Under the GDPR, a streaming subscriber demands erasure while tax law requires their invoices to be kept and a billing dispute is open; what does Art. 17 require?

## The collision A subscriber cancels a video-streaming subscription and asks the service to "delete everything". Invoices issued to them must be kept for a period set by national tax law, and they are disputing one charge. Under the GDPR, both the erasure right and the retention duty are law. The Regulation does not leave the conflict to judgement alone: `Art. 17` states when erasure is owed and when it yields. ## When the duty to erase arises — Art. 17(1) The controller must erase personal data **without undue delay** where one of six grounds applies: | Point | Ground | Streaming example | |---|---|---| | (a) | No longer necessary for the purposes collected or processed | Viewing history after the account is closed | | (b) | Consent withdrawn and no other legal ground | Data processed only on the basis of consent | | (c) | Objection under Art. 21(1) with no overriding legitimate grounds, or objection to direct marketing under Art. 21(2) | A marketing profile after a marketing objection | | (d) | Unlawfully processed | Data kept past its stated retention with no basis | | (e) | Erasure required by a legal obligation in Union or Member State law | A statute that orders deletion | | (f) | Collected in relation to the offer of information society services referred to in Art. 8(1) | An account opened as a child | `Art. 17` sets no number of days for the erasure itself; "without undue delay" is the standard, and `Art. 12(3)` requires the controller to inform the person of the action taken within one month of receipt, extendable by two further months. ## The exceptions — Art. 17(3) Paragraphs 1 and 2 do not apply **to the extent that processing is necessary**: - **(a)** for exercising the right of freedom of expression and information; - **(b)** for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for a task in the public interest or in the exercise of official authority; - **(c)** for reasons of public interest in the area of public health, under `Art. 9(2)(h)` and `(i)` and `Art. 9(3)`; - **(d)** for archiving in the public interest, scientific or historical research or statistical purposes under `Art. 89(1)`, where erasure would render impossible or seriously impair those objectives; - **(e)** for the establishment, exercise or defence of legal claims. Two phrases do the work. **"To the extent that"** makes the exception exactly as wide as the necessity, never wider. **"Union or Member State law"** means a legal obligation must come from law: an internal retention policy or a clause the controller wrote into its own terms is not one. ## Applying it: partial erasure 1. **Map each category of data to the reason it is held.** The request is resolved category by category, not account by account. 2. **Invoices** — keep under point (b) for the period the tax law sets, and use them only for that obligation. 3. **Dispute records** — the disputed charge, the correspondence and the delivery records that prove the service was provided — keep under point (e), to the extent the claim needs them. A speculative possibility of some future claim is hard to square with "necessary". 4. **Everything else** — viewing history, ratings, device list, recommendation data, marketing segments — erase without undue delay. 5. **Schedule the rest.** When the tax period ends or the dispute closes, the retained data is no longer necessary, which is itself ground (a); `Art. 5(1)(e)` storage limitation says the same. ## Telling the person and the recipients - **The person.** For what is erased, `Art. 12(3)` requires information on the action taken. For what is kept, `Art. 12(4)` requires the reasons, and the possibility of a complaint to a supervisory authority and a judicial remedy, within one month. - **Recipients.** `Art. 19` requires the controller to communicate the erasure to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort, and to tell the person who those recipients are if they ask. - **Data made public.** `Art. 17(2)`: where the controller made the data public, it takes reasonable steps, including technical measures and taking account of available technology and cost, to inform other controllers processing it that the person has requested erasure of links, copies or replications. For a streaming service this reaches, for example, public reviews posted under the subscriber's profile. How erasure then propagates through warehouses, backups or append-only logs is an implementation question; the Regulation's requirement is the outcome. ## Common mistakes - Treating erasure as all-or-nothing: either refusing everything because of the invoices, or deleting the invoices too. - Citing an internal retention policy as a legal obligation. - Keeping the whole account "in case of disputes" when no claim exists. - Forgetting the Art. 19 notice to recipients. - Deleting silently without telling the person what was kept and why.