gdpr
A website is refusing or failing to remove personal data I&#39;ve requested removed: is this against GRPR?
<p>I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful:</p>

<ul>
<li>it look a lot of back and forth messaging until they understood what I need</li>
<li>the support team is fairly disconnected from the tech team that can actually do it</li>
<li>in 9 months of continuous messaging there has been little to no progress and I feel I'm running 'round in circles</li>
</ul>

<p>I had a quick at GDPR and these points don't apply:</p>

<ul>
<li><blockquote>
  <p>the personal data your company/organisation  holds is needed to exercise the right of freedom of expression;</p>
</blockquote></li>
<li><blockquote>
  <p>there is a legal obligation to keep that data;</p>
</blockquote></li>
<li><blockquote>
  <p>for reasons of public interest (for example public health, scientific, statistical or historical research purposes).</p>
</blockquote></li>
</ul>

<p>Is the website's refusal/failure to remove my personal data against GDPR ?
What can I do about it ?</p>

<p>If the website's processing of your personal data is within the scope of the GDPR, then you have a qualified right to request the erasure of your personal data.</p>

<p>It is relevant whether:</p>

<ul>
<li>the website operates within the EU;</li>
<li>the website is operated by a company established in an EU country;</li>
<li>the website aims to sell goods or services to people in the EU; or</li>
<li>the website is routinely processing the personal data of people in the EU (including non-citizens).</li>
</ul>

<p>Furthermore, it is relevant whether your posts:</p>

<ul>
<li>contain one or more identifiers from which you could be personally identified, directly or indirectly, including by only the administrators or owners of the website; and</li>
<li>by their content, directly reveal information relating to you.</li>
</ul>

<p>For example, let's say you posted on a forum saying that "I am a keen supporter of socialism", and your personal email address was used to sign up to the website, then you would have revealed information about your political beliefs, which by reference to a username, the website owners could use to uniquely identify you by your email address. You would not necessarily have to have used your name.</p>

<p>If, for example, you posted something factual, like, "The Porsche 911 GT2 RS MR recorded the fastest lap time for a road-legal sports car on the Nürburgring," then it is only personal as long as it is associated with an identifier through which you could be identified. As such, the removal of the relationship could easily anonymise the post.</p>

<p>A data controller has an obligation to provide means by which the data subject can exercise the rights guaranteed under Chapter 3 of the GDPR. Article 17 grants the right to "erasure of personal data concerning him or her without undue delay" where the grounds under Art. 17 lit. 1 (a) to (f) are met. It may be relevant what the lawful basis of processing personal data was in the first place, such as in determining whether you can withdraw consent (i.e. you cannot withdraw consent if consent was not given), or in determining whether there is a right to object under Article 21 lit. 1. Derogations permissible under local implementing laws may provide for other exemptions or requirements to the right to erasure, so it is also important to determine the country of jurisdiction.</p>
