Do privacy laws mean you have to delete a test result if a test-taker asks you to?

Posted by John Kleeman

We have all heard about the “right to be forgotten”, which allows individuals to ask search engines or other organizations to delete their personal data. This right was made stronger in Europe in 2018, when the General Data Protection Regulation (“GDPR”) entered into force, and is gradually becoming recognized in some form in other jurisdictions, for example in the new California privacy law, the California Consumer Privacy Act (“CCPA”).

I’m often asked questions by customers about what the situation is if test-takers ask to delete the results for tests and exams.  Let’s take an example:

Your organization runs a global certification program for third party candidates;One of your European candidates takes an exam in your program;The candidate then reaches out to you and asks for all their personal data to be deleted.