ESC
Clarivate

 
Source: Journal Citation ReportsTM from ClarivateTM 2022

Entrepreneurship and Sustainability Issues Open access
Journal Impact FactorTM (2022) 1.7
Journal Citation IndicatorTM (2022) 0.42
Received: 2022-10-11  |  Accepted: 2022-12-21  |  Published: 2022-12-30

Title

Employee data retention periods in implementing the right to be forgotten: the situation in Lithuania


Abstract

The General Data Protection Regulation (Regulation, 2016) (hereinafter – the GDPR, Regulation) establishes the basic principles of personal data protection and the data subject's rights. The right to be forgotten is established in Article 17 of the GDPR. It allows the data subject, under certain conditions, to obtain from the controller the erasure of personal data concerning him or her upon the termination of the employment relationship. The study was conducted mainly in the context of labour law, i.e. the actions of the employer (as the data controller) and the employee (as the data subject) in processing (protecting) personal data and implementing the right to be forgotten are analysed. However, the public sector was assessed and compared for a more objective and detailed disclosure of the situation in the subject's data retention activities. In the relationship between employers and employees, there are discussions about how long the employer must store the employee's personal data, as well as disputes regarding the period after which the data subject acquires the right to obtain from the controller the erasure of personal data concerning him or her. The GDPR does not provide personal data retention periods – these periods are established in the national legislation of the European Union (EU) Member States. It should be noted that after the provisions of the GDPR came into force, the national legislation regulating personal data retention periods were not changed. This leads to possible non-compliance with the provisions of the GDPR stipulating that the periods for which personal data are stored must be optimal and not too long and must not violate the interests of the data subject. During the study, by analysing case law as well as legal regulation in the Republic of Lithuania and other EU countries, the content of the right to be forgotten is revealed, and optimal personal data retention periods that allow a sustainable relationship between the data subject and the data controller to be maintained are proposed.


Keywords

rights of data subjects, right to be forgotten, employee data retention periods, obligations of employers


JEL classifications

J53 , J58


URI

http://jssidoi.org/jesi/article/1047


DOI


Pages

623-634


Funding


This is an open access issue and all published articles are licensed under a
Creative Commons Attribution 4.0 International License

Authors

Novikovas, Andrejus
Mykolas Romeris University, Vilnius, Lithuania https://www.mruni.eu
Articles by this author in: CrossRef |  Google Scholar

Grigonienė, Rasa
Mykolas Romeris University, Vilnius, Lithuania https://www.mruni.eu
Articles by this author in: CrossRef |  Google Scholar

Journal title

Entrepreneurship and Sustainability Issues

Volume

10


Number

2


Issue date

December 2022


Issue DOI


ISSN

ISSN 2345-0282 (online)


Publisher

VšĮ Entrepreneurship and Sustainability Center, Vilnius, Lithuania

Cited

Google Scholar

Article views & downloads

HTML views: 850  |  PDF downloads: 426

References


Article 29 Data Protection Working Party: Guidelines on Transparency under Regulation 2016/679 (wp260rev.01), adopted on 29 November 2017. https://ec.europa.eu/newsroom/article29/redirection/document/51025

Search via ReFindit


Charter of Fundamental Rights of the European Union (2016/C 202/02), Retrieved July 9, 2022, from . https://eur-lex.europa.eu/legal-content/LT/TXT/PDF/?uri=CELEX:12016P/TXT&from=EN

Search via ReFindit


Civil Code of the Republic of Lithuania. Book Two. Persons (Official Gazette, 2000, No 74-2262).

Search via ReFindit


Code of Administrative Offenses of the Republic of Lithuania (Official Gazette, 10-07-2015, No. 2015-11216)

Search via ReFindit


Convention for the Protection of Human Rights and Fundamental Freedoms as amended by Protocols No. 11 and 14 Rome, 4.XI.1950 (Official Gazette, 1995, No 40-987).

