According to the soon-to-be-implemented General Data Protection Regulations (GDPR) under Article 17, every European Union citizen has the right to request that his personal data file be modified or deleted.
What GDPR States Regarding Erasure
- It is the right of every EU citizen to be able to request the deletion of his or her personal data file— also referred to as ‘the right to be forgotten’.
- Requests must be made in writing or orally.
- A response to a request must be provided within one month.
- This right is not a given. Special circumstances must apply.
- The obligation regarding whether to delete or modify one’s personal data file is on the individual.
Why Data File Erasure is Being Requested
Implementation of GDPR has increased the focus on personal data of individuals. As a result, questions have arisen concerning:
- How the data is collected
- Why the data is needed
- How the data is used
- Who has access to personal data files
- How this sensitive data is used
- When and how the data is eliminated from files
Fuelled by media coverage of GDPR, EU citizens have increased their interest in and concern about their personal data. They worry about how this data can be misused. Identity theft is a legitimate cause for apprehension.
Thus more requests for erasure of the entire personal data file or part of it have increased rapidly — even before GDPR is enacted.
Request for erasure or modification are a huge concern for businesses that employ EU citizens and/or trade with EU citizens.
Up to 80% of healthcare employees who participated in a survey said they would request erasure. In other sectors, the people who would or might ask that their personal files be deleted was almost 70%. Only 10% said they would definitely not request file erasure.