Data Retention v Right to be Forgotten: The importance of awareness of your obligations/rights and striking the best balance between the two data protection areas, are brought into sharp focus in this article concerning two unions and ESB workers (electricity service technicians). A tension between Data Retention and the Right to be forgotten (erasure) has arisen.
To help avoid or reduce the impact of such situations it is helpful to be familiar with rules and principles underpinning both.
The GDPR sets out seven key principles:
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality (security)
- Accountability
Data Retention:
You need to consider and be able to justify how long you keep personal data. Be clear on your purposes for holding personal data
You must not keep personal data for longer than you needed
Periodically review the data you hold, and erase or anonymise it when you no longer need it
Carefully consider any challenge(s) to your retention of data. Individuals have a right to erasure if you can no longer justify holding their data
Create a policy setting standard retention periods wherever possible
Right to be forgotten:
The GDPR introduces a right for individuals to have personal data erased
The right to erasure is also known as ‘the right to be forgotten’
Individuals can make a request for erasure verbally or in writing
You have one month to answer a request
This right is not the only way in which the GDPR places an obligation on you to consider whether to delete personal data
The right is ‘not absolute’ and only applies in specific circumstances.
For more information contact us at:
Sligo Office, 1 Wine Street, Sligo Co Sligo F91 X58H or
212A, The Capel Building, Mary’s Abbey, Dublin 7 D07 FXF8
Tel. 00353 71 916 2211
See http://www.thejournal.ie/right-to-be-forgotten-connect-4244949-Sep2018/
Request a callback
