3 ms·

It is enough that one requests it if the data system is not prepared for that.

elliekelly 6y ago
Did this anecdotal conversation actually happen? I'm highly skeptical for several reasons. The first being that GDPR's "right to be forgotten"[1] absolutely, unequivocally, without a shadow of doubt would not apply to a patient in a medical trial. Even if the patient withdrew consent for data processing and objected to the continued processing of their data under GDPR they still would not have the right to have the data deleted for several reasons: 1. The data isn't being processed on the data subject's consent alone. It's also being processed because it's necessary to perform a public task which is a legal basis for processing data under GDPR. It's also probably being processed under the "legitimate interests" of a third party (the pharmaceutical company) whose interests in the data, in this case, override the individual's interests in having the data deleted which is another legal basis for processing. So the medical trial has two (of only six) lawful bases for data processing should the patient withdraw consent. Only one lawful basis is necessary. 2. Article 17(3) specifically exempts compliance with the right to be forgotten when data processing is necessary "for reasons of public interest in the area of public health" (paragraph c) OR for record-keeping purposes "in the public interest, scientific or historical research purposes or statistical purposes" (paragraph d). 3. Article 17(1)c and Article 21(1) would allow continued processing of the data due to "compelling legitimate grounds for the processing which override the interests". 4. Article 21(6) would allow continued processing of the data for reasons of public interest. Surely someone in the EU conducting medical research would be well aware that GDPR is not at all a barrier to medical trial data processing. [1]https://gdpr.eu/article-17-right-to-be-forgotten/ https://gdpr.eu/article-17-right-to-be-forgotten/

Did this anecdotal conversation actually happen? I'm highly skeptical for several reasons. The first being that GDPR's "right to be forgotten"[1] absolutely, unequivocally, without a shadow of doubt would not apply to a patient in a medical trial. Even if the patient withdrew consent for data processing and objected to the continued processing of their data under GDPR they still would not have the right to have the data deleted for several reasons: 1. The data isn't being processed on the data subject's consent alone. It's also being processed because it's necessary to perform a public task which is a legal basis for processing data under GDPR. It's also probably being processed under the "legitimate interests" of a third party (the pharmaceutical company) whose interests in the data, in this case, override the individual's interests in having the data deleted which is another legal basis for processing. So the medical trial has two (of only six) lawful bases for data processing should the patient withdraw consent. Only one lawful basis is necessary. 2. Article 17(3) specifically exempts compliance with the right to be forgotten when data processing is necessary "for reasons of public interest in the area of public health" (paragraph c) OR for record-keeping purposes "in the public interest, scientific or historical research purposes or statistical purposes" (paragraph d). 3. Article 17(1)c and Article 21(1) would allow continued processing of the data due to "compelling legitimate grounds for the processing which override the interests". 4. Article 21(6) would allow continued processing of the data for reasons of public interest. Surely someone in the EU conducting medical research would be well aware that GDPR is not at all a barrier to medical trial data processing. [1]https://gdpr.eu/article-17-right-to-be-forgotten/ https://gdpr.eu/article-17-right-to-be-forgotten/