Bryan Cave addresses the common question “If I receive a Right to Be Forgotten Request from a former employee that was terminated for cause, do I have to honor it?” The General Data Protection Regulation (GDPR) indicates that people have a “right to be forgotten” in six situations. 1. Companies must delete data upon request, if data is no longer necessary. 2. Companies must delete data upon request if data was processed based solely on consent. 3. Companies must delete data upon request if the data was processed based upon the controller’s legitimate interest, and that interest is outweighed by the data subject’s rights. 4. Companies must delete data upon request if data is being processed unlawfully. 5. Companies must delete data upon request if erasure is already required by law. 6. Companies must delete data upon request if it is collected from a child as part of offering an information society service.

Read more here.