How can we prove that a subjects request for ‘erasure’ has been completed? Assuming we send an email confirming do we then delete the email? This one has always vexed me.
How to prove data erasure?
Share
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
How can we prove that a subjects request for ‘erasure’ has been completed? Assuming we send an email confirming do we then delete the email? This one has always vexed me.
Yorkie82
The answer is quite simple. You keep all the data that you need to be able to prove that the request has been dealt with correctly. The right to erasure request is not absolute and mainly just covers data that you hold based on consent not due to other lawful bases for processing. Here your reason to keep a proof of erasure could be your legitimate interest to protect the company from litigation or ICO complaints etc. Of course, you should just keep the minimum amount of data needed for this purpose. Also, the erasure request is just covering data you hold up to the point when the request is made. Technically the data associated with the measure request was created after the deletion request.
Stephen Lark
Simon,
Thanks for your response, it makes sense indeed. However I was thinking more at the point of engaging a new customer who then asks for details on your GDPR procedures particularly how you prove erasure. This is a real example of one I’m doing at the moment.
Currently I advise two approaches but was looking for some reinforcement firstly to notify the requestor of the erasure by email stating that on confirmation of receipt all details will be erased – putting proof into the hands of IT if processes exist OR delete all details save email address which is placed into an encrypted spreadsheet accessible only by 2 directors with a personal legal responsibility to safeguard that data.
Stephen Lark
Simon,
Thanks for your response,
Simon
A SysAdmin or someone in your IT Team with access to audit logs may be able to provide evidence, depending on your IT setup.
I suspect that if the individual complained to the ICO that they didn’t believe erasure had taken place the ICO could ask for reassurance, technical or otherwise, that erasure had taken place. Otherwise you’re into the world of IT forensics I guess.
If the individual doesn’t trust the audit logs then they are unlikely to trust anything and the ICO will probably cut them short shrift.