A former customer demands erasure of their account after cancelling a service. How should the controller approach the request at concept level?
Select an answer to reveal the explanation.
Short Explanation
Cancel-and-delete isn't always a one-button fairy tale—but it's a real right when the grounds fit. Check whether you still need the data or must keep it for law, then erase what's eligible. 'We like analytics' alone is a weak shield against a solid erasure ask.
Full Explanation
Article 17 establishes the right to erasure where specified grounds apply (including necessity ending or consent withdrawal) and enumerates exceptions such as compliance with a legal obligation or establishment of legal claims. Controllers should evaluate grounds and restrictions rather than blanket refusal for analytics or automatic erasure without checking retention law.