Artikel 17 📖 GDPR. Ret til sletning (»retten til at blive glemt«)

Artikel 17 GDPR. Ret til sletning (»retten til at blive glemt«)

Article 17 GDPR. Right to erasure (‘right to be forgotten’)

1. Den registrerede har ret til at få personoplysninger om sig selv slettet af den dataansvarlige uden unødig forsinkelse, og den dataansvarlige har pligt til at slette personoplysninger uden unødig forsinkelse, hvis et af følgende forhold gør sig gældende:

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

Ekspertkommentar

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

a) Personoplysningerne er ikke længere nødvendige til at opfylde de formål, hvortil de blev indsamlet eller på anden vis behandlet.

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) Den registrerede trækker det samtykke, der er grundlaget for behandlingen, jf. artikel 6, stk. 1, litra a), eller artikel 9, stk. 2, litra a), tilbage, og der er ikke et andet retsgrundlag for behandlingen.

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

Sammenkædede tekster

Artikel 6 GDPR. Lovlig behandling

Article 6 GDPR. Lawfulness of processing

1. Behandling er kun lovlig, hvis og i det omfang mindst ét af følgende forhold gør sig gældende:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

a) Den registrerede har givet samtykke til behandling af sine personoplysninger til et eller flere specifikke formål.

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

Artikel 9 GDPR. Behandling af særlige kategorier af personoplysninger

Article 9 GDPR. Processing of special categories of personal data

1. Behandling af personoplysninger om race eller etnisk oprindelse, politisk, religiøs eller filosofisk overbevisning eller fagforeningsmæssigt tilhørsforhold samt behandling af genetiske data, biometriske data med det formål entydigt at identificere en fysisk person, helbredsoplysninger eller oplysninger om en fysisk persons seksuelle forhold eller seksuelle orientering er forbudt.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2. Stk. 1 finder ikke anvendelse, hvis et af følgende forhold gør sig gældende:

2. Paragraph 1 shall not apply if one of the following applies:

a) Den registrerede har givet udtrykkeligt samtykke til behandling af sådanne personoplysninger til et eller flere specifikke formål, medmindre det i EU-retten eller medlemsstaternes nationale ret er fastsat, at det i stk. 1 omhandlede forbud ikke kan hæves ved den registreredes samtykke.

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

c) Den registrerede gør indsigelse mod behandlingen i henhold til artikel 21, stk. 1, og der foreligger ikke legitime grunde til behandlingen, som går forud for indsigelsen, eller den registrerede gør indsigelse mod behandlingen i medfør af artikel 21, stk. 2.

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

Sammenkædede tekster

Artikel 21 GDPR. Ret til indsigelse

Article 21 GDPR. Right to object

1. Den registrerede har til enhver tid ret til af grunde, der vedrører den pågældendes særlige situation, at gøre indsigelse mod behandling af sine personoplysninger baseret på artikel 6, stk. 1, litra e) eller f), herunder profilering baseret på disse bestemmelser. Den dataansvarlige må ikke længere behandle personoplysningerne, medmindre den dataansvarlige påviser vægtige legitime grunde til behandlingen, der går forud for registreredes interesser, rettigheder og frihedsrettigheder, eller behandlingen er nødvendig for, at retskrav kan fastlægges, gøres gældende eller forsvares.

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

2. Hvis personoplysninger behandles med henblik på direkte markedsføring, har den registrerede til enhver tid ret til at gøre indsigelse mod behandling af sine personoplysninger til sådan markedsføring, herunder at gøre indsigelse mod profilering, i det omfang den vedrører direkte markedsføring.

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

[…]

d) Personoplysningerne er blevet behandlet ulovligt.

(d) the personal data have been unlawfully processed;

e) Personoplysningerne skal slettes for at overholde en retlig forpligtelse i EU-retten eller medlemsstaternes nationale ret, som den dataansvarlige er underlagt.

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

f) Personoplysningerne er blevet indsamlet i forbindelse med udbud af informationssamfundstjenester som omhandlet i artikel 8, stk. 1.

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Sammenkædede tekster

1. Hvis artikel 6, stk. 1, litra a), finder anvendelse i forbindelse med udbud af informationssamfundstjenester direkte til børn, er behandling af personoplysninger om et barn lovlig, hvis barnet er mindst 16 år. Er barnet under 16 år, er sådan behandling kun lovlig, hvis og i det omfang samtykke gives eller godkendes af indehaveren af forældremyndigheden over barnet.

1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Medlemsstaterne kan ved lov fastsætte en lavere aldersgrænse til disse formål, forudsat at en sådan aldersgrænse ikke er under 13 år.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

[…]

Guidelines on consent under Regulation 2016/679

Information society service

129. While assessing the scope of this definition, the EDPB also refers to case law of the ECJ.[62] The ECJ held that information society services cover contracts and other services that are concluded or transmitted on-line. Where a service has two economically independent components, one being the online component, such as the offer and the acceptance of an offer in the context of the conclusion of a contract or the information relating to products or services, including marketing activities, this component is defined as an information society service, the other component being the physical delivery or distribution of goods is not covered by the notion of an information society service. The online delivery of a service would fall within the scope of the term information society service in Article 8 GDPR.

