New Zealand Law Society - "Right to erasure" requirements not global, say Europeans

"Right to erasure" requirements not global, say Europeans

This article is over 3 years old. More recent information on this subject may exist.

The recent European Court of Justice ruling that Google will not be required to apply the "right to be forgotten" globally means that search results suppressed within Europe at the request of the individual will still be available to searches outside Europe, the Office of the Privacy Commissioner says.

The “right to erasure” rule gives EU citizens the power to demand data, including search links, about them be deleted.

The case relates to a dispute between Google and a French privacy regulator (the CNIL). The CNIL imposed a penalty of €100 000 on Google when it refused to apply a de-referencing request to all its search engine’s domain name extensions.

However, the ECJ ruled that Google will not be required to apply this “right to be forgotten” globally. Search results that are supressed within Europe will still be available to searchers outside Europe.

The Office of the Privacy Commissioner says New Zealand's Privacy Act 1993 and the Privacy Bill before Parliament do not contain an equivalent to the EU provision.

The Commissioner has recommended that the bill currently before Parliament offer the right to erasure, so that people can require a company to delete all of their personal data.

The ‘right to be forgotten’ derives from the case where a Spanish man, Mario Costeja González took Google to court as he was concerned that a Google search of his name brought up a 1998 Spanish newspaper article detailing how he had been forced to sell his property to repay social security debts. He argued that this readily accessible information was damaging to his reputation.

The ECJ ordered that Google remove the man’s data from their indexes and since that ruling in 2014, google has removed more than 800,000 URLs following requests for erasure.

Under the General Data Privacy Regulation, passed in the European Union in May 2018, data must be erased where it is no longer required for processing purposes, the subject of the data has withdrawn their consent or objected (and there is no other legal ground for processing) or when erasure is required to fulfil a statutory obligation under EU law or right of Member States.