What is the right to erasure?
This right is also known as ‘the right to be forgotten’. You are entitled to request the deletion or removal of your personal data where it is no longer a lawful basis to continuing processing it.
When does the right to erasure apply?
You only have the right to erase your personal data if:
- The personal data is no longer necessary for the purpose which we originally collected or processed it for;
- Your consent was needed as our lawful basis for holding the data, and the you have now withdrawn it;
- We relied on legitimate interests as our basis for processing your personal information and now you object to the processing of your data, and there is no overriding legitimate interest to continue this processing;
- We are managing personal data for direct marketing purposes and you object to that;
- Personal data has been processed unlawfully (ie in breach of the lawfulness requirement of the 1st principle);
- We have to do it to comply with a legal obligation; or
- We have processed personal data to offer information society services to a child.
How do I make a request and what does it cost?
From 25 May 2018, you can make erasure requests either verbally or in writing. Requests are free of charge, unless the request is manifestly unfounded or excessive. Any fee applied will be based on the administrative costs of complying with the request.
How long will it take to process my request?
We have to provide you with your information within a month of receipt. This time period can be extended by a further two months if your request is complex or numerous.
We will let you know within a month if we expect there to be a delay in processing. We will give you a reason for any extension. If we require proof of identification, the one month responding period will begin when your identity has been confirmed.
When does the right to erasure NOT apply?
The right to erasure does not apply if processing is necessary for one of the following reasons:
- To exercise the right of freedom of expression and information;
- To comply with a legal obligation;
- For the performance of a task carried out in the public interest or in the exercise of official authority;
- For archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or
- For the establishment, exercise or defence of legal claims.
Can you refuse my request?
We can refuse to comply with an erasure request if it is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature.
We will inform you without undue delay and within one month of receipt of the request about:
- The reasons we are not taking action;
- Your right to make a complaint to the ICO or another supervisory authority; and
- Your ability to seek to enforce this right through a judicial remedy.
How do I make a request and what does it cost?
From 25th May 2018, erasure requests can be made verbally or in writing and will be free of charge, unless the request is manifestly unfounded or excessive. Any fee applied will be based on the administrative costs of complying with the request.
What happens if you have shared my details with partners?
If we have shared personal information with others, then we will contact each recipient and inform them of the erasure unless this proves impossible or involves disproportionate effort.
Where personal data has been made public in an online environment we will take reasonable steps to inform other controllers who are processing the personal data to erase links to, copies or replication of that data.