EDPB launches investigation into ‘right to be forgotten’

The European Data Protection Board (EDPB) has initiated an investigation into the right to erasure, also known as ‘the right to be forgotten’.

Article 17 of the General Data Protection Regulation (GDPR) is the foundation of the right to erasure.

It states that data subjects from the European Union have the right to have their personal information erased from the controller that has collected this data ‘without undue delay’. The controller is obligated to comply with the request and has to take ‘reasonable steps’ to do so.

According to the EDPB, which acts as an independent body to ensure the GDPR is interpreted consistently by all data protection authorities (DPAs) in the EU, ‘the right to be forgotten’ is one of the most exercised GDPR rights, and at the same time the right of which the DPAs receive the most complaints about.

32 DPAs across Europe will take part in a so-called Coordinated Enforcement Framework (CEF). All participating privacy regulators will contact a number of controllers from different sectors across Europe, either by opening new formal investigations, or doing fact-finding missions.

“DPAs will check how controllers handle and respond to the requests for erasure that they receive and, in particular, how they apply the conditions and exceptions for the exercise of this right. DPAs will also stay in close contact to share and discuss their findings throughout this year,” the EDPB states in a press release.

The results of the investigation will be aggregated and analyzed to generate ‘deeper insight’ into the topic, allowing for targeted follow-ups on both national and EU levels.

This isn’t the first CEF action the EDPB has launched. In the past three years, the EDPB has carried out investigations regarding the use of cloud-based services by the public sector, the designation and position of data protection officers (DPOs), and the implementation of the right of access by controllers.