Where a data subject provides consent to different controllers for the processing of the same personal data, it is sufficient for such data subject to notify just one of the controllers of the withdrawal of such consent and request for data erasure. It is then up to such notified controller to take the necessary steps to inform the other controllers of the notification made by the data subject, the Court of Justice of the European Union (CJEU) has recently affirmed. The EU’s General Data Protection Regulation (GDPR) regulates how personal data is collected, processed and erased. It endows individuals with the right to exercise control over the processing of their personal data. This includes the right of a data subject to request to have personal data provided to a third party for any purpose erased without undue delay. Though the right to be forgotten is not an absolute one; the GDPR outlines a number of instances when an individual may exercise such right, such as when the personal data is no longer required by the third party who is in possession of such data for the purpose for which it was originally collected or processed. Similarly, in those cases where the processing of...
↧