On December 1, 2023, the Supervisory Authority of Liechtenstein (DSS) released guidance for data subjects and data controllers to better understand the obligation to delete and right to erasure under Articles 5 and 17 of the General Data Protection Regulation (GDPR).  

What are the recommendations for the obligation to delete personal data? 

The guidance highlighted that the period for storing personal data is based on the determination of whether data is necessary to fulfill the purpose for which it was collected. The guidance advised, among other things, that national laws should be considered for retention obligations and that data should be deleted when the legal basis for which the data was collected is no longer valid.  Additional guidance was provided for data minimization and purpose limitation.  

What are the recommendations for the right to erasure? 

Regarding the data subject's right to request erasure of their personal data, the guidance called attention to Article 17 of the GDPR which provides the right for those affected by personal data processing to request immediate deletion of their data. The guidance further clarified that this right is not absolute and must meet certain conditions prior to being honored. 

Specifically, the guidance stated that under Article 35 of the Data Protection Act (DSG) where data processing is fundamentally lawful, and the interest of the person concerned in the deletion is considered to be low impact, deletion can be omitted if this is due to the type of storage or that processing would be impossible or disproportionately complex. In such a case, instead of deletion, processing is restricted in accordance with Article 18 of the GDPR.  

Furthermore, the guidance detailed that Article 35 of the DSG extends the controller's reasons for rejection listed in Article 17(3) of the GDPR to cases in which the deletion can be assumed to harm the legitimate interests of the data subject or in which statutory or contractual retention periods exist. 

What are the recommendations for data storage?

Lastly, the guidance provided information regarding the storage of personal data including among other things, details regarding anonymizing personal data as opposed to deleting data and the benefits of developing a comprehensive and automated retention and deletion schedule. The DSS also published a chart organizing statutory deletion and retention periods. 

You can read the press release here, and the guidance here, both only available in German.