Question

A multinational retailer operating in the EU receives a GDPR Article 17 (right to erasure) request from a former customer. However, the company's legal team has placed a litigation hold on all records related to a pending class-action lawsuit, and this customer's transaction records are within the scope of that hold. The Data Protection Officer (DPO) must respond within the regulatory timeframe. What is the MOST appropriate action?

Accepted Answer

Inform the data subject that the erasure will be delayed for data subject to the litigation hold, invoking the legal claims exemption under Article 17(3), while erasing any data not covered by the hold

Answer

Immediately delete all of the customer's personal data to comply with the erasure request and avoid GDPR penalties

Answer

Deny the erasure request without explanation, since the litigation hold automatically overrides all data subject rights

Answer

Forward the request to the legal team and take no further action until the lawsuit is fully resolved