8

Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view the email sent by person A?

It being an email means that the information of who the message was meant to will always be part of the email's metadata. From a naive understand of GDPR, it looks like the only recourse would be delete the email from person B's inbox, but that doesn't sound right either.

From the perspective of person B, the email in their inbox, is an email "they own", it's addressed to them so their personal information is on it too.

What exactly are you supposed to do in this situation?

1
  • 11
    The "right to be forgotten" cannot be absolute. Otherwise we could order a product or service, and later when having to pay the bill we would invoke that "right" and avoid paying the bill.
    – vsz
    May 29 at 12:59
17

If person A deletes their account would that mean that person B no longer can view the email sent by person A?

No. Person B's inbox implies overriding legitimate grounds that limit person A's "right to be forgotten". See article 17.1.(c) of the GDPR.

Furthermore, item 2 of article 17 is not applicable because the email service did not make A's personal data public. The email service merely sent to B the record with which A unequivocally addressed B. This means that the email service does not even need to notify B regarding A's request for erasure. All the email service needs to do is remove A's account pursuant to A's request.

10

The right to erasure / right to be forgotten only exists under fairly narrow conditions, which may or may not require erasure in this scenario.

As a general principle, when two individual's personal data is involved, we need to carefully balance both people's rights. With some GDPR rights such as the right to access, the right “shall not adversely affect the rights and freedoms of others”. For example, if person A makes a data subject access request, it would adversely effect person B's privacy rights if person B's emails were searched.

However, the right to erasure does not explicitly have such a constraint. Instead, the Art 17 right to erasure contains six cases under any of which erasure may be requested, and five grounds on which erasure can be denied.

Let's look at potential grounds for requesting erasure.

  • (a) the data is no longer necessary. This does not apply, as storing the emails is still necessary in B's inbox.

  • (b) processing was based on consent and A has withdrawn consent. This does not apply.

  • (c) processing was based on legitimate interest, A has objected, and there are no overriding legitimate grounds. Likely, this does not apply: B has an overriding legitimate interest in keeping their emails.

  • (d) the processing was illegal. This does not apply.

  • (e) there's an applicable legal obligation to delete the email in EU or member state law. This might apply, but A would have to point out the specific law.

  • (f) the personal data was collected in relation to the offer of an information society service under Art 8. This might apply, but only if A was a child at the time (between 13–16 years old, depending on member state).

Even if there are grounds to request erasure, one of the grounds to refuse the request could apply:

  • (a) for exercising the right of freedom of expression and information. For example, person A cannot use their right to erasure to suppress journalistic work (but freedom of expression and information is much broader than just journalism).

  • (b) for compliance with another legal obligation, or for a task carried out in the public interest. For example, person A cannot use their right to erasure to force B to delete financial records that B is legally required to maintain.

  • (c) for reasons of public interests in the area of public health. Probably won't apply here, but it's important to note that GDPR generally prioritizes health and life over data protection.

  • (d) for archiving, scientific, research, or statistical purposes. Likely doesn't apply here.

  • (e) for the establishment, exercise, or defence of legal claims. For example, A cannot use their right to erasure to delete evidence that B needs in order to sue A, or to defend against a claim by A.

Many of these exceptions are extremely context-dependent, and cannot be resolved without taking into account the individual circumstances of person B.

It may also be worth noting that B – and not the email service provider – might be the data controller for the emails in B's inbox. Then, the right to erasure should be exercised against B, not against the service provider.

2
  • 1
    Your final paragraph suggests that I, a private American citizen, can become a "data controller" subject to EU law merely by signing up for an email account from one of the large providers. I certainly hope the EU does not take that broad a view of its own jurisdiction.
    – Kevin
    May 29 at 8:16
  • 5
    @Kevin No. “Person B is a data controller” and “this data controller has to comply with GDPR” are separate statements. I mentioned potential controllership issues to explain that the service provider must not delete emails in other people's inboxes without very very good reason.
    – amon
    May 29 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.