UK GDPR — Article 17 Erasure Request and Unlawful Obstruction by Paywall

Shopify Discussion
1

image
image1920×1069 65.8 KB

  1. I require, pursuant to Article 17 UK GDPR, the erasure of all personal data relating to me and the cessation of any further processing, save to the extent strictly necessary to comply with a clear legal obligation. This request covers all systems, live and legacy, backups, archives and data held by your processors and other third parties to whom you have disclosed my data.

  2. Your indication that erasure is contingent upon payment is untenable. Article 12(5) provides that actions on data-subject rights are free of charge, save where a request is manifestly unfounded or excessive, which this routine erasure request is not. Moreover, Article 12(2) imposes a duty to facilitate the exercise of my rights; erecting a paywall is the antithesis of facilitation.

  3. You must respond without undue delay and in any event within one month of receipt (Article 12(3)). If you contend that an extension is necessary (which is not apparent), you must notify me within that first month and explain the reasons.

  4. Please provide a clear confirmation of the following, itemised and referenced to specific systems and processors:
    a) Erasure completed across all environments, with the date and method;
    b) Notification to recipients under Article 19, including the identity of each processor/third party instructed to erase;
    c) Any data you say you must retain, the precise legal basis and retention period for each category;
    d) The treatment of backups and disaster-recovery images (whether hard-deleted or rendered beyond use by timely, documented suppression until overwrite), together with the timetable for final eradication;
    e) A description, at system level, of the searches conducted to locate all personal data in your control.

  5. Should you assert that this request is manifestly unfounded or excessive, you are put on notice that you will need to particularise and evidence that assertion. Absent such particulars, any attempt to levy a fee, or to condition erasure on a subscription or payment, will be treated as an unlawful obstruction.

  6. Failing full compliance, I will lodge a complaint with the Information Commissioner’s Office under Article 77, and I reserve my right to an effective judicial remedy under Article 79. I also reserve my right to seek compensation under Article 82 UK GDPR and section 168 of the Data Protection Act 2018 for non-material damage arising from your obstruction and any continued unlawful processing.

  7. Treat this letter as a document preservation notice. You should preserve all records and correspondence relevant to my request, including internal notes and communications with processors, pending resolution.

Please acknowledge receipt forthwith and confirm the steps you will take. Unless I hear from you sooner, I expect substantive completion within one month of today’s date.

Yours faithfully,

ukparis

1 Like