Forget me yes, part two.

Austrian Data Protection Authority holds that a data controller can meet its obligations to satisfy a data subject’s erasure request under GDPR by anonymizing personal data.

Some points:

• Erasure is not the same as destruction; the controller can select means to carry out the erasure.
• The controller must ensure that neither the controller himself nor a third party can restore a personal reference without disproportionate effort.
• The fact that a reconstruction of the data may become possible in future due to new technology, does not render the erasure insufficient.
• The measures used by the company that were deemed to be sufficient for erasure were:
  • delete the contract offer
  • delete all contacts (e.g. mail address, telephone number, etc.)
  • irrevocable manual deletion of the first and last name and replacement by “John Doe” (with the same date of birth)
  • stop communication with the individual
  • merge the person to be erased with the new anonymous person to ensure that the overwriting is also technically sustainable
  • erase customer in electronic file

Details from the Austrian Data Protection Authority.