Data protection

A. Under the General Data Protection Regulations (GDPR), due to come into force in May 2018, there is a right for individuals to have personal data erased in certain circumstances. This has been referred to as a “right to be forgotten”.


Guidance on the GDPR from the Information Commissioner’s Office describes the broad principle underpinning this right to be to “enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing”.


There are prescribed circumstances under the GDPR in which individuals have a right to deletion of their personal data. These include if the personal data is no longer required for the original purpose; when the individual withdraws consent; or if the personal data has to be deleted to comply with a legal obligation.


If the processing is causing damage and distress, this will make the case for erasure a stronger one. There are limited circumstances in which an organisation can refuse to comply with a request for erasure.

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure