IANAL, but this position from the website operator looks untenable to me.
If you are a data subject residing in the EU, or within places where the jurisdiction of EU law applies then this website is not compliant with the GDPR.
Specifically, the personal data would be unlawfully processed as they did not get your explicit consent to process for a specified process. Consent must be explicit and can be wirdrawn at any time.
The right to erasure is not total, but here's a good write up courtesy of the UK's ICO:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual...
At a glance
- The right to erasure is also known as ‘the right to be forgotten’.
- The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
In brief When does the right to erasure apply?
The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
- When the individual withdraws consent.
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
- The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
- The personal data has to be erased in order to comply with a legal obligation.
- The personal data is processed in relation to the offer of information society services to a child.
Under the GDPR, this right is not limited to processing that causes unwarranted and substantial damage or distress. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.
There are some specific circumstances where the right to erasure does not apply and you can refuse to deal with a request.
When can I refuse to comply with a request for erasure?
You can refuse to comply with a request for erasure where the personal data is processed for the following reasons:
- to exercise the right of freedom of expression and information;
- to comply with a legal obligation for the performance of a public interest task or exercise of official authority.
- for public health purposes in the public interest;
- archiving purposes in the public interest, scientific research historical research or statistical purposes; or
- the exercise or defence of legal claims.
How does the right to erasure apply to children’s personal data?
There are extra requirements when the request for erasure relates to children’s personal data, reflecting the GDPR emphasis on the enhanced protection of such information, especially in online environments.
If you process the personal data of children, you should pay special attention to existing situations where a child has given consent to processing and they later request erasure of the data (regardless of age at the time of the request), especially on social networking sites and internet forums. This is because a child may not have been fully aware of the risks involved in the processing at the time of consent (Recital 65).
Do I have to tell other organisations about the erasure of personal data?
If you have disclosed the personal data in question to others, you must contact each recipient and inform them of the erasure of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, you must also inform the individuals about these recipients.
The GDPR reinforces the right to erasure by clarifying that organisations in the online environment who make personal data public should inform other organisations who process the personal data to erase links to, copies or replication of the personal data in question.
While this might be challenging, if you process personal information online, for example on social networks, forums or websites, you must endeavour to comply with these requirements.
As in the example below, there may be instances where organisations that process the personal data may not be required to comply with this provision because an exemption applies.
Example
A search engine notifies a media publisher that it is delisting search results linking to a news report as a result of a request for erasure from an individual. If the publication of the article is protected by the freedom of expression exemption, then the publisher is not required to erase the article.
