Right to be Forgotten and Data Subject Access Rights

Under the UK GDPR, data subjects have several rights including a right to access their personal data and a right to rectify incorrect personal data that an organisation may hold. Data protection laws provide a helpful tool in also enforcing your legal right to privacy or unwanted intrusion.

If your rights as a data subject have been infringed, you have the right to seek compensation for a data breach claim and to ask the organisation to rectify the situation.

To speak to a solicitor about a right to be forgotten, or engaging any of your other data rights under GDPR, contact JMW today by calling 0345 872 6666, or fill in our online enquiry form to request a call back.

Right of Access

Data subjects have a right to access and receive a copy of personal data that relates to them, which is held by a data controller. This is commonly referred to as making a data subject access request (DSAR or SAR). An organisation must respond to the data subject access request within one month, or risk being in breach of its obligations under data protection law.

Data protection laws do not entitle you to all information that might be held by an organisation but only where that information identifies you and also ‘relates to’ you. If an organisation has not responded to your SAR or you believe that its response is inadequate, you may have a claim for infringement of your legal rights.

Data Breach Claim

Organisations collect a significant amount of information about people and have a duty to use, store and protect this data properly. Data breaches can cause enormous damage and distress to those affected. If you have suffered emotionally or financially due to the mishandling of your personal information, you may be entitled to make a data breach claim.

JMW has vast experience in handling data breach claims, including dealing with the first data breach group litigation claim in the landmark case of Various Claimants v WM Morrison Supermarkets PLC.

Our extensive experience includes cases involving:

• Data sent to the wrong address or person
• Theft, hacking and unauthorised accessing of data
• Failure to anonymise or redact data
• Malicious and deliberate disclosure of data
• Accidental loss of data
• Unauthorised misuse of data

Data breaches can and do cause serious and lasting damage. At JMW, we help our clients to secure substantial compensation for both financial damage and emotional distress, as well as securing other legal remedies. These can also include:

• Apologies
• Statements in court
• Steps to avoid future problems

‘Right to be Forgotten’

The right to be forgotten, otherwise known as the right to erasure, is a key provision of the UK GDPR. When a company or other data controller has collected and is holding personal data about you, you can request that the company delete that data under the ‘right to erasure’ article. You must have valid reasons for doing so, but under most circumstances, the organisation must oblige.

Depending on the type of data you want to erase and the organisation in control of the data, there may be specific processes to follow. If you want to exercise your right to erasure, we can guide you through the options available.

There may be legitimate reasons why a data controller wishes to retain the information, and where they may legally be entitled to do so. For instance:

• The data is being used for a legal obligation or ruling, or for the establishment of a legal defence against other claims
• The data serves the public interest, either for scientific or historical research, or statistical purposes
• The data is needed for public health purposes or is being used by a health professional with a legal obligation

If a request is excessive or unfounded, an organisation can refuse to comply or charge a fee. For this reason, it is important to establish that you have a legally valid reason to exercise your right, and to understand your rights should the organisation fail to comply with a legitimate request.

One of the most common scenarios in which an individual might want to exercise this right is to seek the removal of search engine results. There may be information on the internet about you that you wish was not there, as it is no longer relevant or reflective of your character now. You may be able to use the right to erasure to remove search results responsive to a ‘named based’ search engine. This can go some way to reduce the prominence of old, irrelevant, and adverse material online.

You may be able to pursue legal action against an entity to enforce your right to be erased if a data controller refuses or fails to respond to your request.