united-kingdom gdpr data-ownership
Can I request to delete an account with a government?
<p>This concerns my student loans repayment account which is managed by the gov.uk website.
I have paid my loan back in full and have had a confirmatory letter stating this as well, as I wanted to ensure I have written proof.</p>
<p>When on the phone with the student loan repayment hotline, they told me that I couldn't delete my account (there is no such option anywhere) and that they would keep the account for my lifetime, during which I have to keep my contact details up to date. I said I didn't want that, and the response was that if I want to take out a loan again, they would have all the information.</p>
<p>I really, really disagree with this. I understand that the British government will probably have a track record of my student loan and this is fine; but I don't want to have a life-long account that I need to keep up to date with my home address, email, and two phone numbers.</p>
<p>I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment. Also, all the guides keep talking about companies. Do governments count as companies? Probably not, I presume.</p>
<p>What can I do?</p>

<p>In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at <a href="https://uk-gdpr.org/chapter-2-article-6/" rel="nofollow noreferrer">Article 6(1) of the UK GDPR</a>. Briefly, those are:</p>
<pre><code>a) Consent of the data subject
b) Necessary for performance of a contract with the data subject
c) Necessary for compliance with a legal obligation
d) Necessary to protect vital interests of data subject or another person
e) Necessary for public interest or exercise of official authority vested in the controller
f) Necessary for controller's legitimate interests
</code></pre>
<p>Clearly a) and d) don't apply. As you've settled the debt, it seems unlikely to me that b) or f) apply. That leaves c) and e). A common example under c) would be a requirement by Companies House or HMRC to keep accounting records for a certain period of time. Some public bodies may also find it necessary, under e), to retain records which they need to be able to carry out their other functions. It seems highly unlikely to me that either of these would justify retention for your &quot;lifetime&quot; however.</p>
<p>I would start by sending them a written demand to have your data erased under <a href="https://uk-gdpr.org/chapter-3-article-17/" rel="nofollow noreferrer">Article 17(1)</a>. Make sure you also specifically request that they provide you with all the information (and in particular the purposes of the processing) under <a href="https://uk-gdpr.org/chapter-3-article-15/" rel="nofollow noreferrer">Article 15(1)</a>, and that, in the event that they refuse to erase your data, they explain the reasons why pursuant to <a href="https://uk-gdpr.org/chapter-3-article-12/" rel="nofollow noreferrer">Article 12(4)</a>. Their response on these points will be helpful in establishing whether there is a lawful basis.</p>
<p>Your next step after that is either to complain to the ICO or to apply to court for a compliance order under <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/167" rel="nofollow noreferrer">Section 167 of the Data Protection Act 2018</a>. The former is free while the latter is not and carries risks of cost if you are unsuccessful. If you opt for one of these steps, make sure you cite the relevant provisions of the GDPR and explain why you think there is no lawful basis for the data retention (including by referencing any response you received from them).</p>
<h2>&quot;I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment&quot;</h2>
<p>It doesn't matter whether we are talking about your account or your track record. What matters is whether the account constitutes personal data, which it almost certainly does, per the definition at <a href="https://uk-gdpr.org/chapter-1-article-4/" rel="nofollow noreferrer">Article 4(1)</a>:</p>
<p>&quot;<em>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;&quot;</em></p>
