Complaint about failure to erase Summary Our remarks A former employee complained about DMR A/S’s failure • According to the Danish DPA, if the data subject to delete video recordings and images of him that were withdraws his or her consent, erasure pursuant to included in a series of films on the company’s website, GDPR Article 17(1)(b) must take place immediately Facebook page, and YouTube. after the withdrawal. It is not specified how long this is, but in this specific case, three months was too On the 7th of June 2018, the complainant signed a long. consent declaration for the publication of images and videos. The complainant had authorized DMR A/S to • It can be difficult to remove a person from a video use video recordings of him for use on the company’s while maintaining the original quality of the video. website, in leaflets, newsletters, or other externally The Danish DPA did not appear to consider whether targeted informative material. significant resources are needed to remove a person from a marketing video or if the marketing On the 6th of September 2019, the complainant asked video becomes ineffective when a person featured DMR A/S to remove a film from YouTube in which he in it withdraws their consent. A data controller who appeared, as his employment relationship with DMR wants to produce marketing videos or the like should A/S had ended. DMR A/S replied that they would cut the therefore consider that a person who appears in the complainant out of all films. video based on his or her consent may demand that On the 10th of September 2019, the complainant wrote he or she no longer appears in the video. to DMR A/S informing them that he had still not been • If your company wants to use images or videos removed from DMR A/S’ commercials. DMR A/S stated for marketing purposes on the internet, it should the same day that the company was ”in progress” and consider the risk that it may have to delete the asked the complainant to be patient. video or cut a person out of the video, which could On the 17th of September 2019, DMR A/S informed the render it meaningless. complainant that he had now been removed from Considering this risk, we suggest the following should the employee film. On 11 December 2019, the Danish be considered: DPA nevertheless concluded that the complainant still appeared in a video on DMR A/S’s website and • If the processing is based on the legitimate on YouTube, after the complainant had contacted interests of the organization: Marketing is a the Danish DPA on September 27. The video was legitimate interest, so the basis for processing is not subsequently deleted. useless. However, a former employee will typically The Danish Data Protection Agency’s have a fairly strong interest in not appearing in a significant role in marketing material from a decision company that no longer employs them. Legitimate The Danish DPA seriously criticized the fact that DMR interests should therefore oftentimes only be A/S’ processing of the complainant’s request for used as a basis for processing in the case where erasure had not been carried out in accordance with individuals involved have a more discreet role in the GDPR, Article 17(1) (right to erasure). material, for example, an employee working in the background, or where participation in marketing is a natural part of the job of the individuals involved. Published: 18-05-2020, Journal number: 2019-31-2316 Tags: 03 Erasure and rectification 110