A former customer demands erasure of their account after cancelling a service. How should the controller approach the request at concept level?
Select an answer to reveal the explanation.
Short Explanation
Cancel-and-delete isn't always a one-button fairy tale—but it's a real right when the grounds fit. Check whether you still need the data or must keep it for law, then erase what's eligible. 'We like analytics' alone is a weak shield against a solid erasure ask.
Full Explanation
A former customer’s demand to erase account data after cancelling a service engages the right to erasure. Controllers should assess whether Article 17 grounds apply—for example, that personal data are no longer necessary for the original purposes, or that consent has been withdrawn where consent was the basis—and honour erasure subject to recognised restrictions such as compliance with a legal obligation or establishment, exercise, or defence of legal claims. Delete what must go; retain only what a specific exception still requires, and explain the scope.
Always refusing erasure because cancelled accounts “must” feed product analytics ignores statutory erasure grounds. Erasing immediately without checking legal retention duties, court orders, or other exceptions can itself create legal conflict. Treating every erasure demand as identical to a portability request and only exporting a CSV confuses two different rights.
Exam caveat: erasure is powerful but conditional—neither absolute nor optional. Operational check: map personal data across systems and backups, apply exceptions narrowly with documented reasons, complete deletion or anonymisation where required, and confirm outcomes to the requester as appropriate. Consumer and civic digital services should treat “cancel and delete” as a governed rights process that residents can trust, not a analytics entitlement for the organisation.