# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 17** — Right to erasure ('right to be forgotten')
- **Article 19** — Notification obligation regarding rectification or erasure of personal data or restriction of processing
- **Article 17(2)** — Obligation to inform other controllers of erasure request where data made public
- **Article 12(3)** — Response timeline and extension provisions
- **Article 21** — Right to object (relevant to erasure ground under Art. 17(1)(c))
- **Article 8(1)** — Conditions applicable to child's consent in relation to information society services
- **Article 89(1)** — Safeguards for archiving, research, and statistical purposes
- **Recital 65** — Right to erasure: elaborates on circumstances and limitations
- **Recital 66** — Right to be forgotten in the online environment

### UK Data Protection Act 2018
- **Section 47** — Right to erasure (law enforcement processing)
- **Section 100** — Right to erasure (intelligence services processing)

## Regulatory Guidance

### European Data Protection Board (EDPB)
- **Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR** (adopted 7 July 2020): Provides criteria for assessing de-indexing requests and the balance between erasure rights and freedom of information.
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): While focused on access, provides relevant guidance on the interaction between Art. 15 and Art. 17.

### Court of Justice of the European Union (CJEU)
- **Case C-131/12 Google Spain SL v AEPD** (13 May 2014): Established the right to de-indexing of search results as an expression of the right to be forgotten.
- **Case C-507/17 Google LLC v CNIL** (24 September 2019): Clarified territorial scope of de-indexing obligations.

## Technical Standards

### NIST Special Publication 800-88 Rev. 1 — Guidelines for Media Sanitization
- Provides methods for securely erasing data from electronic media, including clear, purge, and destroy methods applicable to erasure implementation.

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.4.5** — PII de-identification and deletion: Establishes requirements for erasure processes within a PIMS framework.