united-kingdom privacy data-storage
(UK) Data Protection Act - Deleting offline data
<p>I have a question regarding the Data Protection Act and the deletion of users private information. If a website was running a weekly backup of users private data (name, date of birth, address etc.) and then these backups were being placed in an offline server where they were archived, what system would there have to be in place regarding the deletion of users private data?</p>

<p>If for example, a user wanted to delete their user account on this website, would the deletion on the online server be enough, or would a technician have to go through all of these backups to delete their data from those too? </p>

<p>Although it would be nice for that organisation to delete the data altogether, the Information Commissioner's Office (ICO) seem happy that it is simply <a href="https://ico.org.uk/media/for-organisations/documents/1475/deleting_personal_data.pdf" rel="nofollow noreferrer">removed from "live" use</a>.</p>

<blockquote>
  <p>The ICO will be satisfied that information has been ‘put beyond use’, if not actually deleted, provided that the data controller holding it:</p>
  
  <ul>
  <li>is not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;</li>
  <li>does not give any other organisation access to the personal data;</li>
  <li>surrounds the personal data with appropriate technical and organisational security; and</li>
  <li>commits to permanent deletion of the information if, or when, this becomes possible.</li>
  </ul>
</blockquote>

<p>The last sentence being key: the data should be deleted when this becomes possible. It's not clearly how "archives of archives" might remove the data, however, but I would suggest that the organisation is required to make sure it does. Creating another or deeper archive is duplicating data that you have already asked to be removed.</p>