Search via ReFindit


De Terwangne, C. (2013). The Right to be Forgotten and the Informational Autonomy in the Digital Environment, Luxembourg: Publications Office of the European Union, EUR 26434 EN, p 2. https://publications.jrc.ec.europa.eu/repository/bitstream/JRC86750/jrc86750_cecile_fv.pdf

Search via ReFindit


Decision of the Supreme Administrative Court of Lithuania of 15 December 2021 in administrative case No eA-2108-822/2021

Search via ReFindit


Erdos, D. (2021). The 'right to be forgotten' beyond the EU: an analysis of wider G20 regulatory action and potential next steps. Journal of Media Law, 13(1), 1–35. http://doi.org/10.1080/17577632.2021.1884947

Search via ReFindit


Grigonienė, R. (2020). Legal Regulation Ensuring the Protection of Personal Data of Employees: A Critical Analysis. Jurisprudence, 27(2), 346-369. http://doi.org/10.13165/JUR-20-27-2-06

Search via ReFindit


Judgment of European Court of Human Rights of 13 February 2020 in case Gaughran v. the United Kingdom (No 45245/15), ECHR, Retrieved July 20, 2022 from ]}, date of access: 18 June 2020. https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-200817%22

Search via ReFindit


Judgment of the Court of Justice of the European Union (Grand Chamber) of 13 May 2014 in Case C 131/12— Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, EUR-Lex, Retrieved July 10, 2022 from , https://eur-lex.europa.eu/legal-content/LT/TXT/HTML/?uri=CELEX:62012CJ0131&from=EN

Search via ReFindit


Judgment of the Court of Justice of the European Union (Grand Chamber) of 24 September 2019 in Case C-507/17 Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL). ECLI Retrieved July 10, 2022 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62017CJ0507

Search via ReFindit


Judgment of the Court of Justice of the European Union (Sixth Chamber) of 22 September 2022 in Case C‑120/21, LB v TO, request from the Bundesarbeitsgericht for a preliminary ruling, EUR-Lex, Retrieved July 20, 2022 from . https://eur-lex.europa.eu/legal-content/lt/TXT/?uri=CELEX:62021CJ0120

Search via ReFindit


Labor Code of the Republic of Lithuania (Official Gazette, 19-09-2016, No. 2016-23709).

Search via ReFindit


Law on Documents and Archives of the Republic of Lithuania (Official Gazette, 1995, No 107-2389; 2004, No 57-1982).

Search via ReFindit


Moore, S. (2017). The right to be forgotten is the right to have an imperfect past. The Guardian. https://www.theguardian.com/commentisfree/2017/aug/07/right-to-be-forgotten-data-protection-bill-ownership-identity-facebook-google

Search via ReFindit


Order of the Chief Archivist of Lithuania adopted in 2011 March 9 No. V-100 "On Approval of the Index of General Document Storage Terms" (Official Gazette, 2011, No. 32-1534).

Search via ReFindit


Petraitytė, I. (2013). Asmens duomenų teisinės apsaugos principai (Principles of legal protection of personal data; doctoral dissertation, Vilnius University, 2013), p. 186. https://www.tf.vu.lt/wp-content/uploads/2016/08/Ilona-Petraityt%C4%97_Asmens-duomen%C5%B3-teisin%C4%97s-apsaugos-principai-.pdf

Search via ReFindit


Recommendation CM/Rec(2015)5 of the Committee of Ministers to Member States on the processing of personal data in the context of employment, item 13.2, CE, Retrieved July 22, 2022 , https://search.coe.int/cm/Pages/result_details.aspx?ObjectID=09000016805c3f7a

Search via ReFindit


Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Retrieved July 9, 2022, from https://eur-lex.europa.eu/legal-content/LT/TXT/?uri=CELEX:32016R0679

Search via ReFindit


Right to erasure. (2022). Information Commissioner’s Office (ICO), Retrieved July 11, 2022, from . https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/#ib1

Search via ReFindit


Summary of the results of lawfulness checks on the processing of personal data for the purposes of direct marketing and loyalty programmes (2018 )(Asmens duomenų tvarkymo tiesioginės rinkodaros ir lojalumo programos tikslais teisėtumo patikrinimų rezultatų apibendrinimas), State Data Protection Inspectorate, Retrieved July 15, 2022 https://vdai.lrv.lt/uploads/vdai/documents/files/Apibendrinimasdeltiesioginesrinkodarosirlojalumo20180926.pdf

Search via ReFindit