&quot;Destiny&quot; of issued certificates after account deletion Lets say I have a online-training platform where I issue &quot;completion certificates&quot; to users who complete the course (like Udemy, Coursera, etc.). One day a user wants to delete their account. According to GDPR rules I delete all their records in my databases. But... What happens with &quot;completion certificate&quot;. Should I delete it as well? It contains user's full-name. What if the same user wants to show the certificate to potential employer and they want to verify via my platform? What is the common practice for such circumstances? I checked GDPR and Certification Check. They asked about similar case but not exactly what I am asking.
The pragmatic answer is to just ask the data subject what they would like to have erased. The GDPR's right to erasure DOES NOT requires that you “delete all their records in [your] database”. Compared to other GDPR rights, it has a quite limited scope. It is necessary that one ground for erasure in Art 17(1) applies, and none of the exceptions in Art 17(3) apply. For example, you are allowed to retain any data that you need to fulfill a legal obligation (exception in Art 17(3)(b)), such as an obligation to keep financial records for a number of years. In the case of providing course completion certificates, I would assume that your legal basis for providing this service is a contract with the data subject. Contracts directly with the data subject can serve as a legal basis for processing per Art 6(1)(b). It doesn't matter if the contract was paid (consideration is not a necessary element of a contract in civil law systems). As long as this contract is in force, there are no Art 17(1) grounds for erasure. But if the contract is terminated, Art 17(1)(a) would apply: “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed”. So the data subject could release you from your contractual obligation to provide the certificate verification service, and then require you to delete any personal data in connection with that service. In the unlikely case that you are using a different legal basis for hosting the certificate service: legal basis applicable? grounds for deletion Art 6(1)(a) consent maybe Art 17(1)(b): consent can always be withdrawn Art 6(1)(b) contract yes (see discussion) when the contract is terminated Art 6(1)(c) legal obligation unlikely per legal requirements Art 6(1)(d) vital interests no Art 6(1)(e) public interest unlikely per legal requirements Art 6(1)(f) legitimate interest maybe Art 17(1)(c): objection to further processing per Art 21(2) For all of these legal bases, it is the case that once the legal basis expires, then Art 17(1)(a) provides grounds for erasure. In fact, proactive erasure (without waiting for a data subject request) may be required in line with the Art 5(1)(b) purpose limitation and Art 5(1)(e) storage limitation principles. To quickly summarize all Art 17(1) grounds for deletion: Art 17(1)(a): data is no longer necessary Art 17(1)(b): consent withdrawn (only if Art 6(1)(a) consent was used as legal basis) Art 17(1)(c): objection to further processing (only if Art 6(1)(f) legitimate interest was used as legal basis) Art 17(1)(d): unlawful processing always merits erasure Art 17(1)(e): erasure is required by law Art 17(1)(f): special right to erasure for children Note that it is, in principle, possible to provide certificates without storing personal data. This could make it unnecessary to think about data subject rights like erasure. For example, you could provide a certificate to users. The certificate contains personal data, and you do not store a copy of the certificate. But you could use cryptographic signatures to prevent forgery of the certificate. The signature can be verified without having to store personal data. If you are familiar with web development, the same technique is used for JWT tokens: the data in the token is signed by a secret key so that it can be verified whether a token (and the data in the token) was created validly, without having to store a copy of the data in the token. Limitations of this approach are well-known, such as making it difficult or impossible to revoke certificates. In practice, such data-minimization techniques are overkill. The GDPR only requires appropriate security measures. If you have a legal basis (such as a contractual obligation with the data subject) then it is perfectly fine to store a certificate with personal data in your service. The GDPR obligations stemming from such a processing activity are not particularly onerous.
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion. If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though. In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
This will depend partly on what you use the e-commerce website for. If it is simply a point-of-sales and your accounting records are kept elsewhere, then it may be possible to delete their account including associated orders and payments, though you should check that the software doesn't simply update the record by setting the value for a column named deleted or del for short to 1 instead of 0 to identify deleted records, but instead actually deletes the record from the database. You should consider how you will refund a customer if required after doing so!! (i.e. perhaps you acknowledge the request but keep the information for at least as long as the customer is eligible for a refund, and then delete it). If the system is also used for accounting records, then if a customer/user wishes to assert their right to be forgotten, it is likely you'll need to disable the account and apply some kind of pseudonymisation (essentially replacing personal identifiers such as name, email address, date-of-birth, with dummy/null data), in order to preserve the integrity of your financial records. For example, in the UK, there is a statutory obligation on companies to retain financial records for at 7 years. In cases where data cannot be immediately erased due to other legitimate reasons for which it must be kept, once those retention periods expire the data must be erased. You'll need to keep a record of anyone that requests to be forgotten, and remember to follow-up to complete erasure at the appropriate dates if it can't be done immediately, and when the data is destroyed the user needs to be informed.
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.