Right to erasure

(1) In the case of non-automated processing, the BSI's duty to erase personal data under Article 17(1) and (2), in addition to the exceptions named in subsection (3) of Regulation (EU) 2016/679, does not exist where 1. erasure is not possible, or is possible only with disproportionately high effort, on account of the particular manner of storage, and 2. the data subject's interest in erasure is to be regarded as minor. In that case, a restriction of processing under Article 18 of Regulation (EU) 2016/679 takes the place of erasure. The first and second sentences do not apply where the personal data was processed unlawfully.
(2) Where erasure is merely deferred pending any judicial review of measures under section 8(4), the data may, without the data subject's consent, be used only for that purpose. It must be restricted in processing for other purposes. Section 8(8) remains unaffected.