This section amends Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 which provides data subjects with the right to request that data controllers erase their personal data. Article 17(1) specifies grounds under which data subjects can request erasure, and where the data controller is obliged to accept this request. Article 17(3) sets out circumstances when this right does not apply, and a data controller can refuse a request for erasure.
	Subsection (2) inserts an additional ground under Article 17(1) which victims of harassment and stalking can use to request the erasure of personal data from a data controller. This new ground applies if the personal data held was a result of an allegation that was made by a malicious person in relation to the victim, and the data controller has investigated the allegation and has decided that no further action is needed. The exemption detailed in Article 17(3) will apply to this new ground.
	Subsection (3) defines the term ‘malicious person’ as an individual who has either been convicted of a relevant offence in relation to the data subject or who is subject to a stalking protection order made to protect the victim. Subsection (3) also lists the relevant offences in an accompanying table and these offences cover stalking and harassment.
	Subsection (4) amends the Data Protection Act 2018 to add in a new power for the Secretary of State to make regulations to amend the list of relevant offences set out in subsection (3). This regulation making power is subject to the affirmative resolution procedure.
Part 1: Victims of Criminal Conduct Data Protection Section 31: Right to erasure of personal data