2

I have three doubts about GDPR compliance in modern systems, specifically about the "Right to be forgotten" section in the GDPR.

What I would really like to understand is whether the right to be forgotten section in GDPR means: "The person is forgotten about" or "all the person's data is erased".

Can anyone please share a reputable source that either explains how can we still comply to GDPR given when the data is erased in the application layer, it is actually not erased in reality and may still be recoverable, or a source that explains that the data is permitted to still be recoverable.

I give three examples below for cases where even though the data may be erased in the application layer, it may still be recoverable in reality.

  1. Some databases have journaling, redo and undo spaces. Hence, if you delete data from the database, it might still be recoverable. Is this a problem for GDPR compliance?

  2. For disaster recovery purposes, data is often backed up, and sometimes on sequential append only media devices such as tape drives. If you need to erase data to comply to GDPR, do you still need to take care to delete the data from the backup? How is this done? In some cases you'd need to re-write the entire storage unit again to a new storage unit to accommodate for this.

  3. In SSD when you change data it may be written in a new place, and the new data might still be present on the disk. Is this a problem for GDPR compliance? Are we not allowed to use SSDs?

2

Article 17 of the GDPR ("Right to erasure (‘right to be forgotten’)") says:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

...

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

Paragraph 3 (d) of article 17 says further that the right to erasure does not apply when:

for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;

Recital 65 of the GDPR says:

A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

The mention in Paragraph 2 of article 17 that the Controller "... taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, ..." while directed to informing other controllers of an erasure request, seems to indicate, along with the exception for archiving in art 17 par 3(d) that as long as measures are taken to prevent access to the data for which erasure has been requested, that such data is not fully erased is not a violation. But I cannot call that conclusion authoritative.

The ICO says:

If a valid erasure request is received and no exemption applies then you will have to take steps to ensure erasure from backup systems as well as live systems. Those steps will depend on your particular circumstances, your retention schedule (particularly in the context of its backups), and the technical mechanisms that are available to you.

You must be absolutely clear with individuals as to what will happen to their data when their erasure request is fulfilled, including in respect of backup systems.

It may be that the erasure request can be instantly fulfilled in respect of live systems, but that the data will remain within the backup environment for a certain period of time until it is overwritten.

The key issue is to put the backup data ‘beyond use’, even if it cannot be immediately overwritten. You must ensure that you do not use the data within the backup for any other purpose, ie that the backup is simply held on your systems until it is replaced in line with an established schedule. Provided this is the case it may be unlikely that the retention of personal data within the backup would pose a significant risk, although this will be context specific. For more information on what we mean by ‘putting data beyond use’ see our old guidance under the 1998 Act on deleting personal data

In the page "We All Know About GDPR’s Right to Erasure, Does This Mean You Have to Delete Data From Backups As Well? " from teh law firm of Hall, Booth, Smith the authors say:

Unfortunately, the GDPR does not address personal data in backups with regard to the right to erasure. There is not an exception or a “safe harbor” that allows an organization to maintain a backup when they have received a valid request to erase. This can be disconcerting in view of the difficulty in deleting backup data. It is not easy nor practical to remove a single record from the backups. Many backups cannot be searched for a single record, without restoring the entire backup. An organization must also be careful not to affect the personal data of other data subjects in an attempt to delete the personal data of the data subject who has made the request.

Fortunately, several European supervisory authorities have issued guidance on how to handle backups when receiving a request to erase. The Danish supervisory authority has issued guidance stating that personal data must be deleted from backups where technically possible. However, there are cases when erasure from a backup might be technically possible, but is extremely cumbersome and expensive. It is not clear whether technically possible means at any cost, or only when reasonably technically possible. If the organization does not delete the personal data from the backup because it is not technically possible, the organization must ensure that the personal data is deleted if the backup is restored to a production system or a production data base.

The UK’s supervisory authority, the ICO, released guidance stating it is necessary to take steps to ensure erasure from backup systems. Such steps may depend on the organization’s particular circumstances, its retention schedule and the technical mechanisms that are available to delete personal data from backups. The UK recognizes that data may remain on backups for a certain period of time until the backup is overwritten. The UK has indicated that they will be satisfied if backup data are put “beyond use” even if it cannot be immediately overwritten.

...

The import of the guidance from the various supervisory authorities is that if an organization does not delete personal data from backups when there is a request for erasure, the organization needs to document why it is technically not possible for feasible to delete the data from backups, inform the data subject that personal data will exist in a backup, and when the backup will be deleted

See also GDPR - Right to erasure - Conflicting laws

-1

You seem to be conflating two seperate issues

The right to be forgotten is the right not to appear in search engine requests. It is implemented by the person applying to each of the search engine operators with a list of urls that are not to appear when their name is searched on European versions of the engine. No data is deleted.

Data protection requires that data that businesses hold on individuals is kept for no longer than necessary. That is, once the organisation no longer has a lawful basis for keeping the data it is deleted.

Without knowing what the lawful basis was and when and why it no longer exists, it’s not possible to answer technical implementation questions.

2
  • 2
    Under GDPR Art 17, the right to be forgotten is the right to erasure, but controllers may be required to inform other controllers about the deletion as well. It doesn't make sense to draw a strong distinction between these two deeply intertwined rights, in particular since RTBF is usually exercised by requesting erasure from a search engine. However, you are right that “nothing is deleted” in the search engine case since GDPR does not have such a broad extraterritorial effect as to deprive non-EU searchers from their freedom of information.
    – amon
    Jun 15 at 11:04
  • -1 As the comment by @Amon say, the "right to be forgotten" under the GDPR (art 17) does very specifically mandate that a Data Controller delete or erase personal information (PI) about a data subject on request. It does not define technical standards for this, but it is simply not correct to say that "No data is deleted." in response to such a request, or that it deals only with internet search engine response. Jun 15 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.