A customer closes their account with an online retailer and asks the retailer to permanently delete all personal data it holds about them, where no legal obligation requires keeping it. Which privacy right is the customer exercising?
Select an answer to reveal the explanation.
Short Explanation
If the customer wants it gone, not fixed or paused, that's the right to be forgotten. Think of it as asking the store to shred your file, not just stop mailing you coupons. The trap is opt-out, which stops the marketing but leaves your data sitting in their system.
Full Explanation
The right to be forgotten, often called the right to erasure, allows an individual to request that an organization delete the personal data it holds about them when there is no longer a valid reason to keep it, such as after an account is closed and no legal retention obligation applies. Fulfilling the request means locating the data across production systems, copies, and processors, and deleting or irreversibly anonymizing it within the time frame the applicable regulation sets. Data correction, sometimes called rectification, lets an individual have inaccurate or incomplete data fixed; the customer is not disputing accuracy but asking for removal. Opting out stops specific processing, most commonly marketing communications or certain data sharing, while the data itself remains held, which falls short of what the customer requested. Restricting processing limits how the organization may use the data, for example while a dispute is resolved, but the organization keeps storing it; again, the data would not be deleted. Exam caveat: erasure is not absolute, and legal holds or regulatory retention requirements can override a deletion request for the affected records, which the organization should explain to the requester. Operational check: confirm a documented erasure procedure exists that covers backups and third-party processors and logs completion of each request.