GDPR - Right to be forgotten

prowla

I've been wondering about GDPR and the Right to be forgotten if you leave an employment...


If you withdraw your consent for the company to retain your information under GDPR, must all information about you be removed or are there some items of information which the employer must retain?

bap98189

prowla wrote: »

I've been wondering about GDPR and the Right to be forgotten if you leave an employment...


If you withdraw your consent for the company to retain your information under GDPR, must all information about you be removed or are there some items of information which the employer must retain?

The right to be forgotten has nothing to do with GDPR.

But the answer to your questions is that yes, an employer can retain a number of different records even if you write to them and try to withdraw your consent.

sangie595

The right isn't absolute. There are certain types of data which the employer must retain, or retain for specific periods of time - tax records for example. There is other information which may be advisable to retain for periods - any employer who deletes anything before it is impossible for an employment tribunal to be claimed - so possibly up to 12 months, but definitely 6 months - is an idiot. Other pieces of information, similarly, should be held until there is no risk to the employer.

The right to be forgotten is mitigated by legal necessity. Until there's some real practical testing of the law, nobody can predict with certainty what might be the case. But I wouldn't advise anyone to "forget" any employee until they have confidence that this is not a risk. If they can justify keeping the records, they can.

Marcon

bap98189 wrote: »

The right to be forgotten has nothing to do with GDPR.

The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

Comms69

Marcon wrote: »

The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

I think the 'right to be forgotten' as a term is used in many different ways. e.g. google / other search engines.

Undervalued

Marcon wrote: »

The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

No, that is as it says a right to erasure! Not the same thing.

The so called right to be forgotten applies to internet search engines etc.

But yes, the page you linked does indeed answer the question the OP meant to ask!

Doshwaster

bap98189 wrote: »

The right to be forgotten has nothing to do with GDPR.

But the answer to your questions is that yes, an employer can retain a number of different records even if you write to them and try to withdraw your consent.

Yes, there are some records which employers legally have to retain even if you don't want them to.

You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)

Undervalued

Doshwaster wrote: »

Yes, there are some records which employers legally have to retain even if you don't want them to.

You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)

Yes, but that doesn't trump the GDPR requirements. The policy might say 10 years or even indefinitely but if the law (in the form of the ICO) thinks that is excessive the company can't rely on the policy.

Marcon

Undervalued wrote: »

No, that is as it says a right to erasure! Not the same thing.

The so called right to be forgotten applies to internet search engines etc.

But yes, the page you linked does indeed answer the question the OP meant to ask!

I think OP asked the question they meant to ask. As IC says:

• The GDPR introduces a right for individuals to have personal data erased.
• The right to erasure is also known as ‘the right to be forgotten’.

sangie595

Doshwaster wrote: »

Yes, there are some records which employers legally have to retain even if you don't want them to.

You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)

Gosh. Your employers are terribly trusting. Given the possibly of a discrimination or liability claim, I doubt a court will go for "we destroy most medical records as soon as someone leaves".

Brynsam

Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the !!!8216;right to be forgotten!!!8217;. The right is not absolute and only applies in certain circumstances.