Art. 19 GDPR regulates the notification obligation after the deletion of personal data if this deletion takes place at the request of the data subject:
Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing:
“1The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. 2The controller shall inform the data subject about those recipients if the data subject requests it.”
The addressees of the communication are the “recipients” of the data, i.e. both independent data controllers and processors who have received the data; “disclosure” is any form of data transmission (Art. 4 No. 9 and No. 2 GDPR).
The deletion of the data due to (a) achievement of the purpose, (b) revocation of consent, (c) objection by the data subject, (d) otherwise lacking or omitted legal basis must be notified if this deletion took place due to a request of the data subject according to Art. 17 para. 1. GDPR.
According to sentence 2, the data subject must also be informed about the recipients when he or she requests it. However, there is no requirement for the obligation to notify the recipients themselves; this must be “automatic”!
The purpose of the notification obligation is to guarantee the right to be forgotten (EC 66 sentence 2). What the recipient of the communication then does with this information, however, is his business.
As a result, the notification obligation under Art. 19 has the following specific requirements:
- The controller holds personal data relating to the data subject and has also passed this data on to third parties.
- The data subject asserts a claim for deletion against the data controller.
- The data subject has deleted the data.
- The communication to the recipients is not impossible or disproportionately time-consuming.
Do you have any questions regarding the notification obligation under Art. 19 GDPR? Please feel free to contact us at any time – we look forward to hearing from you.