6 Replies Latest reply on Jun 18, 2018 4:25 PM by nathan.lichte

    GDPR Right to be Forgotten


      If I, an Eloqua user, receive a right to be forgotten request from one of my contacts, how can I remove their PII from Eloqua?


      Deleting a contact record is easy enough, as is removing data from custom objects.

      But I don't see a way to remove form submission records or how to remove data from BI reports.


      Thanks for any advice here.

        • 1. Re: GDPR Right to be Forgotten
          Andy BaII-Oracle



          Once you delete a contact. - form submissions will follow shortly thereafter. (note: -  They would be restored though if a Contact submits a form from their machine/ Device whilst their cookie is still active)


          Their activity imprint would still be visible in OBIEE, so that your accurate statistics are still presented to you, but if you drill down in your report to contact level you will see <Deleted Contact> instead of an email address.


          For more information on what exactly is or is not retained (& for how long), please see the below....



          • 2. Re: GDPR Right to be Forgotten

            Andy's answer is correct - for the form submit data you do not have an option to delete - theoretically Oracle cloud ops could delete this on the backend - however,


            Data on the form table is not readily available to the Eloqua user and that data cannot be used for marketing purposes unless linked to a contact (that was deleted)

            The form submission will include the opt-in request for historical purposes.

            The form submission will include the opt-out request for historical purposes.


            In the same paradox of cookie tracking, I need to know who you are (place a cookie) to know that I should not be tracking you.



            • 3. Re: GDPR Right to be Forgotten
              Bob at Elemental Marketing

              Technically, I could export form submissions and reupload as contacts though, right?

              1 person found this helpful
              • 4. Re: GDPR Right to be Forgotten
                Andy BaII-Oracle

                Hi Nathan, - I'm a bit confused by your answer:-

                Once a contact is deleted, their form submissions will be deleted as well. Is that not what is happening in your case? If not I'd suggest contacting My Oracle Support.


                Additionally, - I'm led to understand that retention of certain data (such as Opt in confirmations) is permitted to be retained after a contact is deleted, provided access is restricted to just the essential data protection officer(s) etc. - Such is the case that you are allowed to retain data in order to prove your compliance with the law .


                Please see this great GDPR Webinar from 4Thought Marketing which explains the concept in much more depth:



                • 5. Re: GDPR Right to be Forgotten

                  This not the behavior I'm seeing.


                  Here's what I did:

                  1. Submit data to a form that has an attached "Update Contacts - With Form Data" processing step.
                  2. Find the contact that was created and delete it.


                  I waited 30 minutes and then tried to verify that the form data had been removed.


                  What I saw:

                  1. When choosing "View Submission Data" from the Actions menu on the form page, I verified that my form submission was no longer in the table shown in the web UI.
                  2. I exported the form submission data via the "View Submission Data" modal. I verified that my form submission data was not removed from the export.
                  3. I ran the Form Submission Data report in OBIEE and verified that my form submission data was not removed from the report.


                  2 & 3 are obviously problems from a GDPR compliance perspective.


                  How can I have my form submission data for a given contact removed?


                  Thanks for your help!

                  • 6. Re: GDPR Right to be Forgotten


                    The form data table is separate from the contact table - as far as I know there is no mechanism for a user to remove data from that table - It will need to be done by someone at Oracle (if it is possible at all)


                    Now that I think about it, the personal data (email address) will also be on the unsubscribe table - this is likely exempt because you have to know who unsubscribed in order to suppress communication - nonetheless, the email address exists and is visible in the report.