Bryan Cave addresses the common question If I receive a Right to Be Forgotten Request from a former employee that was terminated for cause, do I have to honor it? The General Data Protection Regulation (GDPR) indicates that people have a right to be forgotten in six situations. 1. Companies must delete data upon request, if data is no longer necessary. 2. Companies must delete data upon request if data was processed based solely on consent. 3. Companies must delete data upon request if the data was processed based upon the controllers legitimate interest, and that interest is outweighed by the data subjects rights. 4. Companies must delete data upon request if data is being processed unlawfully. 5. Companies must delete data upon request if erasure is already required by law. 6. Companies must delete data upon request if it is collected from a child as part of offering an information society service.
