5

This concerns my student loans repayment account which is managed by the gov.uk website. I have paid my loan back in full and have had a confirmatory letter stating this as well, as I wanted to ensure I have written proof.

When on the phone with the student loan repayment hotline, they told me that I couldn't delete my account (there is no such option anywhere) and that they would keep the account for my lifetime, during which I have to keep my contact details up to date. I said I didn't want that, and the response was that if I want to take out a loan again, they would have all the information.

I really, really disagree with this. I understand that the British government will probably have a track record of my student loan and this is fine; but I don't want to have a life-long account that I need to keep up to date with my home address, email, and two phone numbers.

I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment. Also, all the guides keep talking about companies. Do governments count as companies? Probably not, I presume.

What can I do?

5
  • 2
    GDPR does not apply to the governement
    – Trish
    Mar 6, 2021 at 14:54
  • 2
    @Trish GDPR definitely also applies to government entities, though there are exceptions for things like national security. The Student Loan Company provides services on behalf of the government. Whether OP's right to erasure applies would depend on whether the SLC has a legal obligation or other legal basis to continue storing OP's data. If OP thinks their requests have been improperly denied they can lodge a complaint with the ICO, which is the supervisory authority for everyone excluding courts.
    – amon
    Mar 7, 2021 at 10:36
  • 1
    @amon there's a difference between Student loan company and the governement. The latter is for example the Police, the office of citizen services etc. You can't demand to have your birth certificate or history of bad driving erased.
    – Trish
    Mar 7, 2021 at 11:05
  • 1
    @Trish but the reason you can't demand to have those things erased isn't because of who holds them. The distinction you are trying to draw between government data processors and controllers on one hand, and non-governmental data processors and controllers on the other, is not found in the GDPR. Furthermore, the "SLC is an executive non-departmental public body, sponsored by the Department for Education" and its web pages are found on the gov.uk domain.
    – phoog
    Mar 8, 2021 at 3:16
  • 2
    marts: if I were you I would take the approach of asking what consequences I would face for failing to keep my contact details up to date. Probably there are none. Then you can just forget about it.
    – phoog
    Mar 8, 2021 at 3:20

2 Answers 2

3

In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at Article 6(1) of the UK GDPR. Briefly, those are:

a) Consent of the data subject
b) Necessary for performance of a contract with the data subject
c) Necessary for compliance with a legal obligation
d) Necessary to protect vital interests of data subject or another person
e) Necessary for public interest or exercise of official authority vested in the controller
f) Necessary for controller's legitimate interests

Clearly a) and d) don't apply. As you've settled the debt, it seems unlikely to me that b) or f) apply. That leaves c) and e). A common example under c) would be a requirement by Companies House or HMRC to keep accounting records for a certain period of time. Some public bodies may also find it necessary, under e), to retain records which they need to be able to carry out their other functions. It seems highly unlikely to me that either of these would justify retention for your "lifetime" however.

I would start by sending them a written demand to have your data erased under Article 17(1). Make sure you also specifically request that they provide you with all the information (and in particular the purposes of the processing) under Article 15(1), and that, in the event that they refuse to erase your data, they explain the reasons why pursuant to Article 12(4). Their response on these points will be helpful in establishing whether there is a lawful basis.

Your next step after that is either to complain to the ICO or to apply to court for a compliance order under Section 167 of the Data Protection Act 2018. The former is free while the latter is not and carries risks of cost if you are unsuccessful. If you opt for one of these steps, make sure you cite the relevant provisions of the GDPR and explain why you think there is no lawful basis for the data retention (including by referencing any response you received from them).

"I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment"

It doesn't matter whether we are talking about your account or your track record. What matters is whether the account constitutes personal data, which it almost certainly does, per the definition at Article 4(1):

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"

-3

You suffer no harm from not deleting the account. Leave it be and forget about it. Your concern is ill founded. You don't have to keep your contact information current because there is nothing left to contact you about.

2
  • 3
    This doesn't answer the question and contains no legal content. It doesn't matter whether the OP should try to enforce account deletion. What matters is whether they can. Many people feel uncomfortable with third parties holding their private data - this is the primary reason the GDPR (and similar privacy law elsewhere) exists in the first place. The GDPR does not attempt to peer into the reasons why a data subject wants to protect / delete their data, and neither should we.
    – JBentley
    Aug 10, 2022 at 10:35
  • Yes, you are mostly right, and no, the gdpr as such does not mind the incentives or motivations of data subjects. But it is arguably a form of legal insight into the other legal aspects of the situation at hand. Anyway, obviously your answer is superior just a minor nitpick to your comment. Aug 10, 2022 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .