Right to Deletion
The right to deletion is also known as ‘the right to be forgotten’. It is not an absolute right and subject to certain conditions.
Deletion of personal data because the data was not collected in compliance with OC 11
You can request deletion if the collection of the personal data has been performed in an unlawful way, meaning that one or more of the principles set out in OC 11 were not respected. In practice this could be for instance:
- Absence of a purpose
- The personal data collected is disproportionate, inadequate, irrelevant or not limited to minimum required to achieve the stated purpose;
- Unfair or obscure processing of the personal data
- Insufficient security measures
- Inappropriate or missing lawful basis
You have to provide explanations, which of the principles were not observed.
Deletion of personal data because the processing of the data is no longer necessary for the stated purpose for which is was collected and processed
The retention periods for the processing of personal data are detailed in the individual service privacy notices. These will normally be set to a period appropriate for the needs concerning the processing and the data will be deleted subsequently.
However, you may additionally request that your data be erased but this will only be done when there are no longer any need by the Organization to retain the data for the purposes for which they were collected.
You have to demonstrate that the data is no longer necessary by providing adequate explanations.
Deletion of personal data because the data is processed on the basis of consent, and the said consent has been withdrawn
To find out if "consent" applies to the processing of your personal data, you should first verify the underlying Privacy Notice that contains the lawful basis. If it is “Consent”, you should inform the controlling service that you withdraw your consent. Then, the data held by the Controlling Service must be deleted.