第 17 條 📖 GDPR. 刪除權（「被遺忘權」）

第 17 條 GDPR. 刪除權（「被遺忘權」）

Article 17 GDPR. Right to erasure (‘right to be forgotten’)

1. 有下列情事者，資料主體應有權使控管者刪除其個人資料，不得無故拖延，且控管者應有義務刪除該個人資料，不得無故拖延：

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

專家評論

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

(a) 個人資料對於蒐集或處理目的不再需要者；

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) 處理係依據第 6 條第 1 項第 a 點或第 9 條第 2 項第 a 點者，資料主體撤回其同意，且該處理已無其他法律依據者；

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

第 6 條 GDPR. 處理之合法性

Article 6 GDPR. Lawfulness of processing

1. 合法之處理應至少符合下列要件之一：

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) 資料主體同意為一個或多個特定目的處理其個人資料；

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

第 9 條 GDPR. 特殊類型之個人資料處理

Article 9 GDPR. Processing of special categories of personal data

1. 揭露種族或人種、政治意見、宗教或哲學信仰或貿易聯盟會員之個人資料、以及基因資料、用以識別自然人之生物特徵識別資料、與健康相關或與自然人之性生活或性傾向有關個人資料之處理，應予禁止。

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2. 有下列情形之一者，不適用第 1 項規定：

2. Paragraph 1 shall not apply if one of the following applies:

(a) 除歐盟法或會員國法律規定資料主體不得排除第 1 項所定之禁止外，資料主體已明確同意為一個或多個特定目的處理上開個人資料；

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

(c) 資料主體依第 21 條第 1 項規定對處理提出異議，且該處理無其他優先適用之法律依據者，或資料主體依第 21 條第 2 項規定對處理提出異議者；

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

第 21 條 GDPR. 拒絕權

Article 21 GDPR. Right to object

1. 資料主體應有權基於與其具體情況有關之理由，隨時拒絕依第 6 條第 1 項第 e 點或第 f 點規定所為有關其個人資料之處理，包括基於該等條款所為之建檔。控管者應不得再處理該個人資料，除非該控管者證明其處理有優先於資料主體權利及自由之法律依據、或為建立、行使或防禦法律上請求所為之者。

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

2. 為直接行銷目的處理個人資料時，該資料主體有權隨時拒絕為行銷目的所涉及其個人資料之處理，包括與該直接行銷有關範圍內之建檔。

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

[…]

(d) 該個人資料遭違法處理者；

(d) the personal data have been unlawfully processed;

(e) 控管者依其受拘束之歐盟法或會員國法律有義務應刪除個人資料者；

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) 個人資料係依據第 8 條第 1 項所定為提供資訊社會服務所蒐集者。

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

1. 第 6條第 1項第 a點適用於直接向兒童提供資訊社會服務之情況，如兒童年滿 16 歲，兒童之個人資料處理應屬合法。如該兒童未滿 16 歲，僅限於其法定代理人授權或同意之範圍內，該等處理始為合法。

1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

會員國得以法律為該等目的規定較低年齡，惟不得低於 13 歲。

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

[…]

Guidelines on consent under Regulation 2016/679

Information society service

129. While assessing the scope of this definition, the EDPB also refers to case law of the ECJ.[62] The ECJ held that information society services cover contracts and other services that are concluded or transmitted on-line. Where a service has two economically independent components, one being the online component, such as the offer and the acceptance of an offer in the context of the conclusion of a contract or the information relating to products or services, including marketing activities, this component is defined as an information society service, the other component being the physical delivery or distribution of goods is not covered by the notion of an information society service. The online delivery of a service would fall within the scope of the term information society service in Article 8 GDPR.

_{[62] See European Court of Justice, 2 December 2010 Case C-108/09, (Ker-Optika), paragraphs 22 and 28. In relation to ‘composite services’, the EDPB also refers to Case C-434/15 (Asociacion Profesional Elite Taxi v Uber Systems Spain SL), para 40, which states that an information society service forming an integral part of an overall service whose main component is not an information society service (in this case a transport service), must not be qualified as ‘an information society service’.}

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Offering of goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the Union

The first activity triggering the application of Article 3(2) is the “offering of goods or services”, a concept which has been further addressed by EU law and case law, which should be taken into account when applying the targeting criterion. The offering of services also includes the offering of information society services, defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 [23] as “any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”.

_{[23] Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services.}

2. 如控管者已將該個人資料公開，且其有義務依據第 1 項規定刪除該個人資料者，考量現有科技及執行成本，該控管者應採取合理步驟，包括科技方式，通知正在處理該個人資料之控管者，資料主體已提出刪去任何該個人資料之連結或複製或仿製之請求。

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 17(2) GDPR:

8.3.1 Obligations to PII principals

Control

The organization should provide the customer with the means to comply with its obligations related to PII principals.

Implementation guidance

A PII controller’s obligations can be defined by legislation, by regulation and/or by contract.

…

登入
访问全文

3. 於下列情形者，不適用第 1 項及第 2 項規定：

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 17(3) GDPR:

7.2.2 Identify lawful basis

Control

The organization should determine, document and comply with the relevant lawful basis for the processing of PII for the identified purposes.

Implementation guidance

Some jurisdictions require the organization to be able to demonstrate that the lawfulness of processing was duly established before the processing.

