European Court of Justice: Personal data must be deleted

Status: 10/27/2022 3:06 p.m

If a customer wants this, a telephone provider must ensure that their personal data that has been passed on is deleted. The customer does not have to ask each company individually – this has been decided by the European Court of Justice.

The extensive deletion of personal data from directories such as telephone books could become much easier in the future. If telephone providers have passed on customer data to other providers and search engines, they must also ensure that the entries are deleted there if the customers ask them to do so. According to the European Court of Justice (ECJ) in Luxembourg, they do not have to apply for deletion from each company individually.

Lawsuit against telephone provider Proximus

The background to the judgment is a lawsuit against the Belgian telephone provider Proximus, which offers, among other things, telephone information services and directories with personal data such as names, addresses and telephone numbers. These are transmitted to Proximus by other providers, and Proximus also forwards them to other providers and search engines such as Google.

A customer is now suing because his new telephone number was in such a directory without his consent. Proximus fought back, arguing that the customer’s consent was not required for the publication of his data in telephone directories. Rather, they would have to apply for not being listed themselves using a so-called opt-out procedure. As long as this does not happen, data does not have to be deleted.

ECJ: Customers must consent

The ECJ did not follow this reasoning. Before the data is published, customers must give their consent. With this consent, other companies could then also process the data, provided that the same purpose is being pursued. Equally, it is then sufficient to revoke your consent just once – whether to your own provider or to one of the other companies that use the data. The telephone providers are then obliged to forward the revocation and ensure that the data is deleted.

(Case C-129/21)

source site