gdpr
Data deleted prior to GDPR access request
<p>A company recieves a request to access personal data. They realize that they got the request two weeks after  data collection; by this time all data is deleted. What would a company reply if such deletion was preinformed in the privacy policy of the company? Can a company just tell user they don't have the data or not?</p>

<p>Paragraph 1 of <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">GDPR Article 15</a> says:</p>
<blockquote>
<p>The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data ...</p>
<p>(b) the categories of personal data concerned;</p>
<p>(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed ...</p>
</blockquote>
<p>Paragraph 3 of article 15 provides that:</p>
<blockquote>
<p>The controller shall provide a copy of the personal data undergoing processing. ...</p>
</blockquote>
<p>This clearly includes the possibility that some personal data may not be &quot;undergoing processing&quot;, remembering that storage is a form of processing under the GDPR.</p>
<p><a href="https://gdpr-info.eu/recitals/no-63/" rel="nofollow noreferrer">Recital 63</a> says that:</p>
<blockquote>
<p>Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, ...</p>
</blockquote>
<p><a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">GDPR Article 5</a> paragraph 1 (b)  says in relevant part that personal information should be :</p>
<blockquote>
<p>collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;</p>
</blockquote>
<p>Thus when the purpose for wich PI was collected has ended, and there is no further lawful basis to store or otherwise process that PI, it should be deleted.</p>
<p><a href="https://gdpr-info.eu/recitals/no-39/" rel="nofollow noreferrer">Recital 39</a> says that:</p>
<blockquote>
<p>...the period for which the personal data are stored is limited to a strict minimum ...
...</p>
<p>In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.</p>
</blockquote>
<p>So again, it is not only possible but desirable that PI once collected may be deleted once the purpose for which it was collected has been satisfied.</p>
<p><a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">GDPR article 13</a> paragraph 1 says:</p>
<blockquote>
<p>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with</p>
<p>...</p>
<p>(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;</p>
</blockquote>
<p>Paragraph 2 (a) adds that the controller shall also provide the Data Subject with:</p>
<blockquote>
<p>the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;</p>
</blockquote>
<p>It is thus again contemplated that some PI will be stored only for a limited period.</p>
<p>Where PI data is collected, but has been erased prior to the request for access, the previous processing of that data should be included in the categories listed under art 15 par 1 (b), and its recipients under art 15 par 1 (c). The period of retention should have been disclosed upon collection. That (along with the other required information) should be a sufficient reply.</p>