…

登入
访问全文

(a) 為行使表意自由及資訊權者；

(a) for exercising the right of freedom of expression and information;

(b) 依據控管者所應遵守之歐盟法或會員國法，遵守其法律義務、或符合公共利益之職務執行、或委託控管者行使公權力所必須者；

(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) 基於公共衛生領域上之公共利益，且符合第 9 條第 2 項第 h 點及第 i 點及第 9 條第 3 項規定者；

(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

第 9 條 GDPR. 特殊類型之個人資料處理

Article 9 GDPR. Processing of special categories of personal data

2. 有下列情形之一者，不適用第 1 項規定：

2. Paragraph 1 shall not apply if one of the following applies:

[…]

(h) 依據歐盟法或會員國法律或基於與健康專業人員所定且受第 3 項要件及保護措施所拘束之契約，且為預防或職業醫學之目的、為評估僱員之工作能力、醫療診斷、為提供健康或社會照護或治療或為健康管理或社會照護系統及服務而有必要之處理；

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i) 處理係基於公共衛生領域之公共利益，例如為防止對於健康之跨境嚴重威脅或為確保醫療保健及醫療產品或醫療設備品質之高標準與安全性而有必要者，並依據歐盟法或會員國法律規定採取適當及具體安全措施保護資料主體之權利和自由，尤其是職業秘密；

(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

[…]

3. 當資料係由基於歐盟法或會員國法或國內主管機構所訂定之規則受職業秘密之義務所拘束之專業人員或其他人處理或由其負責處理時，為第 2 項第 h 點所定目的，得處理第 1 項所定之個人資料；

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

(d) 為實現公共利益、科學或歷史研究目的或統計目的，且符合第 89 條第 1 項規定者，但以第 1 項所定權利實際上不可能或嚴重損害該處理目標之實現者為限；

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

第 89 條 GDPR. 為實現公共利益、科學或歷史研究目的或統計目的所為處理之保護措施及例外規定

Article 89 GDPR. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. 為實現公共利益、科學或歷史研究目的或統計目的之處理，應受本規則為資料主體之權利及自由所定適當保護措施之拘束。該等保護措施應確保已備妥技術上及組織上之措施，特別是用以確保資料最少蒐集原則之落實。只要上開目的得以實現，措施得包括假名化。當透過進階處理得實現上開目的，且進階處理不允許或不再允許識別資料 180 主體者，上開目的應以該方式實現。

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

[…]

Guidelines on consent under Regulation 2016/679

Scientific research

153. Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

(e) 為了建立、行使或防禦法律上之請求者。

(e) for the establishment, exercise or defence of legal claims.

通用数据保护条例(EU GDPR)

Source: https://www.ndc.gov.tw/Content_List.aspx?n=F98A8C27A0F54C30

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

專家評論 ISO 27701 献技指南和案例法发表评论

專家評論

(EN) The so-called “right to be forgotten” was hailed as a breakthrough with the adoption of the General Data Protection Regulation, even though it existed in a limited form before. Article 17 provides for a broader “right to erasure”, to take into account the exact wording of the provision. European Union residents have a right to ask for the deletion of their personal data, and the organization that holds the data has a corresponding obligation to erase them “without undue delay” under a certain number of circumstances.

…

登入
访问全文

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Request to erase my personal data

Dear Madam, Dear Sir,

You have data concerning me that I am asking you to delete…

…

登入
访问全文

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 17 GDPR:

7.3.6 Access, correction and/or erasure

Control

The organization should implement policies, procedures and/or mechanisms to meet their obligations to PII principals to access, correct and/or erase their PII.

Implementation guidance

The organization should implement policies, procedures and/or mechanisms for enabling PII principals to obtain access to, correct and erase of their PII, if requested and without undue delay.

…

登入
访问全文

献技

(65) 資料主體應有更正其個人資料之權利、以及當資料保存違反規範控管者之本規則、歐盟法或會員國法時應有「被遺忘權」。尤其，資料主體應享有刪除其個人資料之權利，並於該個人資料就資料蒐集或另為處理之目的已無必要時、於資料主體已撤回其同意或拒絕其個人資料之處理時、或於其個人資料處理違反本規則時，資料主體應享有請求不再處理其個人資料之權利。該權利尤其涉及該資料主體於兒童時期所為同意且未完整理解該處理存在之風險，爾後希望移除其個人資料（特別是網路上資料）之情形。不問其是否仍為兒童，資料主體應得行使該權利。然而，為了表意自由權之行使、法律義務之遵守、符合公共利益之職務執行、或委託控管者行使公權力所必須者、在公共衛生領域上之公共利益的理由、為了實現公共利益、科學或歷史研究目的或統計目的時、或為了建立、行使或防禦法律上主張時，於必要範圍內進一步保留個人資料應屬合法。

(65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

(66) 為強化網路環境之被遺忘權，刪除權亦應擴張至公開個人資訊之控管者有義務通知個人資料處理之控管者刪去任何該個人資料之連結、複製或仿製。透過此種做法，該控管者應採取合理步驟，考量現有科技與對控管者可行之手段，包括科技方式，通知依該資料主體之請求而正在處理該個人資料之控管者。

(66) To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request.

指南和案例法

(EN)