PDPF practice question 17 of 25

A person buys a product at a store located in the European Economic Area (EEA). At the time of purchase, you are asked to fill out a registration…

A person buys a product at a store located in the European Economic Area (EEA). At the time of purchase, you are asked to fill out a registration form and he informs his personal email. As is usual in many stores, in the next few days this person will start receiving several marketing emails. He considers the frequency of these emails to be very high. Demanding his rights, he asks the store to delete all his personal data. What the store must do according to the General Data Protection Regulation (GDPR)?

Answer options

A: The owner does not have this right, since he bought a product in the store, he has the right to send emails with new promotions.

B: The store has 30 days from the date of receipt of the customer’s request to delete all data at no cost to the customer.

C: The store must delete customer data from its advertising list. Purchase data cannot be deleted, as financial data has to be kept longer. Correct answer

Correct Answer:

C. The store must delete customer data from its advertising list. Purchase data cannot be deleted, as financial data has to be kept longer.

Explanation

The General Data Protection Regulation (GDPR) grants data subjects the right to erasure (Article 17), but this right is not absolute. The request requires the store (data controller) to erase personal data used for direct marketing, as the legal basis for this processing (likely consent or legitimate interest) is no longer valid upon the customer's request (Article 21(2)). However, the store must also comply with other legal obligations, such as retaining financial and transactional data for specific periods for tax, accounting, or auditing purposes. This is a recognized exception to the right to erasure under Article 17(3)(b) of the GDPR. Therefore, the store must remove the customer from marketing lists but retain the necessary purchase records.

Why Incorrect

A. This is incorrect because purchasing a product does not grant the controller an indefinite right to send marketing materials. The data subject has an absolute right to object to direct marketing at any time.
B. This is incorrect because it states all data must be deleted. The right to erasure has exceptions, including the need to comply with legal obligations which require the retention of financial data.

References

1. Regulation (EU) 2016/679 (General Data Protection Regulation):

Article 17(1)(c): A data subject has the right to erasure if they object to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds, or they object to the processing pursuant to Article 21(2).

Article 21(2) & (3): "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time... Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes."

Article 17(3)(b): The right to erasure shall not apply to the extent that processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject..."

2. European Union Agency for Fundamental Rights (FRA) and Council of Europe, Handbook on European data protection law, 2018 edition.

Page 158, Section 5.2.5: "The right to erasure is not an absolute right... For example, a bank cannot be asked to erase all data of a former client, as it has a legal obligation to store data for a certain period of time. The same applies to data needed for establishing, exercising or defending legal claims." This principle directly applies to the store's legal obligation to retain purchase data.

3. KU Leuven Centre for IT & IP Law (CiTiP), The Cambridge Handbook of Consumer Privacy, 2018.

In discussions surrounding the right to be forgotten, legal scholars consistently emphasize the balance between the data subject's right and the controller's other obligations. The handbook notes that "the right to erasure is limited by a number of important exceptions, including where the processing is necessary for compliance with a legal obligation" (paraphrased from general principles discussed in chapters on GDPR rights). This supports the notion that financial records are exempt from erasure requests due to legal retention requirements.

Keep practicing

Take the free PDPF practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test