As a demonstration of our commitment to the consistent application and enforcement of data protection in the EU institutions (EUIs) and the EU as a whole, the EDPS participates in the European Data Protection Board's (EDPB) coordinated enforcement action on the right to erasure of personal data.
This is the fourth coordinated enforcement action in which the EDPS has participated, together with 31 data protection authorities of the European Economic Area, since the launch of the initiative, under the coordinated enforcement framework, in 2022. Priority topics included the role of data protection officers, the use of cloud services in the public sector and the right to access personal data in EU institutions, bodies, offices and agencies (EUIs) and across the EU.
Wojciech Wiewiórowski, EDPS: " Through our involvement in this coordinated enforcement action, we are continuously advocating for the coherent application of EU data protection law and the consistent protection of individuals' personal data across the EU/EEA. The right to erasure enables individuals to reclaim their identity in the digital world. It is a complex right to verify, which is why it is our job to ensure that it is correctly understood and applied within EUIs."
The right to erasure - or the right to be forgotten - is enshrined in Article 19 of Regulation (EU) 2018/1725 (EUDPR), the EU data protection law for EUIs, and in Article 17 of the General Data Protection Regulation (GDPR) for EU/EEA countries, which have similarities. This right allows individuals to maintain control over their personal data by requesting deletion from EUIs or EU/EEA public or private entities that process it. It is the most common right that individuals establish.
Importantly, the right to erasure (or the right to be forgotten) is not an absolute right; exceptions exist under the EUDPR and the AVG, such as, in the case of compliance with legal proceedings, for the public interest. Therefore, any request for erasure of natural persons must be analyzed on a case-by-case basis by data controllers who decide on the processing of personal data of natural persons based on justified and legal justification. The right to be forgotten thus challenges the delicate balance between the right to data protection and the collective memory of society.
To carry out this coordinated enforcement action, the EDPS will conduct a survey, including a questionnaire for EUI controllers, based on the analysis of complaints from individuals about the right to erasure, to assess how they apply the legal obligations of this right. As a follow-up, the EDPS will summarize its findings, draw conclusions on the best and worst practices identified, and identify areas for improvement.
The results of this joint action will also be analyzed in a coordinated way with the other EU/EEA data protection authorities to decide on further monitoring and enforcement measures, if necessary. Once the coordinated enforcement action is completed, the EDPB will publish a report on the results of this analysis.
Download here the document.
