Leon closed his savings account and redeemed his mortgage with Harbour Bank last month. He makes a written request that the bank erase all the personal data it holds about him. What should the bank do with the identity records it obtained for customer due diligence?
The right to erasure in UK GDPR Art 17 does not apply where processing is necessary to comply with a legal obligation (Art 17(3)(b)), and MLR 2017 reg 40 requires CDD records to be kept for five years after the relationship ends. After that, reg 40 requires the personal data to be deleted unless an exception applies, so keeping it permanently would breach the storage limitation principle (Art 5(1)(e)). The bank should still reply within one month explaining why it is keeping these records. Erasure requests are normally free.
Treating the right to erasure as absolute when a legal duty requires the data to be kept.
Practise more FRE2 Money Laundering, Proceeds of Crime & Data Protection questions
Exam-style questions with worked answers, then full timed mocks. Free to start.
Build a daily practice habit — a few exam-style questions a day, with worked answers. Free to start.
Start practising →Original practice material mapped to the published CeMAP FRE2 learning outcomes. Independent, not endorsed by Walbrook (formerly LIBF). Verify figures and rules against current guidance before relying on them.
