8.3 Right to Erasure

Individuals have a right to have personal data erased and to prevent processing in specific circumstances when:

• the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
• the individual withdraws consent to processing where that processing is carried out on the grounds of the individual’s consent
• the individual objects to the processing and there is no overriding lawful interest for continuing the processing
• the personal data was unlawfully processed (i.e. otherwise in breach of data protection legislation)

If the processing causes damage or distress, this is likely to make the case for erasure stronger.

You can refuse to comply with a request for erasure where the personal data is processed for the following reasons:-

• to exercise the right of freedom of expression and information
• to comply with a legal obligation for the performance of a public interest task or exercise of official authority
• for public health purposes in the public interest
• archiving purposes in the public interest, scientific research historical research or statistical purposes
• the exercise or defence of legal claims

This right is also known as the ‘right to be forgotten’. It is only available in certain circumstances and it would be unusual for erasure to be applicable to properly governed surveillance and security data. If this does arise it would be dealt with on a case by case basis and advice should be sought.

If you have disclosed the personal data in question to third parties, you must inform them about the erasure of the personal data, unless it is impossible or involves disproportionate effort to do so.