Withdrawal Of Consent – What Steps Must A Controller Take?

The CJEU has recently held that controllers must implement technical and organisational measures to inform other controllers with whom they shared personal data that the data subject to whom the data relates, has made an erasure request.

Background

The case involves a complainant who is a subscriber to the Belgian telephone service operator, Telenet. Telenet transfers telecom subscriber data to directory providers, including Proximus.

In January 2019, the complainant made a request to Proximus to unsubscribe him from both Proximus's and third-parties' lists of telecom subscribers, which made certain personal data of subscribers publicly available. Following the request, Proximus changed the status of the complainant in its computer system so that the complainant's contact details would no longer be made public.