Imagine a world where everything you ever shared online, every piece of information about you, remained there indefinitely, even if you no longer wished for it to. Such a prospect can be unsettling. Thankfully, in many places, you have important rights that give you control over your personal information. One of the most powerful of these is often called the ‘right to be forgotten’. It means you can ask for your personal data to be deleted, giving you more control over your own digital story. Let’s explore what this really means for you and how it works.
What is Your Personal Data and Why Does it Matter?
Before we discuss data erasure, let’s clarify what personal data entails.
Understanding what ‘personal data’ really means for you.
Simply put, personal data is any information that can identify you. Think about it: your name, your home address, your email address, and your phone number are all clear examples. But it’s more than that. It also includes things like your online shopping habits, the websites you visit, your date of birth, and even details about your financial activities. If an organisation holds information that helps them know it’s you, then it’s your personal data.
Why protecting your data is so important.
Your personal data is valuable, and that’s why securing it is incredibly important. When organisations collect your data, they use it to provide you with services, enhance your online experience, or even to understand what products you might like. However, if your data is not adequately secured, it could be accessed by unauthorized parties. This could result in issues such as unsolicited communications or, more critically, identity theft leading to unauthorized account access. Protecting your data helps protect your privacy and your identity.
Exercising Control Over Your Data: Withdrawing Your Consent
Sometimes, you might have given an organisation permission to use your data, but then you change your mind. This is entirely permissible, and you have the right to do so.
What it means to give permission for an organisation to use your data.
When you sign up for a new online service, create an account, or subscribe to a newsletter, you often click a box that says “I agree” or “I accept the terms and conditions.” This action is usually how you give your ‘consent’ – your permission – for that organisation to use your personal data for specific reasons. It’s like telling them, “Yes, you can use my email address to send me updates.”
When you can decide to take back your permission.
The good news is that if you’ve given an organisation permission to use your data, you can generally take that permission back. This is known as withdrawing your consent. You might decide to do this if you no longer use a service, if you’re receiving an excessive number of emails, or if you simply no longer wish for that organisation to retain your information. You have the right to change your mind at any time.
How to tell an organisation you’re withdrawing your consent.
Withdrawing your consent is usually straightforward. Many online services have a section in your account settings where you can manage your privacy preferences or unsubscribe from communications. If you are unable to locate such an option there, the best approach is to contact the organisation directly. Look for their customer service contact details or a dedicated privacy contact, sometimes called a Data Protection Officer. You should clearly state that you are withdrawing your consent for them to use your personal data.
Asking for Your Data to Be Erased: Your ‘Right to Be Forgotten’
Beyond simply withdrawing consent, you also have a stronger right to ask for your data to be completely removed.
What the ‘right to be forgotten’ really means for you.
The ‘right to be forgotten’ is a powerful concept. It means you can ask an organisation to delete your personal data from their records. This isn’t just about stopping them from using it; it’s about asking them to remove it entirely. It’s about ensuring your information isn’t kept longer than necessary and that you have a say in your digital memory.
When you can ask for your personal data to be deleted.
You can usually ask for your data to be deleted in several situations:
- When it’s no longer needed: If the data was collected for a specific purpose and that purpose is no longer valid or necessary.
- When you withdraw consent: If the sole legal basis for processing your data was your consent, and you have since withdrawn it.
- If it was collected without a lawful basis: If the organisation collected your data without a proper legal reason.
- If you successfully object to its use: If you object to how your data is being used and there’s no legitimate overriding ground for its continued processing.
- To comply with a legal obligation: If a legal requirement dictates that the organisation must delete certain data.
The steps to request your data be erased.
To ask for your data to be erased, you should contact the organisation directly. It’s best to do this in writing (like an email) so you have a record. Clearly state that you are exercising your ‘right to be forgotten’ and specify which data you want to be deleted. Providing them with enough information to identify you and your data will help them process your request quickly.
What to Expect After You Withdraw Consent or Request Erasure
Once you’ve made your request, what should you expect to happen next?
How organisations should respond to your request.
When you withdraw consent or request data erasure, the organisation should acknowledge your request. They should then consider it carefully and either confirm that they will comply or explain their grounds for refusal. Their response should be clear and easy to understand.
The time an organisation has to act on your wishes.
Organisations are usually given a strict timeframe to respond to your requests. Generally, they have one calendar month from the day they receive your request to act on it. If your request is exceptionally complex, they might be able to extend this period, but they must inform you and explain why.
What you should expect to see happen with your data.
If your request is successful, you should receive confirmation that your data has been deleted or that its processing has stopped. For instance, if you asked to be removed from a newsletter list, you should stop receiving those emails. If you asked for your account data to be erased, you might find that your account is closed and your information is no longer accessible to the organisation.
Circumstances Under Which Data Cannot Be Erased
While your data rights are strong, there are some situations where an organisation might not be able to delete your data.
When legal rules say data must be kept.
Sometimes, laws require organisations to keep certain types of data for a specific period. For example, financial institutions must keep records of your transactions for several years to comply with regulations, such as those set by the Reserve Bank of India (RBI) or similar bodies, to prevent financial crime. Even if you ask for your data to be erased, they must follow these legal requirements first.
Other Legitimate Reasons for Data Retention.
- Public interest: For reasons related to public health or scientific research.
- Freedom of expression: If the data is part of journalistic work or public information.
- Legal claims: If the data is needed for an ongoing legal case or to defend legal rights.
- Archiving: For historical research or statistical purposes, but only under strict conditions.
What an organisation should communicate if they cannot erase your data.
If an organisation cannot erase your data, they must inform you why. They should clearly explain the legal or legitimate reason for keeping it. They must also inform you of your right to complain to the relevant data protection authority if you dispute their decision.
Who Helps You Protect Your Data Rights?
Understanding the organisations that safeguard your privacy.
In the UK, the main body that safeguards your privacy and data rights is the Information Commissioner’s Office (ICO). The ICO is an independent authority that sets the rules for how organisations should handle your data. They provide guidance, investigate complaints, and can take action against organisations that fail to comply with data protection laws. Their role is to ensure that your rights are respected.
What to do if you believe your rights have not been upheld.
If you believe an organisation has inadequately addressed your data request or has not upheld your rights, you can take action. First, try to resolve the issue directly with the organisation. If the matter remains unresolved, you can then make a formal complaint to the ICO. They will review your case and can investigate the organisation on your behalf, helping to ensure your privacy is protected.
Why Your Data Rights Are So Important for You
Taking control of your digital footprint.
Every time you go online, you leave a ‘digital footprint’ – a trail of your activities and information. Your right to withdraw consent and the right to be forgotten empower you to manage this footprint. You get to decide what information stays out there about you, helping you maintain your privacy and secure your personal details in an increasingly digital world. It’s about having a real say in your own story.
Building trust in the digital world.
When organisations know that you have these rights, it encourages them to be more careful and transparent with your data. This accountability helps build trust. You can feel more confident using online services and engaging in digital payments knowing that there are rules in place to protect your information, and that you have the power to challenge how your data is used. This trust is essential for a safe and secure digital future.
What is the 'right to be forgotten'?
Author
