{"id":504,"date":"2019-09-04T09:31:55","date_gmt":"2019-09-04T07:31:55","guid":{"rendered":"http:\/\/blog.eprivacy.eu\/?p=504"},"modified":"2020-12-09T09:32:50","modified_gmt":"2020-12-09T08:32:50","slug":"notification-obligation-after-deletion-of-data-at-the-request-of-the-data-subject-in-accordance-with-article-19-gdpr","status":"publish","type":"post","link":"https:\/\/blog.eprivacy.eu\/?p=504","title":{"rendered":"Notification obligation after deletion of data at the request of the data subject in accordance with Article 19 GDPR"},"content":{"rendered":"\n<p>Art. 19 GDPR regulates the notification obligation after the deletion of personal data if this deletion takes place at the request of the data subject:<\/p>\n\n\n\n<p><br><em>Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing:<\/em><br><em><sup>&#8222;1<\/sup>The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with&nbsp;<\/em><em><a href=\"https:\/\/gdpr-info.eu\/art-16-gdpr\/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 16<\/a><\/em><em>,&nbsp;<\/em><em><a href=\"https:\/\/gdpr-info.eu\/art-17-gdpr\/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 17<\/a><\/em><em>(1) and&nbsp;<\/em><em><a href=\"https:\/\/gdpr-info.eu\/art-18-gdpr\/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 18<\/a><\/em><em>&nbsp;to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.&nbsp;<sup>2<\/sup>The controller shall inform the data subject about those recipients if the data subject requests it.&#8220;<\/em><br>&nbsp;<br>The addressees of the communication are the &#8222;recipients&#8220; of the data, i.e. both independent data controllers and processors who have received the data; &#8222;disclosure&#8220; is any form of data transmission (Art. 4 No. 9 and No. 2 GDPR).<br>The deletion of the data due to (a) achievement of the purpose, (b) revocation of consent, (c) objection by the data subject, (d) otherwise lacking or omitted legal basis must be notified&nbsp;<em>if<\/em>&nbsp;this deletion took place due to a request of the data subject according to Art. 17 para. 1. GDPR.<br>According to sentence 2, the data subject must&nbsp;<em>also<\/em>&nbsp;be informed about the recipients&nbsp;<em>when<\/em>&nbsp;he or she requests it. However, there is&nbsp;<em>no<\/em>&nbsp;requirement for the obligation to notify the recipients themselves; this must be &#8222;automatic&#8220;!<br>The purpose of the notification obligation is to guarantee the right to be forgotten (EC 66 sentence 2). What the recipient of the communication then does with this information, however, is his business.<\/p>\n\n\n\n<p>As a result, the notification obligation under Art. 19 has the following specific requirements:<\/p>\n\n\n\n<ol type=\"1\"><li>The controller holds personal data relating to the data subject and has also passed this data on to third parties.<\/li><li>The data subject asserts a claim for deletion against the data controller.<\/li><li>The data subject has deleted the data.<\/li><li>The communication to the recipients is not impossible or disproportionately time-consuming.<\/li><\/ol>\n\n\n\n<p>Do you have any questions regarding the notification obligation under Art. 19 GDPR? Please feel free to&nbsp;<a href=\"https:\/\/www.eprivacy.eu\/en\/contact\/\" target=\"_blank\" rel=\"noreferrer noopener\">contact us at any time<\/a>&nbsp;&#8211; we look forward to hearing from you.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Art. 19 GDPR regulates the notification obligation after the deletion of personal data if this deletion takes place at the request of<\/p>\n<p class=\"link-more\"><a class=\"myButt \" href=\"https:\/\/blog.eprivacy.eu\/?p=504\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/504"}],"collection":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=504"}],"version-history":[{"count":1,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/504\/revisions"}],"predecessor-version":[{"id":505,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/504\/revisions\/505"}],"wp:attachment":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}