The GDPR – The New Right to Erasure – Part II

by Dr Edric Micallef Figallo – Associate

The following is the seventh article in a series of articles delving into the GDPR, intended to give an overview of the main aspects of the provisions it introduced, retained and updated in the data privacy law regime of the European Union, and its legislative implementation in Malta. The previous article may be viewed here.

This article continues upon the previous article, linked above, about the new right provided by the GDPR under Article 17 thereof, ergo the right to erasure, also known as the right to be forgotten.

In this part we shall first refer to the six main grounds for the exercise of this new right, as provided under Article 17, para. 1 GDPR, failing which said right might not apply. In the author’s opinion, given the wording of the provision itself this seems to be an exhaustive list.

The grounds are the following, being that:

“(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”

For the readers’ ease of reference, Article 8(1) as referred deals with services specifically involving minors (the English text uses “children”¸ however the Maltese text uses “minorenni”, whilst the Italian text uses “minori”).

The word limitations for the articles in this series makes it necessary to deal with grounds individually, albeit not in the same article. The first ground in the list above should seem fairly straightforward and is very much case dependant. As we may recall the grounds for personal data processing are found under Articles 6 and 9, moreover Articles 13 and 14 both make it mandatary to provide a data subject with the purposes for the data processing, and said grounds and purposes must be considered together for compliance purposes. Should these purposes change, and if legitimate, other obligations fall upon the data controller. The referred ground (a) basically speaks for itself but the most important qualifying criteria is the “no longer necessary” one. Therefore, while fairly straightforward, the right to erasure under this ground has a number of requirements for the successful exercise of that right. This is reasonable, and is related to the restrictions to this right which we shall be dealing with in future articles.

The second ground (b) basically deals with consent, which would require separate consideration. For the purposes of the right of erasure it is enough to state that such right is applicable following the withdrawal of consent should the legal basis for the personal data processing be consent alone (“and where there is no other legal ground for the processing”). This requires a parenthesis on this latter qualifying criteria. This seems contradictory to what the European Data Protection Board seems to stress in its guidelines, in succinct being that consent is best limited to situations were it is inevitable (ergo when no other legal ground under Articles 6 and, or 9 is possible), and it is best not used cumulatively with other legal grounds (a favourite hobby for many data collectors and processors in Malta), otherwise, as this second ground (b) seemingly implies, there could be diverse situations in relation to the exercise of rights and the fulfilment of obligations, and in this case making the exercise of the right to erasure subject to legal uncertainty.

In the next article we shall be dealing with further grounds for the exercise of the right to erasure.

____________________________________

Disclaimer: This article is not to be considered as legal advice, and is not to be acted on as such. Should you require further information or legal assistance, please do not hesitate to contact Dr Edric Micallef Figallo on edric@abalegal.eu.