gdpr
Does The &quot;Right To Be Forgotten&quot; Include Sent Emails?
<p>Say that you maintain an email service, and person A, sends an email to person B  who is also on your email service. If person A deletes their account would that mean that person B no longer can view the email sent by person A?</p>
<p>It being an email means that the information of who the message was meant to will always be part of the email's metadata. From a naive understand of GDPR, it looks like the only recourse would be delete the email from person B's inbox, but that doesn't sound right either.</p>
<p>From the perspective of person B, the email in their inbox, is an email &quot;they own&quot;, it's addressed to them so their personal information is on it too.</p>
<p>What exactly are you supposed to do in this situation?</p>

<blockquote>
<p>If person A deletes their account would that mean that person B no longer can view the email sent by person A?</p>
</blockquote>
<p>No. Person B's inbox implies <em>overriding legitimate grounds</em> that limit person A's &quot;right to be forgotten&quot;. See article 17.1.(c) of the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="noreferrer">GDPR</a>.</p>
<p>Furthermore, item 2 of article 17 is not applicable because the email service did not make A's personal data public. The email service merely sent to B the record with which A unequivocally addressed B. This means that the email service does not even need to notify B regarding A's request for erasure. All the email service needs to do is remove A's account pursuant to A's request.</p>

<p>The right to erasure / right to be forgotten only exists under fairly narrow conditions, which may or may not require erasure in this scenario.</p>
<p>As a general principle, when two individual's personal data is involved, we need to carefully balance both people's rights. With some GDPR rights such as the right to access, the right “shall not adversely affect the rights and freedoms of others”. For example, if person A makes a data subject access request, it would adversely effect person B's privacy rights if person B's emails were searched.</p>
<p>However, the right to erasure does not explicitly have such a constraint.
Instead, the Art 17 right to erasure contains six cases under any of which erasure may be requested, and five grounds on which erasure can be denied.</p>
<p>Let's look at potential grounds for requesting erasure.</p>
<ul>
<li><p>(a) the data is no longer necessary. This <strong>does not apply</strong>, as storing the emails is still necessary in B's inbox.</p>
</li>
<li><p>(b) processing was based on consent and A has withdrawn consent. This <strong>does not apply</strong>.</p>
</li>
<li><p>(c) processing was based on legitimate interest, A has objected, and there are no overriding legitimate grounds. Likely, this <strong>does not apply</strong>: B has an overriding legitimate interest in keeping their emails.</p>
</li>
<li><p>(d) the processing was illegal. This <strong>does not apply</strong>.</p>
</li>
<li><p>(e) there's an applicable legal obligation to delete the email in EU or member state law. This <strong>might apply</strong>, but A would have to point out the specific law.</p>
</li>
<li><p>(f) the personal data was collected in relation to the offer of an information society service under Art 8. This <strong>might apply</strong>, but only if A was a child at the time (between 13–16 years old, depending on member state).</p>
</li>
</ul>
<p>Even if there are grounds to request erasure, one of the grounds to refuse the request could apply:</p>
<ul>
<li><p>(a) for exercising the right of freedom of expression and information. For example, person A cannot use their right to erasure to suppress journalistic work (but freedom of expression and information is much broader than just journalism).</p>
</li>
<li><p>(b) for compliance with another legal obligation, or for a task carried out in the public interest. For example, person A cannot use their right to erasure to force B to delete financial records that B is legally required to maintain.</p>
</li>
<li><p>(c) for reasons of public interests in the area of public health. Probably won't apply here, but it's important to note that GDPR generally prioritizes health and life over data protection.</p>
</li>
<li><p>(d) for archiving, scientific, research, or statistical purposes. Likely doesn't apply here.</p>
</li>
<li><p>(e) for the establishment, exercise, or defence of legal claims. For example, A cannot use their right to erasure to delete evidence that B needs in order to sue A, or to defend against a claim by A.</p>
</li>
</ul>
<p>Many of these exceptions are extremely context-dependent, and cannot be resolved without taking into account the individual circumstances of person B.</p>
<p>It may also be worth noting that B – and not the email service provider – might be the data controller for the emails in B's inbox. Then, the right to erasure should be exercised against B, not against the service provider.</p>
