by Dr Edric Micallef Figallo – Associate
The following is the ninth article in a series of articles delving into the GDPR, intended to give an overview of the main aspects of the provisions it introduced, retained and updated in the data privacy law regime of the European Union, and its legislative implementation in Malta.
____________________________________
In this part of this article, we shall continue the analysis of the right to erasure and its grounding in the right to object (as per Articles 17(1)(c) and 21 GDPR).
While a data controller can call upon the right to erasure to be based in at least one of the six main grounds for its exercise, one of the grounds available to the data subject is the exercise of the right to object.
When the ground called upon by the data subject is the right to object, one has to consider when the data subject can exercise such a right to object, being: (i) when the legal basis for processing are Articles 6(1)(e) or 6(1)(f) GDPR as per Article 21(1) GDPR; and (ii) in cases involving direct marketing as per Article 21(2) GDPR. It apparently follows that the exercise of the right to erasure as grounded on the right to object is further limited to the provisions of Article 21(1) and 21(2) GDPR, being the grounds for the exercise of the right to object itself.
Article 21(2) is the more direct and straighforward of the lot and basically gives an absolute right to object in cases of direct marketing. In such cases objecting to data processing and, if desired, making a request for erasure should prove comparatively straightforward and successful. That is, assuming there are no other grounds for the data processing or applicable restrictions to the right to object or the right to erasure.
However, Article 21(1) GDPR requires more discussion, as it is conditional on the legal bases for data processing as provided by Article 6(1)(e) and 6(1)(f) GDPR. A reminder of these legal bases for data processing is fit:
“(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
N.B. The proviso to Article 6(1) GDPR makes it clear that Article 6(1)(f) cannot be used by public authorities in the performance of their tasks.
The above seems to be provide quite a restrictive scenario, and on paper it is. However, the GDPR broadened the application of the right to object significantly in relation to Article 21(1) GDPR, and this further opens up the possibilities to exercise the right to erasure. Indeed, in the previous part of this series we have already referred to the GDPR novelty related to the inversion of the burden of proof in favour of the data subject, in the sense that the right to erasure as grounded in the right to object now does not require the data subject to prove that he has “compelling legitimate grounds relating to his particular situation”. The latter was a requirement to exercise the right to object under the previous law. The GDPR broadens the same right to object further by rewording the requirement to “grounds relating to his or her particular situation”. This alone allows for a broader application of the new GPPR right to erasure.
It must be added that if request to exercise a right to erasure falls within the GDPR parameters discussed above, then such a request is to be acceded by the controller unless the latter “demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims”. It is the data controller which has to demonstrate the applicability of the same limitations to the right to erasure, and it is probable that a restrictive interpretation of the same would be applied by the competent adjudicators. This is an aspect best left for future discussion.
____________________________________
Disclaimer: This article is not to be considered as legal advice, and is not to be acted on as such. Should you require further information or legal assistance, please do not hesitate to contact Dr Edric Micallef Figallo on edric@abalegal.eu.