GDPR: What is the legal situation on documenting cases of &quot;Right to be forgotten&quot; claims?
<p>I wasnt able to find an explanation inside the GDPR whether a data privacy officer (or similar responsible) is allowed or required to document cases where individuals claimed the right to be forgotten.</p>

<p><strong>Is it against the law to document the individual cases?</strong>
edit for clarification: Such as "on Feb 26th Mr. John Doe inquired via e-Mail and requested to purge all his data". Now there is another data set about John Doe, documenting his deletion request, whereas he initially inquired to have his data erased. Instead of being forgotten, he is now remembered in one extra data collection. /edit</p>

<p>On one hand documenting the process allows a company to prove they obeyed the law and the request, should this be questioned later on by the individual.</p>

<p>I can even imagine a former employee first claiming his right to be forgotten, and then - a week after getting the confirmation - claiming his right to receive a resumee (a right in existense in Germany), which a company would not be able to fulfill as it hasnt got any data to base the resumee on. In case they do not have documentation, that the former employee requested to be forgotten, they cannot tell this.</p>

<p>On the other hand documenting such cases is 180 degree against the original request to be forgotten, as the individual ends up being stored in yet another data processing process.</p>

<p>The "right to be forgotten" is not absolute. It is subject (<a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Art. 17</a>) to certain conditions, in particular the absence of "<em>overriding legitimate grounds for the processing</em>" (1(c)).</p>

<p>3(b) explicitly exempts data controllers from the erasure where needed "<em>for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject</em>".</p>

<blockquote>
  <p>I can even imagine a former employee first claiming his right to be
  forgotten, and then - a week after getting the confirmation - claiming
  his right to receive a resumee (a right in existense in Germany),
  which a company would not be able to fulfill as it hasnt got any data
  to base the resumee on.</p>
</blockquote>

<p>If the "right to receive a resumee" indeed exists in Germany and employers need to comply with it, that would be perfectly legitimate ground to only partially fulfil the request to be forgotten⁠ — forget everything but the resume.</p>

<blockquote>
  <p>Is it against the law to document these cases?</p>
</blockquote>

<p>If you document "<em>On 27 February 2020 John Smith requested to be forgotten so we deleted or anonymised all his records</em>", you will effectively NOT forget him. If you actually had to forget him, it will therefore be against the law to document your forgetting that way.</p>

<blockquote>
  <p>where individuals claimed the right to be forgotten. Is it against the law to document these cases?</p>
</blockquote>

<p>The <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> actually encourages properly documenting these cases, since that relates to the controller's ability to prove compliance with the GDPR.</p>

<p>See, for instance, recitals 74 and 77:</p>

<blockquote>
  <p>In particular, the controller should [...] be able to demonstrate the
  compliance of processing activities with this Regulation</p>
  
  <p>[...]</p>
  
  <p>Guidance [...] on the demonstration of compliance by the controller or
  the processor [...] could be provided in particular by means of
  approved codes of conduct [...] or indications provided by a data
  protection officer.</p>
</blockquote>

<p>The right to erasure requests clearly is within scope of "processing activities" in the GDPR. See recitals 65, 66, 68, art. 4(2) (definition of 'processing'), art. 5.1(d), and elsewhere. Likewise, art. 5.2 provides that "<em>[t]he controller shall be responsible for, and <strong>be able to demonstrate compliance</strong> with, paragraph 1 ('accountability')</em>" (emphasis added).</p>

privacy gdpr european-union