european-union gdpr
What does &#39;Right to Erasure&#39; actually cover?
<p>According to GDPR, any person has '<a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Right to Erasure</a> (<a href="https://gdpr-info.eu/recitals/no-65/" rel="nofollow noreferrer">Recital</a>)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user?</p>

<p>For an example, if there is a Database record:</p>

<pre><code>         Phone|  Option|     Actived|  Deactivated|  ...
(555)-123-4567|       A|  2017-04-12|   2018-01-10|  ...
</code></pre>

<p>If all sensitive information is deleted and information is reduced, such as:</p>

<pre><code>         Phone|  Option|     Actived|  Deactivated|  ...
(XXX)-XXX-XXXX|       A|        2017|         2018|  ...
</code></pre>

<p>This process of hiding users data is considered anonymization and as such should not be <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">applicable</a>. On the other hand, this approach will ensure that information about users who had option A activated last year will be kept without storing the users personal information. </p>

<p>However, by matching multiple sources, someone COULD potentially still find out what this number was. </p>

<p>Does this mean that <a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">reasonable effort</a> was put into securing the users sensitive data or does 'Right to Erasure' mean just that, delete everything about that user? That seems like it would seriously harm a lot of organization analytic.</p>

<p>You did read the exceptions?</p>
<blockquote>
<p>(3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:</p>
<p>d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or</p>
<p>e) for the establishment, exercise or defence of legal claims.</p>
</blockquote>