_{[62] See European Court of Justice, 2 December 2010 Case C-108/09, (Ker-Optika), paragraphs 22 and 28. In relation to ‘composite services’, the EDPB also refers to Case C-434/15 (Asociacion Profesional Elite Taxi v Uber Systems Spain SL), para 40, which states that an information society service forming an integral part of an overall service whose main component is not an information society service (in this case a transport service), must not be qualified as ‘an information society service’.}

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Offering of goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the Union

The first activity triggering the application of Article 3(2) is the “offering of goods or services”, a concept which has been further addressed by EU law and case law, which should be taken into account when applying the targeting criterion. The offering of services also includes the offering of information society services, defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 [23] as “any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”.

_{[23] Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services.}

2. Hvis den dataansvarlige har offentliggjort personoplysningerne og i henhold til stk. 1 er forpligtet til at slette personoplysningerne, træffer den dataansvarlige under hensyntagen til den teknologi, der er tilgængelig, og omkostningerne ved implementeringen, rimelige foranstaltninger, herunder tekniske foranstaltninger, for at underrette de dataansvarlige, som behandler personoplysningerne, om, at den registrerede har anmodet disse dataansvarlige om at slette alle link til eller kopier eller gengivelser af de pågældende personoplysninger.

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 17(2) GDPR:

8.3.1 Obligations to PII principals

Control

The organization should provide the customer with the means to comply with its obligations related to PII principals.

Implementation guidance

A PII controller’s obligations can be defined by legislation, by regulation and/or by contract.

(EN) […]

(EN) Sign in
to read the full text

3. Stk. 1 og 2 finder ikke anvendelse, i det omfang denne behandling er nødvendig:

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 17(3) GDPR:

7.2.2 Identify lawful basis

Control

The organization should determine, document and comply with the relevant lawful basis for the processing of PII for the identified purposes.

Implementation guidance

Some jurisdictions require the organization to be able to demonstrate that the lawfulness of processing was duly established before the processing.

(EN) […]

(EN) Sign in
to read the full text

a) for at udøve retten til ytrings- og informationsfrihed

(a) for exercising the right of freedom of expression and information;

b) for at overholde en retlig forpligtelse, der kræver behandling i henhold til EU-retten eller medlemsstaternes nationale ret, og som den dataansvarlige er underlagt, eller for at udføre en opgave i samfundets interesse eller som henhører under offentlig myndighedsudøvelse, som den dataansvarlige har fået pålagt

(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c) af hensyn til samfundsinteresser på folkesundhedsområdet i overensstemmelse med artikel 9, stk. 2, litra h) og i), samt artikel 9, stk. 3

(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

Sammenkædede tekster

Artikel 9 GDPR. Behandling af særlige kategorier af personoplysninger

Article 9 GDPR. Processing of special categories of personal data

2. Stk. 1 finder ikke anvendelse, hvis et af følgende forhold gør sig gældende:

2. Paragraph 1 shall not apply if one of the following applies:

[…]

h) Behandling er nødvendig med henblik på forebyggende medicin eller arbejdsmedicin til vurdering af arbejdstagerens erhvervsevne, medicinsk diagnose, ydelse af social- og sundhedsomsorg eller -behandling eller forvaltning af social- og sundhedsomsorg og -tjenester på grundlag af EU-retten eller medlemsstaternes nationale ret eller i henhold til en kontrakt med en sundhedsperson og underlagt de betingelser og garantier, der er omhandlet i stk. 3.

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

i) Behandling er nødvendig af hensyn til samfundsinteresser på folkesundhedsområdet, f.eks. beskyttelse mod alvorlige grænseoverskridende sundhedsrisici eller sikring af høje kvalitets- og sikkerhedsstandarder for sundhedspleje og lægemidler eller medicinsk udstyr på grundlag af EU-retten eller medlemsstaternes nationale ret, som fastsætter passende og specifikke foranstaltninger til beskyttelse af den registreredes rettigheder og frihedsrettigheder, navnlig tavshedspligt.

(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

[…]

3. Personoplysninger som omhandlet i stk. 1 kan behandles til de formål, der er omhandlet i stk. 2, litra h), hvis disse oplysninger behandles af en fagperson, der har tavshedspligt i henhold til EU-retten eller medlemsstaternes nationale ret eller regler, der er fastsat af nationale kompetente organer, eller under en sådan persons ansvar, eller af en anden person, der også har tavshedspligt i henhold til EU-retten eller medlemsstaternes nationale ret eller regler, der er fastsat af nationale kompetente organer.

