Right to erasure policy and procedure

The UK-GDPR does not specify how to make a valid request, however, we have an application form to help facilitate the process. The request for erasure can be made verbally or in writing.

The request can be sent to any part of the council, and staff need to know how to process this and in the first instance forward it to the data protection Inbox. The request itself need not even include the phrase ‘right to erasure’, Article 17, as long as the request to erase personal data is understood as the purpose. If there is any doubt clarification should be sought from the individual.

This presents a challenge as any council employee could receive a valid verbal request. However, we have a legal responsibility to identify that an individual has made a request for erasure and handle it accordingly. Therefore each request must be logged.

Identity

To ensure adequate proof of identity of the applicant, a list of acceptable identification is listed in Appendix A. Once identity has been confirmed, the documentation should be securely disposed of as the purpose for the processing of it has been fulfilled.

We must ensure adequate information has been received from the applicant to facilitate locating the information requested. Preferably the application form detailed on Appendix B will be completed by the applicant, however, internally we can complete this for our convenience.

Fees

In most cases we cannot charge a fee to comply with a request for erasure, unless the request is manifestly unfounded or excessive, in which case a 'reasonable fee' for the administration costs with complying with the request may be made.