and sections 2 and 3 detail limitations and exceptions to the right of erasure. For example, you would be allowed to keep financial records that you're legally obligated to keep. So, if they have the right, you have to delete all their personal data that is not exempted.

Aggregate statistics and other anonymous data in the sense of Recital 26 are not personal data and don't have to be deleted. Whether the kinds of data you have mentioned would be sufficiently anonymous would require further analysis.

Improve this answer
4
  • you my also retain data that is necessary - for example if an E-mail address is banned.
    – Trish
    Jan 21, 2021 at 0:16
  • When there is a legal basis other than consent, Art b17(2) may provide an exception to the requirement to delete.
    – David Siegel
    Jan 21, 2021 at 2:09
  • The GDPR also only requires that deleted data be "put beyond use". The data itself might still be on disks or tapes and theoretically retrievable, but it doesn't appear in the results of a database query or in the regular processing of data (which is of course documented as per other bits of the GDPR). This point is normally raised in connection with backups, but it applies more generally.
    – Paul Johnson
    Jan 21, 2021 at 16:05
  • What about log data like an IP address?
    – Justin Thomas
    Feb 16 at 12:13
-5

According to Art. 17 GDPR, Right to erasure (‘right to be forgotten’) you have to delete everything including internal IDs and statistics of the user behaviour.

Improve this answer
1
  • 4
    As @Dale M says, "personal information" must be deleted. If internal IDs or stats cannot (or can no longer) be associated with an individual person, then they are not personal data. Nothing in Art 17 specifies what "personal data" is beyond the general definition of this for all GDPR purposes.
    – David Siegel
    Jan 20, 2021 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .