PRIMA // BLOG

Realisation of the duty to erasure

For the lawful processing of personal data, a legal basis is necessary, and the processing can only last as long as it is necessary to fulfill the purpose for which the personal data was collected. Afterwards, the personal data needs to be erased. In this document you can read about the processes you should implement to fulfil this duty.

Permitted period for storing personal data

The legal basis for the processing of personal data is most of the time the GDPR or the german data protection law (BDSG). Also, company agreements or collective labour agreements can be the legal basis for processing personal data.

Before collecting personal data, it is therefore necessary to ensure that an applicable legal basis exists. A legal basis is for example applicable, if the data subject has given consent to the processing, or the processing is necessary for compliance with a legal obligation or for the performance of a contract. Up on to the fulfillment of the purpose, the processing of the personal data is lawful. Given the case of an order of goods, the purpose of the collection of address data is fulfilled, when the order is delivered.

When do you need to delete personal data?

After the purpose of the processing is fulfilled, personal data usually needs to be erased. Often there is a reason to store the data longer. One possible reason is that a new legal basis is applicable because a new or changed purpose for the processing exists. When the address data for the order process is collected and the recipient agrees to receive advertising of the company, the company can process the address data after the delivery of the order to send advertisements.

Even after every purpose is fulfilled, a check for possible legal storage obligation should be performed. Regularly, such obligations exist. In that case, the further storage is necessary. Typically, such obligations resolve from tax- and commercial-law statues.

In case of the order-process described above, the storage of personal data is possible until the limitation period has expired. Usually, this period is three years starting with the end of the year where the order was made. The reason for this is the possibility of legal disputes related to the order. If commercial or business letters were created because of the order, the letters must be stored for six years.

When no applicable legal basis exists and the period for legal storage obligations is over, the personal data must be erased.

Here you can find an overview of deletion periods for HR data.

Duty to provide a erasure concept 

Art. 5 sec. 2 GDPR provides a factual obligation to provide a concept for the erasure of personal data.

Art. 5 sec. 1 let. e GDPR provides the principle of storage limitation. Together with the principle of purpose limitation in Art. 5 sec. 1 let. B GDPR the duty of erasure is concluded. Also Art. 17 GDPR provides the data subject with the right to obtain erasure of personal data. Due to the obligation of accountability in Art. 5 sec. 2 GDPR for the fulfilment of these obligations the controller needs to be able to demonstrate compliance with these provisions. Therefore, the controller needs to document the personal data, which is included in the it systems, the purposes of the processing, the storage and erasure period as well as a proof for the erasure. In other words: an erasure concept.

How to create this concept

The basis for creating the concept for erasure of personal data is the creation of an overview of the it-systems and all processing of personal data. Afterwards, the specifically affected personal data and the categories of this data are added to the respective it-system and process. For each category of personal data, the respective duration for the existence of the purpose for the processing needs to be determined. Also, the period of storage after the realisation of the purpose needs to be defined.

Here you can download our sample.

What happens if the personal data is erased too late or not at all?

A violation of the principles of storage and purpose limitation can lead to a fine of up to 20 million euros or up to 4% of the worldwide turnover of the company. In 2019 the responsible data protection officer of Berlin fined the company “Deutsche Wohnen” with a fine of 14 million euros - the highest fine till now in Germany - for the violation of the duty to erasure. Till now, the legal process about the fine is ongoing and the fine is not legally binding.

The danger of cyber risks is constantly increasing. In addition to the threat to IT security, IT security incidents are always relevant in terms of data protection law. Read here how to react correctly and what preparations you can make in the event of an emergency.

What is a data breach?

According to Art. 33 (1) GDPR, a data breach is "a personal data breach", i.e. an incident that violates the security of personal data so that unauthorised persons can access it. Classic cases are

• Accidentally sending the wrong emails or having too large an open mailing list
• Access to IT systems as a result of hacking or phishing attacks
• Theft or loss of data carriers, laptops, etc.
• Security gaps in IT systems
• Hidden but not deleted information in Excel documents

What needs to be considered for data breaches?

The top priority with data breaches is to quickly identify and eliminate the cause in order to minimise or eliminate the consequences for data subjects and prevent the data breach from spreading.

If the data breach results in risks to the rights and freedoms of the data subjects or if this cannot be ruled out, the data breach must be reported to the competent supervisory authority immediately and, if possible, within 72 hours. This happens relatively frequently.

If the data breach is also likely to result in a high risk to the rights and freedoms of the data subjects, the data subjects must also be informed immediately. This happens, but is less common than reporting to the competent supervisory authority.

Measures for internal detection and reporting

In order to be able to react appropriately to a data breach, it is particularly important that data breaches are quickly recognised internally and reported internally immediately. This requires that all employees know what a data breach is, to whom it must be reported internally and how it should be reported. It makes sense to create an instruction, guideline or similar document that describes the process. However, this process must also be communicated to employees so that they are aware of it and can follow it. The motto for this is: train, train, train.

Internal treatment - countermeasures and decision on the report

After the internal report, people should immediately come together and take action who can take technical countermeasures, evaluate the process and decide on further (legal) steps. The composition of the data breach team is made up of several or the following stakeholders:

• IT department
• IT securityInformation securit
• Cyyber insurance
• Data protection officer
• Legal department
• External legal and IT and IT security consultants
• senior management

The first priority of the data breach team should always be to take countermeasures, then clarify the extent of the incident and then decide on the next steps. Further steps are usually

• Deciding whether to notify the relevant data protection authority (mandatory for all companies if the requirements are met)
• Decision to report to the BSI (mandatory for KRITIS companies, voluntary for other companies)
• Decision on whether to file a criminal complaint with the cybercrime unit of the competent state criminal investigation office (not mandatory)
• Decision on informing the data subjects
• Implementation of the measures

Notification of data breaches to data protection authorities

If there is an obligation to report under Art. 33 GDPR, the report should be submitted within 72 hours of the incident being discovered. To be on the safe side, the first internal knowledge should be used to calculate the deadline. A later notification is possible and, in case of doubt, still makes sense after 72 hours; however, reasons must then generally be given as to why the 72-hour deadline was not met.

Art. 33 GDPR does not provide for a special form of notification. However, the supervisory authorities have online notification forms for this purpose and it is advisable to use these because the supervisory authorities receive the notification in a form that enables it to be processed quickly and, ideally, dealt with. This must be the aim of the notification.

Information of data subjects

Pursuant to Art. 34 (1) GDPR, data subjects must be informed if there is a high risk to the rights and freedoms of the data subjects. In this case, the data subjects must be informed about the incident in clear, simple language. The information should contain at least this information

• Description of the nature of the personal data breach
• where possible, the categories and approximate number of data subjects and data involved
• the name and contact details of the data protection officer or other contact point for further information
• Description of the likely consequences
• Description of the countermeasures taken or proposed

There are exceptions where personal information does not have to be provided. However, these should be treated with caution.

• You have taken appropriate technical and organisational security measures to prevent access to the data, in particular through encryption.
• You have taken measures to ensure that, in all probability, the risk to the rights and freedoms of the data subjects no longer exists.
• Notification would involve a disproportionate effort. In this case, a public announcement or similar measure must be made instead, through which data subjects are informed in a comparably effective manner.

Does reporting make you free and what are the consequences of failing to report?

The question of whether to report an incident is often discussed intensively in the data breach team. The concern that management, legal department and IT controllers in particular often have is that they could bring the data protection supervisory authority and thus many problems into the company or possibly provoke conditions and sanctions. Attempts are then often made to minimise the incident or the consequences in order to avoid a report.

These concerns are generally unfounded. Section 43 (4) BDSG contains a prohibition on the utilisation of evidence for the contents of the report, which we believe is observed by the data protection authorities despite criticism of the provision under European law. In this respect, the following applies: What is reported cannot be used against the controller.

In addition, the reactions of the data protection authorities to reports are generally much more harmless than is often feared. You often receive an acknowledgement of receipt, occasionally queries, and also occasionally the notification that the process has been checked and finalised. It is possible that a report will be followed by a supervisory process, but this is rather rare in relation to the number of reports submitted.

Data subjects have a number of rights in relation to data controllers. When you receive requests from data subjects, it is important to handle them correctly to prevent them from becoming a major problem for your company and your data protection organisation. Read here about the points to bear in mind.

How must the request for information be submitted?

There are virtually no formal requirements for data subject requests. Data subjects can submit them in writing, electronically or verbally. It is important for the handling of the request to understand what the data subject is concerned about. This sounds logical, but in practice can be the first challenge. You should ask yourself what the data subjects really want. If requests from data subjects are not clear, you need to be able to interpret them. The following requests regarding data subjects' rights are particularly suitable for this purpose

·       Access in line with Art. 15 (1) GDPR

·       Provision of a copy of the data in line with Art. 15 (3) GDPR

·       Rectification pursuant to Art. 16 GDPR

·       Erasure pursuant to Art. 17 GDPR

·       Restriction of processing or blocking of their personal data (Art. 18 GDPR) or

·       Data portability (Art. 20 GDPR)

It is also possible, and in practice a frequent case, that data subjects request the restriction of their email or telephone number for web emails or calls.

The right interpretation of the data subject's request is the first step towards a good response. In order to avoid misunderstandings, it makes sense to inform the data subject of the result of the interpretation when replying. One possible phrasing could be:

"Thank you for your email. We understand your request as a request for information in accordance with Art. 15 (1) GDPR."

Let's take a closer look at the highly relevant cases of access pursuant to Art. 15 (1) GDPR and the provision of a copy of data pursuant to Art. 15 (3) GDPR.

Identity check

To ensure that the response to the access request does not itself become a compliance boomerang, it is important to only provide the information to the data subject. This is also required by Art. 12 (6) GDPR. In practice, it happens from time to time that divorced spouses, the ex, other family members or complete strangers make requests for information. Answering these without verifying your identity can easily lead to a disaster.

You should always check who you are dealing with on the other side. This is not a problem for requests from your own employees, customers you know personally or other people you know personally. If you do not know the requesting party personally, you must ask yourself whether there are reasonable doubts about their identity. This may be the case, for example, if an enquiry is sent from an email that you do not know, or if an email suggests that it is a different person because, for example, a data subject enquiry is sent from the email account sue.miller @ for the data subject Jack Russel Brown.

If there are reasonable doubts, the identity must be verified. The principle here is that the more sensitive the information to be disclosed, the higher the requirements for identification. In particular, the following can be considered

·       Requesting additional information (birthday, adress etc.)

·       Registration and confirmation via a verified account or

·       Post-/Video-Ident and sending identification documents for particularly sensitive information.

Power of attorney for access requests handled by lawyers

In practice, it is relatively common for requests for information to be made by lawyers. This is permissible. The data controller should then ensure that a power of attorney exists for making the request for information and for receiving the information. If no original power of attorney is submitted, but only a fax or similar, the information can be rejected "immediately" in accordance with Section 174 BGB (see Regional Court Stuttgart judgement of 31.03.2021 - 9 U 34/21). The information period (see below) then only begins with the submission of an original power of attorney.

If the power of attorney does not contain a clear indication that the information may also be provided to the lawyer, in case of doubt the information should not be sent to the lawyer, but directly to the person concerned.

Information to be provided

When requesting information, the first question to be answered is always whether the data subject's personal data is being processed. This must either be confirmed or denied.

If personal data is processed, the content of the information depends on what the data subject requests. Information in accordance with Art. 15 (1) GDPR, handing over copies of data in accordance with Art. 15 (3) GDPR or specially specified information. Data controllers can request/ask data subjects to specify which information is to be provided or to which processing operations the request relates. This can help to ensure that information is provided quickly and in accordance with the wishes of the data subject. However, it does not mean that data subjects are entitled to less information than originally requested.

If information is requested in accordance with Art. 15 (1) GDPR, information must be provided in accordance with the catalogue of Art. 15 (1) GDPR on

·       purposes of the processing,

·       categories of personal data being processed,

·       recipients or categories of recipients of the personal data (in doubt, at the choice of the data subjects)

·       planned retention or the criteria for determining retention

·       data subject rights and the right to lodge a complaint with a supervisory authority

·       the origin of the data,

·       the existence of automated decision-making, including profiling.

If copies of data are requested in accordance with Art. 15 (3) GDPR, copies of the data must be provided. If the request relates to documents, a copy of the document itself must also be provided in accordance with ECJ case law, insofar as this is necessary for the control of data processing.

If less than the content of Art. 15 (1) GDPR or Art. 15 (3) GDPR is requested, correspondingly less information must be provided.

Timeline and form of the information

Pursuant to Art. 12 (3) GDPR, the time limit for providing information is one month from receipt of the request for information. The deadline can be extended to up to three months in the event of particular complexity or a high number of requests. In practice, it is advisable to send a confirmation of receipt immediately after receiving a request and to announce that you will get back to us within one month in order to manage expectations and avoid complaints to data protection authorities. Of course, this is especially true if data subjects themselves set shorter deadlines.

It is important to choose a secure channel for the transmission of the information so that the content of the information is protected. The more sensitive the content, the higher the requirements. In the frequent case of transmission by email, appropriate encryption should be provided in case of doubt.

Depending on the type of communication with the data subject, the information must be provided in writing, electronically or verbally. In case of doubt, the channel chosen by the data subject or the channel that is recognisably desired should be used. As a rule, copies of data must be provided in a commonly used electronic format.

Is it possible to reject access requests?

There are cases in which access may be rejected or made subject to paying a fee. These are

·       obviously unfounded requests and

·       excessive requests.

These exceptions are rare and are applied very cautiously in case law. It is therefore a very blunt sword to defend yourself against requests for information.

What happens if you do not provide information?

Unanswered requests for information are the breaking point of any data protection organisation and should be avoided. Especially if there is already a conflict with data subjects, unanswered requests for information often end up with the data protection authorities. You should then have a good justification - or excuse - ready, otherwise you could face fines of up to EUR 20 million or 4% of the company's turnover. Those affected can also claim material and immaterial damages. The first judgements have been handed down in which claims for damages for late information have been awarded, e.g. EUR 10,000 by the Oldenburg Labour Court in its judgement of 9 February 2023 - Ref. 3 Ca 150/21.