The account they refuse to erase: the written walkthrough

Myth · I click “Deactivate”: the profile disappears, so the data must go with it.

The best established myth in the settings menu: “deactivating is deleting” The sentence in pale grey under the button was telling the truth: deactivation hides the profile, it retains the content. The Regulation, for its part, knows nothing about deactivation. It knows one verb, erase, and it turns it into an obligation resting on the controller. A hidden profile is still a profile whose data are retained.

“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies”

In plain words: the text says “erase”, not “hide”. As long as the data are retained the obligation is not met, whatever state your profile is shown in.

Myth · Erasure is something you get with a serious reason. I have nothing dramatic to point to.

The myth: “you need a good reason” The official EU page sums the condition up in one line, and it asks for no drama at all: data that are no longer needed is enough. The Regulation says the same thing and names a second ground that is just as ordinary, the withdrawal of the consent the processing was based on. What is expected of you is not a justification: it is naming the ground you rely on.

“If your personal data is no longer needed or is being used unlawfully then you can ask for your data to be erased. This is known as "the right to be forgotten".”

In plain words: “no longer needed” is a ground in its own right. You do not have to tell your life story to obtain an erasure.

Myth · I pay the 15 €: that is the price of a quiet life.

The myth: “an erasure has to be paid for” The first sentence of the paragraph leaves no room: it shall be provided free of charge. The text does allow an exception, and it is narrow: requests that are manifestly unfounded or excessive, in particular because of their repetitive character. Then it adds the sentence that turns the table over: the controller shall BEAR THE BURDEN of demonstrating that character. So it is not for you to prove your request is legitimate.

“5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.”

In plain words: the request costs nothing. They may charge or refuse in one case only, and it is for them to establish that you are in it.

Myth · The Regulation sets no precise deadline: they will answer when they can.

The myth: “the Regulation gives no deadline” It gives one, and it gives it for EVERY request in the series, from access to objection: one month from receipt. The phrase “without undue delay” does not replace that month, it adds to it. What makes the deadline usable is that it runs from a date you know: the date of their acknowledgement.

“The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.”

In plain words: the deadline exists, it is one month, and it runs from their receipt, not from their goodwill.

Myth · Their silence amounts to a refusal, and a refusal is not up for discussion.

The myth: “no reply, so the file is closed” The Regulation treats inaction for what it is, and fences it in three times over. If they do not act, they must inform you of the REASONS for not taking action, at the latest within one month, AND point you to two doors: lodging a complaint with a supervisory authority and seeking a judicial remedy. A silence gives no reasons, keeps to no deadline and points to no door: it meets none of the three.

“4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.”

In plain words: a refusal has to be reasoned, and it has to tell you itself where to go next. The text hands you the next step inside the sentence that turns you down.

Myth · Once the data has gone to third parties it is lost: nobody can pull it back.

The myth: “gone to a third party, so out of reach” The official EU page says the opposite in one sentence, and it names the other websites the data was shared with: informing them is the company's job. The same page notes in passing that these rules also apply to search engines, which are likewise regarded as data controllers. Sharing does not create a zone outside the law: it creates a list of people to be told.

“These rules also apply to search engines […] as they're also considered to be data controllers. […] If a company has made your personal data available online and you ask for them to be deleted, the company also has to inform any other websites where they've been shared that you've asked for your data and links to them to be deleted.”

In plain words: informing the other websites is the company's job, not yours to track them down one by one.

Myth · Erasure erases everything, no exceptions. Their 10 years of billing data go too.

The myth: “the right to be forgotten erases everything” The article that creates the right sets its own limits, in its third paragraph, and it names them: exercising the right of freedom of expression and information, compliance with a legal obligation which requires processing, the establishment or defence of legal claims. What your country requires to be kept does not fall under the same regime as your profile, and this site never covers national law. Knowing the limit of a right is what makes the rest of the request credible.

“3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject […] (e) for the establishment, exercise or defence of legal claims.”

In plain words: erasure stops where another rule requires keeping. Ask for the erasure of what can be erased, and the file stands up.

Myth · They write that my request is excessive. So it is up to me to prove otherwise.

The myth: “it is written in their letter, so it is established” The paragraph that allows a refusal ends with a sentence refusals never quote: the controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. Writing the word “excessive” is not demonstrating it. And the text says “manifestly”: it is for them to establish that you are there, request by request.

“Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee […] or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.”

In plain words: the proof is on their side, not yours. You do not have to justify having followed up.

Myth · A written refusal can only be fought in court, and I am not going to court.

The myth: “after their refusal there is only the courtroom” The official EU page puts the two routes side by side. It presents a complaint to the national data protection authority as a DIRECT route, with an investigation and a response within three months, and it writes that the court stays open without any obligation to go through that authority first. In other words: two doors, and you are required to take neither of them first. The same page adds that material or non-material damage may entitle you to compensation.

“If you think your data protection rights have not been respected, you can make a complaint directly to your national data protection authority which will investigate your complaint and give you a response within 3 months. […] to file a case directly in court against the company or organisation concerned instead of first going to your national data protection authority. You may be entitled to compensation if you suffer material damage, such as financial loss, or non-material damage, such as psychological distress, due to a company or organisation not respecting EU data protection rules.”

In plain words: you have two doors and you pick one. The authority of your country answers within three months; the court stays open with or without it.