Outside of image recordings, consent can usually be withdrawn at any time without any problems. The withdrawal of consent does not affect the lawfulness of data processing based on consent given prior to the withdrawal. The withdrawal of consent is therefore ‘only’ effective for the future. However, if data processing can no longer take place because the necessary consent no longer exists, the question arises as to what should be done with the personal data on the basis of which this data processing was carried out. According to Art. 17 (1) (b) GDPR, the data must be erased if the data subject withdraws consent and no other legal basis for continued data processing can be found. Since the latter is likely to be the norm, the data subject’s data must be erased after consent has been withdrawn. No additional erasure request is required for this.
Another aspect that is often overlooked is the obligation to inform all recipients of the data in the event of erasure in accordance with Article 19 of the GDPR.