1

A company recieves a request to access personal data. They realize that they got the request two weeks after data collection; by this time all data is deleted. What would a company reply if such deletion was preinformed in the privacy policy of the company? Can a company just tell user they don't have the data or not?

2

Paragraph 1 of GDPR Article 15 says:

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data ...

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed ...

Paragraph 3 of article 15 provides that:

The controller shall provide a copy of the personal data undergoing processing. ...

This clearly includes the possibility that some personal data may not be "undergoing processing", remembering that storage is a form of processing under the GDPR.

Recital 63 says that:

Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, ...

GDPR Article 5 paragraph 1 (b) says in relevant part that personal information should be :

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

Thus when the purpose for wich PI was collected has ended, and there is no further lawful basis to store or otherwise process that PI, it should be deleted.

Recital 39 says that:

...the period for which the personal data are stored is limited to a strict minimum ... ...

In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.

So again, it is not only possible but desirable that PI once collected may be deleted once the purpose for which it was collected has been satisfied.

GDPR article 13 paragraph 1 says:

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with

...

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

Paragraph 2 (a) adds that the controller shall also provide the Data Subject with:

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

It is thus again contemplated that some PI will be stored only for a limited period.

Where PI data is collected, but has been erased prior to the request for access, the previous processing of that data should be included in the categories listed under art 15 par 1 (b), and its recipients under art 15 par 1 (c). The period of retention should have been disclosed upon collection. That (along with the other required information) should be a sufficient reply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.