Employee data retention periods in implementing the right to be forgotten: the situation in Lithuania

ENThe General Data Protection Regulation (Regulation, 2016) (hereinafter - the GDPR, Regulation) establishes the basic principles of personal data protection and the data subject's rights. The right to be forgotten is established in Article 17 of the GDPR. It allows the data subject, under certain conditions, to obtain from the controller the erasure of personal data concerning him or her upon the termination of the employment relationship. The study was conducted mainly in the context of labour law, i.e. the actions of the employer (as the data controller) and the employee (as the data subject) in processing (protecting) personal data and implementing the right to be forgotten are analysed. However, the public sector was assessed and compared for a more objective and detailed disclosure of the situation in the subject's data retention activities. In the relationship between employers and employees, there are discussions about how long the employer must store the employee's personal data, as well as disputes regarding the period after which the data subject acquires the right to obtain from the controller the erasure of personal data concerning him or her. The GDPR does not provide personal data retention periods – these periods are established in the national legislation of the European Union (EU) Member States. It should be noted that after the provisions of the GDPR came into force, the national legislation regulating personal data retention periods were not changed. This leads to possible noncompliance with the provisions of the GDPR stipulating that the periods for which personal data are stored must be optimal and not too long and must not violate the interests of the data subject.During the study, by analysing case law as well as legal regulation in the Republic of Lithuania and other EU countries, the content of the right to be forgotten is revealed, and optimal personal data retention periods that allow a sustainable relationship between the data subject and the data controller to be maintained are proposed. Keywords: rights of data subjects; right to be forgotten; employee data retention periods; obligations of employers. [From the publication]

• Asmens duomenų teisinės apsaugos principai : disertacija / Ilona Petraitytė. Vilnius, 2013. 1 pdf (339 p.).
• Darbuotojų asmens duomenų apsaugos užtikrinimo teisinio reguliavimo ypatumai / Rasa Grigonienė. Jurisprudencija. 2020, Nr. 27 (2), p. 346-369.