Know your rights. The right to erasure / to be forgotten. Reduce your digital footprint

If you've ever stopped using an app, an online service, or an account, take a moment before hitting delete on your device. Before, ask them to remove the data they have about you from their system. It's the easiest and most effective way to reduce your digital footprint and protect yourself against future breaches.

Knowing your rights empowers you to take control of your digital presence. Read on how to exercise your right to have your data deleted.

What it is

The right to deletion/ erasure (article 17 – GDPR) is commonly known as "the right to be forgotten." And it empowers you to ask companies, organizations, and businesses to delete your data from their systems.

Note that "The right to be forgotten"/ deletion/ erasure is not the right to delisting. The right to delisting applies specifically to your data that can be found via search engines. For instance, when you request Google to delete specific search results associated with your name, you are exercising your right to delist. They will stop your data from appearing in search results but will not delete it from those holding it.

Your right to erasure is broader, encompassing all controllers processing your data, not limited to search engines, and we encourage you to exercise it.

You can request your data to be erased if:

• The storage or use of your data is no longer necessary for the original collection purposes. For example, your subscription at the gym expired months ago, and you paid your membership fees on time and have no intention to use their services anymore.
• You have withdrawn your consent.
• You object to the processing of your data to direct marketing
• The controller is processing your data illegally (for example, without your consent)
• The personal data of a child under 16 is used for a paid service without parental/guardian consent.
• Data has to be removed for legal reasons. For example, you ask a bank to delete data about your debts after several years.

Exceptions to data deletion

Organizations will not delete your data if your information:

• Has been processed to comply with the law. For example, taxpayers cannot request their data be deleted from the tax system.
• Is used for public health reasons (a hospital retains it to prevent virus contamination).
• Is necessary for archive, research, historical, scientific, or statistical purposes.
• Is needed for a national security issue, freedom of expression, or information (e.g., a newspaper publishing online investigations).

Example story

After years with his internet provider, Jim decides to switch to a new one offering better services. He asks the former company to delete his data -  online account, credit card numbers, ID numbers, and other personal information since he will no longer use their services. They search and delete all the data and respond to him with confirmation that they fulfilled his request.

How to exercise your right to deletion

Here are three simple steps to exercise your right to be forgotten.

Step 1 – Identity and contact your data holders

When you stop using an app, service, or online account and wish to delete the data they've gathered about you, look for an email to contact them. You'll likely find it in the "privacy policy" and "contact us" sections of their website.

If you want to go for a deep clean of your digital data waste and are wondering if you remember all the services you've been signing up for, use Bitdefender Digital Identity Protection. It's a tool that scans and identifies all accounts associated with you you may have opened with a Gmail or Outlook email address.

Step 2 – Draft your deletion request

In your request:

• Clearly state that you are requesting the deletion of your data and ask for confirmation from the organization that they have done it.

• Specify your name and mention details like your phone number, username, account name, or IP address so they can quickly find you in the system.

• If your data has been shared, insist that recipients be informed and delete the data from their systems.

• Mention the reason(s) why they are obliged to delete your data and refer to Article 17 of the GDPR if in UE.

Step 3 - If you prefer, Digital Identity Protection can send the erasure requests on your behalf. You can find these pre-written emails as one of the actions you can take for each company that has your data and see how your footprint becomes smaller.

What to expect

After you send your request, the controller has one month to respond and confirm that they've deleted your data. This period can be extended once in more complex situations, but only for up to two additional months.

The controller might respond by stating they've chosen not to delete some or all of the data you asked to be erased. If they do, they must clarify why and show how one of the exceptions we talked about earlier applies to your case. They can't just refuse without a valid reason, and they can't give you a generic, one-size-fits-all response.

If you're not satisfied with their answer, you have the option to file a complaint with a data protection authority in your country.

The US. The right to delete or be forgotten depends on specific laws. For instance, under federal laws like COPPA, parents have the right to check and delete their children's information, and sometimes data may be deleted even without a specific request. Some state laws, like CCPA, grant residents the right to request deletion, though there are some exceptions.

Recent state privacy laws, such as CPRA, Virginia CDPA, Colorado Privacy Act, Utah Consumer Privacy Act, and Connecticut Privacy Act, empower consumers to request the deletion of their personal information.

Sources: European Commission, noyb.eu, Data Protection Laws and Regulations USA 2023