The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?

Question

I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a key into in other tables, such as the 'club_officers' table that hold the dates when someone with a particular memberID held certain positions in the club.

Under the 'right to erasure', if I delete all the personally identifiable data (name, address, phone etc) from the 'member' table, would I be able to retain the memberID in that table, associated with just a load of blank fields, so that I can still link it to other tables?

That way I would still be able to see that, for example, somebody with memberID 1234 was the club secretary between 2012 and 2014, which would be useful.

However, since nowhere in my database does that memberID 1234 provide any name, address phone etc. I cannot identify who that person was.

Is this sufficient for this part of article 17?

Answer 1

Under GDPR article 4 Personal information is:

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly ...

If the subject's name IP address, and other identifying information has been deleted, and there is no way to connect or re-connect the internal ID to an actual specific natural person, then that ID is not "Personal Information" under the GDPR.

Under GDPR article 127 a data subject is entitled to:

obtain from the controller the erasure of personal data concerning him or her without undue delay ...

But if the data is no longer identifiable to a specific natural person, it is not "personal data concerning him or her" and no right of erasure applies.

Beyond that, the right of erasure only exists if at least one of the provisions of article 17 paragraph 1 applies. Art. 17 (1) (b) will apply if the original basis for processing was the data subject's consent, but not otherwise. Art. 17 (1) (c) will apply if the data subject objects, unless there are "overriding legitimate grounds for the processing".

Under GDPR article 6 processing can be lawful because the Data Subject has given consent (Par. 1 a) but also because the Controller has a legitimate interest in the data (1 f). It would seem that malignant a record of who was an officer of a club or organization would be a matter of legitimate interest and thus form a lawful basis for processing basic ID information, such as the name of the person, even over a request for erasure. However other personal, information not needed for such a purpose would still have to be erased on request.

So I think that retaining the internal member ID would be permissible in any case, but retaining the name would be permissible, even over an objection, to identify club officers.

After additional Information

The OP says in a comment:

Every year we issue a printed handbook to each of our members containing, amongst other things, a full list of members complete with member ID, name, address, phone, email etc. There will be thousands of these in circulation from past years from which I could re-attach my DB memberID. Obviously I cannot erase all of them! The ICO have told me members have to accept the continued existence of the handbook when joining and cannot expect that data to be erased. Does this change things wrt the database?

This changes mattes a bit.

GDPR Art 17 paragraph 2 says:

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Just who needs to be informed in this case is not clear to me. It is a good thing that only "reasonable steps" are required.

The existence of the handbook means that the member IDs can be easily re-identified by anyone with access to a copy. They are therefor clearly personal information. A valid request for erasure will thus require removing the member ID from anywhere that it is visible to users at least, and if possible from anywhere in the database. A new random member ID to link together the various records where the deleted ID is used, provided that they do not include PI, could be substituted.

I still think that retention of the member ID and name for a former officer of the club is arguably a matter of legitimate interest, and not subject to a request for erasure, under article 17. But that would not apply to an ordinary club member.

Given the existence of the information in the handbook, distributed in "thousands" of copies, there seems less point in anyone issuing a request for erasure under article 17. It might be a good idea to remind requester of this situation. Still a person might feel that an online DB is much more exposure than a handbook in print available only to those members who happen to have kept it. In any case, the right still exisats under the GDPR.

Answer 2

The GDPR has a fairly broad concept of personal data: any information that relates to an identifiable person. This is far more than directly identifiable information! The concept of identifiability is further explained in Recital 26:

To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.

So indirectly linkable information can still be personal data. In your example, that ID can be easily re-identified with a particular person if you know who the secretary was between 2012 and 2014. It is quite likely that there are members in the club with this knowledge, or that this information can be gained from public sources like newspaper reports. Thus, you should assume that your member IDs are at most pseudonyms, but not anonymous. They are likely still personal data.

However, it doesn't necessarily follow that you would have to erase everything. Art 17 comes with lots of caveats and exceptions. For example, if you are processing this personal data under a legitimate interest, and someone requests erasure, you might have overriding grounds to continue processing anyway. E.g. such a legitimate interest could involve security or auditability purposes. There might also be such a legitimate interest for keeping some history for the club, but there would have to be a decision based on the individual circumstances. Furthermore, you can of course retain data e.g. due to a legal obligation, or when this information is necessary for the establishment of or defence against legal claims.

I understand your desire to keep some data around. Instead of asking “do I have to delete this?” it might be more productive to consider “under which legal basis can I keep this?”. I think you might have a legitimate interest, but you'd have to carry out a balancing test between the various interests and rights.

A really problematic approach would be to hold on to de-identified data in the belief that it no longer were personal data. Such a belief is usually mistaken. True anonymization that meets the GDPR's definition is really hard, in particular because you would also have to prevent indirect identification, also by other actors than yourself. There are theoretical models that can help with anonymization, e.g. with k-anonymization methods you'd ensure that there are no unique records in the DB. But this can be tricky to apply correctly, so I'd recommend to only treat aggregate statistics as truly anonymous.

In 2012, the ICO has published an anonymization code of practice (PDF). It is no longer up to date with the current legal environment (in particular since the GDPR has expanded the concept of identifiability), but it provides a good overview of both the difficulties of preventing re-identification and an overview of potential solutions.