Guidelines 03/2019 on processing of personal data through video devices
Paragraph 6.2.1 Right to erasure (Right to be forgotten)
99. If the controller continues to process personal data beyond real-time monitoring (e.g. storing) the data subject may request for the personal data to be erased under Article 17 GDPR.
100. Upon a request, the controller is obliged to erase the personal data without undue delay if one of the circumstances listed under Article 17 (1) GDPR applies (and none of the exceptions listed under Article 17 (3)GDPR does). That includes the obligation to erase personal data when they are no longer needed for the purpose for which they were initially stored, or when the processing is unlawful (see also Section 8 –Storageperiods and obligation to erasure). Furthermore, depending on the legal basis of processing, personal data should be erased:
for consent whenever the consent is withdrawn (and there is no other legal basis for the processing)
for legitimate interest: – whenever the data subject exercises the right to object (see Section 6.2.2) and there are no overriding compelling legitimate grounds for the processing, or – in case of direct marketing (including profiling) whenever the data subject objects to the processing.