May I use personal data?
[/su_lightbox]In principle, you may use data as long as they are needed for the preparation or fulfillment of a contract, you are required by law to process (store) the data or if there is a legitimate interest to process the data. This covers all data required for the fulfillment of orders and legal requirements (record keeping), as well as the protection of the network or for the defense against lawsuits (legitimate interest). Consent is NOT required for these processing operations. The exact list of when consent is not required can be found in here. As long as the legal grounds mentioned here exist, the person concerned has NO right to deletion.
Restriction of data use
However, data subjects may request a restriction of use. This means that the data may only be used for the absolutely necessary purpose (e.g. accounting archive).
If the data is processed for public interest or legitimate interest, the data subject has the right to object. By objecting, the processing must be stopped (and the data erased) unless compelling legitimate grounds for the processing can be demonstrated or the processing serves the purpose of asserting or defending legal claims. Direct marketing can always be objected to.
For all other processing that is not “necessary”, the consent of the data subject is required. This can be revoked at any time.