{"id":186949,"date":"2024-04-09T02:28:20","date_gmt":"2024-04-09T01:28:20","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=186949"},"modified":"2024-11-18T23:08:15","modified_gmt":"2024-11-18T23:08:15","slug":"right-to-be-forgotten","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/right-to-be-forgotten\/","title":{"rendered":"When Should Your UK Business Act Upon an Individual’s Right to Be Forgotten?"},"content":{"rendered":"\n

With the advent of the internet and digital technologies, the concept of privacy has become more critical than ever. To address these concerns, the General Data Protection Regulation (GDPR) empowers individuals to control their personal data and introduces the “right to be forgotten”. This allows individuals to request erasure of their data from data controllers<\/a>. However, it poses challenges for UK businesses. This article will explore when your company should act upon an individual\u2019s right to be forgotten to ensure your business avoids breaching the GDPR<\/a>.<\/p>\n\n\n\n

What Is the \u2018Right to Be Forgotten\u2019?<\/h2>\n\n\n\n

UK law grants individuals the right to request that organisations erase their personal data without undue delay. This “right to be forgotten” is applied if the data is no longer needed, inaccurate, or processed illegally. The right remains in effect after Brexit and applies to all EU member states.<\/p>\n\n\n\n

The right to be forgotten is not absolute, and exceptions exist. For example, your business has the right to retain personal information if it is necessary for legal compliance, regulations, or defending itself in a legal claim.<\/p>\n\n\n\n

The right to be forgotten only applies to searchable data accessible through search engines. This means your business is not legally obligated to erase personal data stored internally that is not publicly searchable.<\/p>\n\n\n\n

When Should Your UK Business Act Upon an Individual\u2019s Right to Be Forgotten?<\/h2>\n\n\n\n

In certain situations, a UK business must comply with an individual’s right to be forgotten. Failing to do this could be a breach of the GDPR or the Data Protection Act. With this in mind, let us explore some examples below.<\/p>\n\n\n\n

1. No Longer Necessary<\/h3>\n\n\n\n

Under the UK GDPR, personal data must be kept for no longer than necessary for the purposes for which it is processed. If a business no longer requires an individual\u2019s personal data for its intended purpose, the individual has the right to request the erasure of their personal data.<\/p>\n\n\n\n

For example, suppose a customer has closed their account with a business and no longer requires their services. In this case,  the company should erase their personal data upon request.<\/p>\n\n\n\n

2. Inaccuracy<\/h3>\n\n\n\n

If the personal information is inaccurate, incomplete or out-of-date, the individual has the right to request the erasure or correction of their personal data.<\/p>\n\n\n\n

Your business should ensure that the personal data it holds is accurate and up-to-date. Upon receiving a request to erase inaccurate personal data, your company must take the following actions:<\/p>\n\n\n\n