The Erasure Request Versus Regulatory Retention
A UK mortgage broker receives an erasure request from a former customer whose mortgage application was declined 18 months ago. The customer cites 'the right to be forgotten' and wants all data deleted, including application records, call recordings, and credit checks. The broker's retention schedule says declined application records are kept for 6 years to defend against potential mis-selling complaints and to meet Financial Conduct Authority record-keeping expectations. One call recording contains an allegation by the customer about a staff member's conduct, and HR has flagged it for a potential employment tribunal. The broker also shared the application with two lenders and a credit reference agency. The customer's request arrived on a Friday; the broker's SLA is 30 days.
1. Advise the broker on how to respond to the erasure request, addressing each data category.
Read the worked answer
The request must be assessed category by category; erasure is not all-or-nothing.
- Declined application records: Likely exempt or restricted by a legal obligation (FCA record-keeping) and the establishment, exercise or defence of legal claims. The broker should refuse erasure for the retention period, explain the specific reason, and inform the customer of the right to complain to the ICO and to seek a judicial remedy.
- Credit checks: Determine the basis and retention. Credit reference agency data may be held under separate obligations; the broker should direct the customer to the CRA where appropriate and delete its own copies if no overriding obligation applies.
- Call recordings generally: Apply the same retention logic; delete those not needed for complaints or legal claims.
- Recording flagged by HR: Preserve under the legal claims exemption for the potential tribunal, restrict access, and document the decision. Do not delete while litigation is reasonably anticipated.
The broker must respond within one month (extendable by two months for complexity, with notice), confirm what was erased, what was retained, and why. The Friday arrival starts the clock; the SLA should be tracked from receipt.
2. The broker also wants to know whether it must contact the two lenders and the credit reference agency. Explain the obligations and the practical steps.
Read the worked answer
Yes, where erasure is granted, the broker must take reasonable steps to inform other controllers who received the data, taking account of available technology and cost.
- Lenders: Notify them of the erasure (or partial erasure) and request deletion of the broker-shared copies where they have no independent retention obligation. Lenders may retain their own records under their own obligations; the broker should record their responses.
- Credit reference agency: The CRA is likely an independent controller with statutory retention. The broker should notify it and direct the customer to exercise rights directly with the CRA.
- Documentation: Log recipients notified, dates, and any refusals with reasons.
Practical steps: use a standard recipient-notification template, maintain a register of third-party recipients per data category, and set a follow-up reminder. If erasure is refused for the application records, the notification obligation does not arise for those records, but the broker should still explain the position to the customer.