GDPR - Right to be forgotten

I've been wondering about GDPR and the Right to be forgotten if you leave an employment...


If you withdraw your consent for the company to retain your information under GDPR, must all information about you be removed or are there some items of information which the employer must retain?
«134

Comments

  • bap98189
    bap98189 Posts: 3,801
    First Post First Anniversary
    Forumite
    prowla wrote: »
    I've been wondering about GDPR and the Right to be forgotten if you leave an employment...


    If you withdraw your consent for the company to retain your information under GDPR, must all information about you be removed or are there some items of information which the employer must retain?

    The right to be forgotten has nothing to do with GDPR.

    But the answer to your questions is that yes, an employer can retain a number of different records even if you write to them and try to withdraw your consent.
  • sangie595
    sangie595 Posts: 6,092 Forumite
    The right isn't absolute. There are certain types of data which the employer must retain, or retain for specific periods of time - tax records for example. There is other information which may be advisable to retain for periods - any employer who deletes anything before it is impossible for an employment tribunal to be claimed - so possibly up to 12 months, but definitely 6 months - is an idiot. Other pieces of information, similarly, should be held until there is no risk to the employer.

    The right to be forgotten is mitigated by legal necessity. Until there's some real practical testing of the law, nobody can predict with certainty what might be the case. But I wouldn't advise anyone to "forget" any employee until they have confidence that this is not a risk. If they can justify keeping the records, they can.
  • Marcon
    Marcon Posts: 10,314
    First Post First Anniversary Name Dropper Combo Breaker
    Forumite
    bap98189 wrote: »
    The right to be forgotten has nothing to do with GDPR.

    The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/
    Googling on your question might have been both quicker and easier, if you're only after simple facts rather than opinions!  
  • Comms69
    Comms69 Posts: 14,229
    Name Dropper First Anniversary First Post
    Forumite
    Marcon wrote: »
    The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/



    I think the 'right to be forgotten' as a term is used in many different ways. e.g. google / other search engines.
  • Undervalued
    Undervalued Posts: 8,839
    First Anniversary Name Dropper First Post
    Forumite
    Marcon wrote: »
    The right to be forgotten has everything to do with GDPR, unless the Information Commissioner is mistaken(!): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

    No, that is as it says a right to erasure! Not the same thing.

    The so called right to be forgotten applies to internet search engines etc.

    But yes, the page you linked does indeed answer the question the OP meant to ask!
  • Doshwaster
    Doshwaster Posts: 6,130
    Name Dropper First Post First Anniversary
    Forumite
    bap98189 wrote: »
    The right to be forgotten has nothing to do with GDPR.

    But the answer to your questions is that yes, an employer can retain a number of different records even if you write to them and try to withdraw your consent.

    Yes, there are some records which employers legally have to retain even if you don't want them to.

    You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)
  • Undervalued
    Undervalued Posts: 8,839
    First Anniversary Name Dropper First Post
    Forumite
    Doshwaster wrote: »
    Yes, there are some records which employers legally have to retain even if you don't want them to.

    You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)

    Yes, but that doesn't trump the GDPR requirements. The policy might say 10 years or even indefinitely but if the law (in the form of the ICO) thinks that is excessive the company can't rely on the policy.
  • Marcon
    Marcon Posts: 10,314
    First Post First Anniversary Name Dropper Combo Breaker
    Forumite
    No, that is as it says a right to erasure! Not the same thing.

    The so called right to be forgotten applies to internet search engines etc.

    But yes, the page you linked does indeed answer the question the OP meant to ask!

    I think OP asked the question they meant to ask. As IC says:
    • The GDPR introduces a right for individuals to have personal data erased.
    • The right to erasure is also known as ‘the right to be forgotten’.
    Googling on your question might have been both quicker and easier, if you're only after simple facts rather than opinions!  
  • sangie595
    sangie595 Posts: 6,092 Forumite
    Doshwaster wrote: »
    Yes, there are some records which employers legally have to retain even if you don't want them to.

    You should have a company privacy policy which states how long personal data is kept. I've just checked ours and some data are destroyed as soon as employment ends (e.g. emergency contact details, most medical information), most things are after 7 years while others are permanent (e.g. pension records, share options)
    Gosh. Your employers are terribly trusting. Given the possibly of a discrimination or liability claim, I doubt a court will go for "we destroy most medical records as soon as someone leaves".
  • Brynsam
    Brynsam Posts: 3,643
    First Anniversary Name Dropper Combo Breaker First Post
    Forumite
    Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the !!!8216;right to be forgotten!!!8217;. The right is not absolute and only applies in certain circumstances.
This discussion has been closed.
Meet your Ambassadors

Categories

  • All Categories
  • 342.4K Banking & Borrowing
  • 249.9K Reduce Debt & Boost Income
  • 449.4K Spending & Discounts
  • 234.6K Work, Benefits & Business
  • 607K Mortgages, Homes & Bills
  • 172.8K Life & Family
  • 247.4K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 15.8K Discuss & Feedback
  • 15.1K Coronavirus Support Boards