A right to erasure of personal information.

I blogged previously on my opposition to the court ruling in the EU giving people a right to be forgotten. This forces search engines to censor results to hide information that people claimed was outdated and embarrassing to them.

I mentioned there is a push for a similar right in NZ, but not quite the same thing. The Privacy Commissioner’s submission to the select committee is here and is dealt with on pages 28 to 30.  The recommendation is:

The Privacy Bill should include a new information privacy principle on the right to erasure of personal information.

How this works in Europe under the GDPR is:

individuals have the right to request their personal data be erased if:
a) the personal data is no longer necessary for the purpose which it was originally collected or processed;
b) the agency is relying on consent as the lawful basis for holding the data, and the individual withdraws their consent;
c) the individual objects to the processing of their data, and there is no overriding legitimate interest to continue processing it;
d) the agency has processed the personal data unlawfully;
e) the agency has a legal obligation to erase the data (for example an obligation arising from another Member State); or
f) the agency has processed the personal data to offer information society services to a child.

Few would argue with b, d, e or f. Even a is not hat controversial. But “c” could open up a minefield.

However I object less to a law that requires agencies to delete personal data, than a law which requires search engines to censor their results.

But having said that I’m still against, and here’s one reason why.

I often get requests from various people to delete a reference to them in an old blog post. Some of these are from over a decade ago. Often all I have done is link to and comment on a story in the media about them. But as I come up high in Google ranks, my post on them comes up high.

Off memory, I have always agreed to delete or edit the old posts or references. Unless I think they are an ongoing “threat” I’ll agree. But what is nice is they ask me politely. They don’t demand. If they did makes threats or demand, I’d probably be less inclined.

A law giving people a right to demand old information on them be deleted, is likely to result in people sending me lawyers letters demanding I do x or y, rather than simply asking politely. Plus I do reserve the right to say no, if I think it is in the public interest to keep an old post up. I don’t think people should have the right to take me to court because I posted on something in the public domain.

So while is proposed here is better than in the EU, I’m still far from convinced. And it would be such a major law change, I’d want its own consultation, not something added on at select committee stage to this bill.