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

d) til arkivformål i samfundets interesse, til videnskabelige eller historiske forskningsformål eller til statistiske formål i overensstemmelse med artikel 89, stk. 1, i det omfang den rettighed, der er omhandlet i stk. 1, sandsynligvis vil gøre det umuligt eller i alvorlig grad hindre opfyldelse af denne behandling, eller

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

Sammenkædede tekster

Artikel 89 GDPR. Garantier og undtagelser i forbindelse med behandling til arkivformål i samfundets interesse, til videnskabelige eller historiske forskningsformål eller til statistiske formål

Article 89 GDPR. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. Behandling til arkivformål i samfundets interesse, til videnskabelige eller historiske forskningsformål eller til statistiske formål skal være underlagt fornødne garantier for registreredes rettigheder og frihedsrettigheder i overensstemmelse med denne forordning. Disse garantier skal sikre, at der er truffet tekniske og organisatoriske foranstaltninger, især for at sikre overholdelse af princippet om dataminimering. Disse foranstaltninger kan omfatte pseudonymisering, forudsat at disse formål kan opfyldes på denne måde. Når disse formål kan opfyldes ved viderebehandling, som ikke gør det muligt eller ikke længere gør det muligt at identificere de registrerede, skal formålene opfyldes på denne måde.

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

[…]

Guidelines on consent under Regulation 2016/679

Scientific research

153. Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

e) for, at retskrav kan fastlægges, gøres gældende eller forsvares.

(e) for the establishment, exercise or defence of legal claims.

Generel forordning om databeskyttelse (GDPR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Ekspertkommentar ISO 27701 Betragtning Retningslinjer & Case Law Efterlad en kommentar

Ekspertkommentar

(EN) The so-called “right to be forgotten” was hailed as a breakthrough with the adoption of the General Data Protection Regulation, even though it existed in a limited form before. Article 17 provides for a broader “right to erasure”, to take into account the exact wording of the provision. European Union residents have a right to ask for the deletion of their personal data, and the organization that holds the data has a corresponding obligation to erase them “without undue delay” under a certain number of circumstances.

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Request to erase my personal data

Dear Madam, Dear Sir,

You have data concerning me that I am asking you to delete…

(EN) […]

(EN) Sign in
to read the full text

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 17 GDPR:

7.3.6 Access, correction and/or erasure

Control

The organization should implement policies, procedures and/or mechanisms to meet their obligations to PII principals to access, correct and/or erase their PII.

Implementation guidance

The organization should implement policies, procedures and/or mechanisms for enabling PII principals to obtain access to, correct and erase of their PII, if requested and without undue delay.

(EN) […]

(EN) Sign in
to read the full text

Betragtning

(65) En registreret bør have ret til at få berigtiget sine personoplysninger og »ret til at blive glemt«, hvis opbevaringen af sådanne oplysninger overtræder denne forordning eller EU-ret eller medlemsstaternes nationale ret, som den dataansvarlige er underlagt. En registreret bør navnlig have ret til at få sine personoplysninger slettet og ikke længere behandlet, hvis personoplysningerne ikke længere er nødvendige til de formål, hvortil de er blevet indsamlet eller på anden måde behandlet, hvis en registreret har trukket sit samtykke tilbage eller gør indsigelse mod behandling af personoplysninger om vedkommende, eller hvis behandlingen af vedkommendes personoplysninger i øvrigt ikke er i overensstemmelse med denne forordning. Denne ret er navnlig relevant, når den registrerede har givet sit samtykke som barn og ikke er fuldt ud var bekendt med risiciene i forbindelse med behandling, og senere ønsker at fjerne sådanne personoplysninger, særligt på internettet. Den registrerede bør kunne udøve denne rettighed, uanset om vedkommende ikke længere er et barn. Yderligere opbevaring af personoplysningerne bør dog være lovlig, hvis det er nødvendigt for at udøve retten til ytrings- og informationsfrihed, for at overholde en retlig forpligtelse, for udførelsen af en opgave i samfundets interesse eller som henhører under offentlig myndighedsudøvelse, som den dataansvarlige har fået pålagt, af hensyn til samfundsinteresser på folkesundhedsområdet, til arkivformål i samfundets interesse, til videnskabelige eller historiske forskningsformål eller statistiske formål, eller for at retskrav kan fastlægges, gøres gældende eller forsvares.

(65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

(66) For at styrke retten til at blive glemt i onlinemiljøet bør retten til sletning udvides, så en dataansvarlig, der har offentliggjort personoplysninger, forpligtes til at underrette de dataansvarlige, der behandler sådanne personoplysninger, med henblik på at få slettet alle link til, kopier af eller gengivelser af disse personoplysninger. I den forbindelse bør den dataansvarlige tage rimelige skridt under hensyntagen til den tilgængelige teknologi og de midler, som den dataansvarlige har til sin rådighed, herunder tekniske foranstaltninger, til at informere de dataansvarlige, der behandler personoplysningerne, om den registreredes anmodning.

(66) To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request.

Retningslinjer & Case Law

(EN)