Regulation and data
Right to erasure
The right to erasure, or right to be forgotten, lets a person have the controller delete their personal data without undue delay if they are no longer needed, if the consent they rested on is withdrawn, if the person objects to the processing or if they were processed unlawfully. Art. 17 of the GDPR governs it.
Also known asright to be forgotten · right to deletion · derecho de supresión
When it applies and when it does not
Art. 17.1 lists six grounds. The ones closest to a centre's daily life are three: the resident has left and their data are no longer needed; they withdraw the consent behind an optional processing operation, such as a published photo; or they object to one based on legitimate interest and there are no other overriding grounds. The controller has one month to reply, extendable by two more if the request is complex (art. 12.3). But the right has limits (art. 17.3):
- A legal obligation to keep the data (17.3.b): the invoice for the stay is not deleted because the resident asks.
- The defence of legal claims (17.3.e): whatever an open claim needs may stay.
- Archiving, research or statistics under the conditions of art. 89 (17.3.d).
Worth knowing
Erasing is not destroying on the spot. In Spain, art. 32 of the LOPDGDD, the national data protection act, requires the controller to block the data when erasing them: they are set aside and cannot be processed, available only to judges, the Public Prosecutor and the competent authorities for the limitation period of any liability, and are then destroyed. The centre's other duties are in the GDPR, and the period for each processing operation in its ROPA.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- ROPA (record of processing activities)The ROPA, or record of processing activities, is the document art. 30 of the GDPR requires of controller and processor: what data are processed, what for, whose, who receives them, whether they leave the EU, when they are deleted and under what security measures. It goes to the supervisory authority on request.