Answer
Yes, you can ask for your personal data to be deleted when, for example, the data the company holds on you is no longer needed or when your data has been used unlawfully. Personal data provided when you were a child can be deleted at any time.
This right also applies online and is often referred to as the ‘right to be forgotten’. In specific circumstances, you may ask companies that have made your personal data available online to delete it. Those companies are also obliged to take reasonable steps to inform other companies (controllers) that are processing the personal data that the data subject has requested the erasure of any links to, or copies of, that personal data.
It’s worth keeping in mind that this right is not an absolute right, meaning that other rights, such as the freedom of expression and scientific research, are also safeguarded.
Examples
Data should be deleted
You have joined a social networking site. After a while, you decide to leave the networking site. You have the right to ask the company to delete the personal data belonging to you.
Data can’t immediately be deleted
A new bank offers good home loan deals. You’re buying a new house and decide to switch to the new bank. You ask the ‘old’ bank to close down all accounts and request to have all your personal details deleted. The old bank, however, is subject to a law obliging banks to store all customer details for 10 years. The old bank can’t simply delete your personal details. In this case, you may want to ask for restriction of processing of your personal data. The bank may then only store the data for the period of time required by law and can’t perform any other processing operations on them.
Data should be deleted
When you do an online search using your name and surname the results show a link to a newspaper article. The information in the newspaper dates back a number of years and is related to an issue – a real-estate auction connected with debt recovery proceedings – settled a long time ago that is now irrelevant. If you are not a public figure and your interest in having the article removed outweighs the general public’s interest in having access to the information then the search engine is obliged to remove links to web pages including your name and surname from the results.
References
- Articles 12, 17 and23 and Recitals (65) and (66) of the GDPR
- Article 29 Working Party Guidelines on the implementation of the Judgment of the Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, ECLI:EU:C:2014:3171(WP 225)
1 A summary of the judgment can be found in OJ C 212, 7.7.2014, p. 4.