Template Letter Erasure Request

Summary

This is a template letter published by the Jersey Office of the Information Commissioner (JOIC) to help individuals draft a request for erasure of their personal data under Article 32 of the Data Protection (Jersey) Law 2018. It is a guidance tool, not a binding regulatory instrument, and must be adapted to the individual's own circumstances before use.

• Purpose: Provides a model letter individuals can send to an organisation (data controller) to request erasure of specified personal data.
• Grounds for erasure: Lists the statutory grounds a requester can cite, including data no longer necessary, withdrawn consent, objection to processing, unlawful processing, legal obligation to erase, or data relating to a child collected for online services.
• Third party notification: Asks the organisation to notify any third parties with whom the data was shared, unless impossible or disproportionately burdensome.
• Response obligations noted: Reminds the organisation that under DPJL 2018 it must respond without undue delay and, in any event, within four weeks of receipt, or explain any delay.
• Identity verification: Anticipates the organisation may require proof of identity from the requester.

As a template rather than a rule, it does not itself create new legal duties beyond those already set out in the Data Protection (Jersey) Law 2018, but it reflects and communicates the statutory erasure and response-time obligations that organisations receiving such a request must meet.

Key obligations

• An organisation receiving an erasure request under Article 32 DPJL 2018 must respond without undue delay and, in any event, within four weeks of receipt.
• If unable to comply within the four week period, the organisation must inform the requester of the anticipated timescale and reasons for the delay.
• If the organisation cannot erase all or part of the data, it must explain the legal basis for retention and any applicable exemptions.
• If the data has been shared with third parties, the organisation must notify them of the erasure request so they can erase their copies, unless impossible or disproportionately burdensome.

Applies to

individuals (data subjects), organisations acting as data controllers

Deadlines

• within four (4) weeks of receipt: Statutory timeframe under DPJL 2018 for an organisation to respond to an erasure request