gdpr
Under GDPR, can I request to be forgotten and re-register for a trial?
<p>Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually:</p>

<ul>
<li>register for the trial, use it for a month</li>
<li>request my account deleted and my data forgotten</li>
<li>repeat
?</li>
</ul>

<blockquote>
  <p>Under GDPR, can I request to be forgotten and re-register for a trail?</p>
</blockquote>

<p>No (unless they are stupid.)</p>

<p>The "right to be forgotten" does not mean they <em>have</em> to delete your data. They can keep personal data about if they have "legitimate interests" to keep these data.  Stopping clients from abusing their "free trial" system is a legitimate interest.</p>

<p>Definitely not legal advice and please consult an attorney before making any moves w/r/t GDPR (or anything else, really!). </p>

<p>Under the GDPR, the "<a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">right to erasure</a>" applies in the following circumstances: </p>

<blockquote>
  <p>a) the personal data are no longer necessary in relation to the
  purposes for which they were collected or otherwise processed;</p>
  
  <p>b) the data subject withdraws consent on which the processing is based
  according to point (a) of Article 6(1), or point (a) of Article 9(2),
  and where there is no other legal ground for the processing;</p>
  
  <p>c) the data subject objects to the processing pursuant to Article
  21(1) and there are no overriding legitimate grounds for the
  processing, or the data subject objects to the processing pursuant to
  Article 21(2);</p>
  
  <p>d) the personal data have been unlawfully processed;</p>
  
  <p>e) the personal data have to be erased for compliance with a legal
  obligation in Union or Member State law to which the controller is
  subject;</p>
  
  <p>f)the personal data have been collected in relation to the offer of
  information society services referred to in Article 8(1).</p>
</blockquote>

<p>However, those points do not apply when the processing in question is necessary:</p>

<blockquote>
  <p>a) for exercising the right of freedom of expression and information;</p>
  
  <p>b) for compliance with a legal obligation which requires processing by
  Union or Member State law to which the controller is subject or for
  the performance of a task carried out in the public interest or in the
  exercise of official authority vested in the controller;</p>
  
  <p>c) for reasons of public interest in the area of public health in
  accordance with points (h) and (i) of Article 9(2) as well as Article
  9(3);</p>
  
  <p>d) for archiving purposes in the public interest, scientific or
  historical research purposes or statistical purposes in accordance
  with Article 89(1) in so far as the right referred to in paragraph 1
  is likely to render impossible or seriously impair the achievement of
  the objectives of that processing; or</p>
  
  <p>e) for the establishment, exercise or defence of legal claims.</p>
</blockquote>

<p>If no exceptions apply and one of the above circumstances exists, the </p>

<blockquote>
  <p>data subject shall have the right to obtain from the controller the
  erasure of personal data concerning him or her without undue delay and
  the controller shall have the obligation to erase personal data
  without undue delay</p>
</blockquote>

<p>Therefore, the <a href="https://law.stackexchange.com/a/28871/12269">statement</a> that </p>

<blockquote>
  <p>The "right to be forgotten" does not mean they have to delete your
  data</p>
</blockquote>

<p>is inaccurate. </p>

<p>According to the United Kingdom's <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/" rel="nofollow noreferrer">Information Commissioner's Office</a>, there are two other ways a request to delete information may be denied. It may be denied if the request is</p>

<blockquote>
  <p>manifestly unfounded or excessive, taking into account whether the
  request is repetitive in nature.</p>
</blockquote>

<p>If that is the case, the request may be refused or a "reasonable fee" to deal with the request may be requested. </p>

<p>The bottom line is the company </p>

<ol>
<li><p>could argue that its legitimate interests override your request; or</p></li>
<li><p>could argue that the data is still being used to accomplish the purpose it was originally collected or processed for</p></li>
</ol>

<p>You should be able to determine this when you provide the information, though, <a href="https://www.linkedin.com/pulse/understanding-legitimate-interests-v-consent-paul-adams-llb-hons-/" rel="nofollow noreferrer">because</a> </p>

<blockquote>
  <p>[i]f Controllers use Legitimate Interests as their lawful basis of
  data processing, then they must ensure that the individuals are told
  that they intend to process their data. They must also inform them of
  the Legitimate Interests they have stipulated as the basis of the
  processing, and they are also obliged to inform them of their right to
  object to the processing.</p>
</blockquote>

<p>However, companies are obligated to only collect and process information that is needed to accomplish the ends for which the data is acquired. Thus, you may be able to request that certain parts of your information be deleted. For example, the company may need your name and email address to prevent you from achieving your goal of lifetime freebies; however, perhaps they would not need your home address for those purposes. You'd likely be able to successfully have that part of your data removed nonetheless, because there is also an obligation to get rid of personal information within a reasonable time after which the data is no longer needed. </p>

<p>Alternatively, you may get away with it a time or two, but it is conceivable that after that, assuming they catch on, they would be able to establish that your request for erasure is "manifestly unfounded or excessive, taking into account whether the request is repetitive in nature."</p>

<p>Finally, and this is simply conjecture on my part and I think it would be an interesting scenario, perhaps the company would be required to delete your data, but your attempt to take advantage of their free trial services would <em>create</em> the legitimate interest the company could rely on <em>or</em> perhaps it could create a new purpose for the keeping of that information that had not existed already. </p>

<p>At the end of the day, you're probably not going to get away with the free trial scheme. However, I wanted to make sure you had a full answer and one that considered the various aspects of this issue.</p>

<p>Even if you do have the right to have your data deleted, that doesn’t mean you can get away with your plan. They can keep a hash of the information you provided, which isn’t personal data since it can’t be linked to you, but if you try to open a new account with the same details they can hash it again and see that the hash already exists. </p>
