The General Data Protection Regulation (GDPR) has been in force in the European Union since May 2018. It governs how companies are allowed to collect and process personal data. In particular, Article 15 – the right of access by the data subject – and Article 17 – the right to erasure – pose challenges for companies. The first article gives a person the right to obtain confirmation from the data controller as to whether or not personal data concerning them is actually being processed. This information must be provided within one month. The second article gives a person the right to demand that this data be deleted without delay.

As part of their corporate social responsibility strategy, many companies spend a share of their resources on promoting social and environmental projects or making their supply chains and the manufacture of their products more climate- and environmentally friendly. However, today’s digital lifestyle is also having an increasingly negative impact on the environment, by generating high CO2 emissions in the manufacture and use of electronic devices, for example. The increasing volumes of data also need to be taken into account: Data centres already consume around 1 percent of the electricity generated worldwide – in the next 15 years, this figure is expected to rise to 30 percent.