Under the GDPR, individuals have a right to erasure, also known as a ‘right to be forgotten’. This right can be exercised in the following circumstances:
- where the personal data is no longer necessary for the purposes for which it was originally collected or processed;
- where the individual withdraws consent;
- where the individual objects to the processing and there is no overriding legitimate interest to continue the processing;
- where the personal data is being processed unlawfully;
- where the personal data has to be erased to comply with a legal obligation.
- where the personal data is being processed for direct marketing purposes and the individual objects to the processing.
Where the University has made personal data public and is obliged to erase the data, it will, taking account of available technology and cost of implementation, take reasonable steps, including technical measures, to notify other controllers of the erasure request.
The University can refuse a request for erasure in certain circumstances i.e. where data is processed:
- to exercise the right of freedom of expression and information;
- to comply with a legal obligation;
- for the performance of a task carried out in the public interest or in the exercise of official authority;
- for reasons of public health where there is a public interest;
- for archiving purposes in the public interest, scientific research, historical research or statistical purposes
- for the establishment, exercise or defence of legal claim.
- for purposes of preventative or occupational medicine.
If you would like to exercise your right to erasure, please notify firstname.lastname@example.org.