> You make it sound as if this is new, but this was also possible under the DPD from the late 90s. GDPR didn't improve that. GDPR did improve it. Under the imp

> You make it sound as if this is new, but this was also possible under the DPD from the late 90s. GDPR didn't improve that. GDPR did improve it. Under the implementation by member states of the DPD many required that you can show "duress and/or distress" from continued processing to request erasure. GDPR made it so you don't have to show anything, you can just request it (or, more technically, you can withdraw consent). And the DPD only said: > as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; Organisations often took a very conservative interpretation of this which wasn't enforced differently by many DPAs in EU states. GDPR Art. 17 is definitely stronger.