european-union gdpr
Can a company charge a fee for erasure under GDPR?
<p>Suppose a company has a mailing list to reach out to potential customers. They send both physical and electronic mail. One EU-based potential customer does not want to receive mail anymore and requests their data to be erased under GDPR. Can this company charge a fee for this?</p>

<p><a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Art. 17 GDPR</a> contains the Right to erasure (‘right to be forgotten’).</p>

<p><a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">Art. 12(5) GDPR</a> contains:</p>

<blockquote>
  <ol start="5">
  <li><p>Information provided under Articles 13 and 14 and any communication and any actions taken under <strong>Articles 15 to 22</strong> and 34 shall be provided <strong>free of charge</strong>. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:</p>
  
  <p>(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested;</p>
  
  <p>or</p>
  
  <p>(b) refuse to act on the request.</p>
  
  <p>The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.</p></li>
  </ol>
</blockquote>

<p>So it is not possible to charge a fee for this.</p>

<p>Regarding electronic mail, also take a look at Article 13(1,2) of <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058" rel="nofollow noreferrer">Directive 2002/58/EC</a></p>

<blockquote>
  <p>Article 13</p>
  
  <p>Unsolicited communications</p>
  
  <ol>
  <li><p>The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic
  mail for the purposes of direct marketing may only be allowed in
  respect of subscribers who have given their prior consent.</p></li>
  <li><p>Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for
  electronic mail, in the context of the sale of a product or a service,
  in accordance with Directive 95/46/EC, the same natural or legal
  person may use these electronic contact details for direct marketing
  of its own similar products or services provided that customers
  clearly and distinctly are given the opportunity to object, 
  <strong>free of charge</strong> and in an easy manner, to such use of electronic contact
  details when they are collected and on the occasion of each message in
  case the customer has not initially refused such use.</p></li>
  </ol>
</blockquote>

<p>Note that this is a <a href="https://en.wikipedia.org/wiki/Directive_(European_Union)" rel="nofollow noreferrer">Directive</a>, so it is not directly binding, but each EU member state has created it's own laws containing this. </p>

<p><a href="https://gdpr-info.eu/art-95-gdpr/" rel="nofollow noreferrer">Article 95 GDPR</a> explicitly specifies it does not change any obligations from Directive 2002/58/EC.</p>

<p>So sending electronic mail to potential customers who have not given consent is unlawful because of paragraph 1. For existing customers paragraph 2 applies, removing must be free of charge. </p>
