The \u201cright to be forgotten\u201d is under the spotlight in 2025, with the EU coordinating a major review of Article 17 of the GDPR. On 5 March 2025, the European Data Protection Board (EDPB) launched the Coordinated Enforcement Framework (CEF 2025), bringing together 32 EU data protection authorities, including the Hellenic Data Protection Authority (HDPA). This initiative targets compliance across sectors and highlights the increasing complexity of balancing employee rights with business needs.<\/p>\n
In employment, the right to erasure directly affects HR operations. Employees can request the deletion of their personal data when it is no longer necessary, consent is withdrawn, processing is unlawful, they object to processing without overriding legitimate grounds, or erasure is legally required.<\/p>\n
However, this right is not absolute. Employers can lawfully retain data to comply with legal obligations (e.g., tax or payroll records), for defending or pursuing legal claims, or for public interest purposes, including research and statistics.<\/p>\n
After an employee leaves, unnecessary data must be deleted without delay, but certain records\u2014payroll, insurance, employment termination\u2014must be retained for specific periods, taking into account regulatory requirements, potential claims, and limitation periods. For example, annual leave records are retained for five years under Article 250 of the Civil Code. CCTV footage is generally deleted within 15 days, unless special circumstances justify longer retention, such as criminal investigations. Internal investigation data can be retained until the process concludes, provided proportionality is respected.<\/p>\n
Full implementation of the right to erasure means removing data from all storage systems, physical and digital, including backups. Employers must also notify employees and any third parties involved in processing.<\/p>\n
Effectively managing the right to erasure requires balancing employee privacy with business interests. Embedding data protection by design and by default, training staff, and following best practices ensures a compliant, responsible, and modern workplace, while safeguarding fundamental rights and corporate integrity.<\/p>","protected":false},"excerpt":{"rendered":"
The \u201cright to be forgotten\u201d is under the spotlight in 2025, with the EU coordinating a major review of Article 17 of the GDPR. On 5 March 2025, the European Data Protection Board (EDPB) launched the Coordinated Enforcement Framework (CEF 2025), bringing together 32 EU data protection authorities, including the Hellenic Data Protection Authority (HDPA)…. <\/p>\n