Don’t forget about the right to be forgotten.
In early April 2018 in cases heard in the UK High Court the judge upheld the claim of one businessman that Google should remove information about him from its search engine while refusing the application of another. The reasoning was that the information in the latter case remained in the public interest while in the former case it was no longer relevant.
The “right to be forgotten” that was the subject of that case came from a legal precedent set in 2014 by the European Union Court of Justice. When the GDPR comes into force on 25 May 2018, it brings with it a statutory right for individuals to have personal data erased.
That right is not absolute, though, and only applies in certain circumstances – basically, if the data is no longer necessary for the purpose it was collected or processed and (i) consent to its processing has been withdrawn or (ii) there is no longer any overriding legitimate interest to continue the processing.
Individuals can make a request for erasure verbally or in writing. The data controller or processor has to respond to the request within one month.
As ever, the devil is in the detail and this is just a summary of the right. Please get in touch if you would like more detail or if you receive a request and would like advice on whether you must comply with it and how you should deal with it.