Ioannis Iglezakis
Assistant Professor, Aristotle University of Thessaloniki
Abstract:
In the age of social media where it is almost impossible to escape your past on the Internet, the right to be forgotten enhances the ability of the individual to control the use of his or her personal data. Such a right has been recognized by the CJEU in the Google Spain case as far as search engines are concerned. With the adoption of the Data Protection Regulation by the EU it will form part of the EU legal framework in data protection.
Keywords: Data protection, digital forgetting, right to be forgotten, right to oblivion
1. Introduction
In the age of social media it is almost impossible to escape your past on the Internet, since every status update or photograph, and every tweet may be copied and/or reposted by other users or saved in Internet archives, such as the wayback machine1, and in cached pages2 or even – in case of photographs stored in the cloud – leaked online after an attack by hackers; as a result personal information may be available online, even if it has been deleted in its initial place (Mitrou/Karyda, 2012).
To address the issue of the Web that never forgets, jurists have proposed the introduction of a new digital right, a right to delete personal information from the Net (Mayer-Schönberger, 2009). This right draws its origin from the French and Italian law which recognize the right to oblivion that allows a convicted criminal who has served his time and been rehabilitated to object to the publication of his conviction and confinement.
In the digital world this right acquires a new substance; it is conceived as a right to delete personal information published in the web by data subjects, particularly in social networking sites. Some authors also consider this not as a legal right, but as a value or interest worthy or protection or as a policy goal to be achieved through law or through other regulatory mechanisms (Koops, 2011, Rouvroy, 2008).
The right to be forgotten in enshrined in Article 17 of the Draft Regulation on Data Protection (‘General Data Protection Regulation’, GDPR), which was presented in 2012 by the EU Commission and its adoption is still pending.
The introduction of this right has been the subject of much debate, for it is being criticized as a threat to free speech on the Internet (see, e.g. Rosen, 2012, Fleischer, 2011). Viviane Reding, Vice-President of the EU Commission describes this right as a modest expansion of existing data privacy rights. The Court of Justice of the EU with its decision of 13 May 2014 in the Google Spain case (C-131/12) confirmed this view, interpreting the provisions of Directive 95/46/EEC in such a way as to include a right ‘to be forgotten’ on the Net.4
2. Outline of the right to be forgotten
The provision of Article 17 GDPR basically includes a right to erasure of data that requires the controller to delete personal data and preclude any further dissemination of this data, but also to oblige third parties, e.g. search engines, etc., to delete any links to, or copies or replication of that data.5
In the initial Draft it was mentioned that this right has particular relevance when the individual made data available as a child. Although this provision was deleted after the vote in the Libe Committee, it is still a fact that a right to erasure of information has particular reference in cases where the information posted by young people in social media becomes obsolete when this person grows old. In more general, embarrassing information may be the subject of a right to digital forgetting that may protect against the negative use of information relating to the past (Costa, Poullet, 2012).
This applies in five instances, which derive from data protection principles: a) where data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) where the data subject withdraws consent on which the processing is based or when the storage period consented to has expired and there is no other legal ground for the processing of the data; c) where the data subject objects to the processing of personal data; d) where a court or regulatory authority base in the Union has ruled as final and absolute that the data concerned must be erased; or e) where the data has been unlawfully processed.
The right to be forgotten which is enshrined in the GDPR is not conceived as an absolute right; thus, a number of exceptions restrict its ambit, the most important being the freedom of expression and information. There is consensus that such a right cannot amount to a right of erasure of history and turn our modern society into a society of ‘lotus eaters’ (Iglezakis, 2014), which would be the case if the Internet was programmed to forget, e.g. if Internet content was programmed to auto-expire (Fleischer, 2011). Consequently, the erasure cannot take place where the retention of the personal data is necessary for exercising the right to freedom of expression.
3. The current EU legal framework and the Google Spain of the CJEU
Authors have taken the view that the existing legal framework in the EU, i.e. the Data Protection Directive (DPD)6 does not establish a comprehensive right to effectively control the use of personal data with a view to erase them, but some provisions provide a legal basis for a limited recognition of the right to be forgotten (Ausloos, 2012).
The Court of Justice of the European Union (CJEU), on the other hand, found that the provisions of the Directive can serve as a legal basis for the right to be forgotten vis-à-vis search engine providers. In its decision on May 13 2014, in case C-131/12 (Google Spain SL, Google Inc. v. Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez), it ruled that the ‘right to be forgotten’ is rooted in the provisions of Directive 95/46/EEC (Alsenoy et al., 2013).
In this case it was held that an Internet search engine operator is responsible for the processing that it carries out of personal data appearing on web pages published by third parties, i.e., content providers. The Court ruled that the data subject may request the removal of links, which are displayed in the list of results after a search on the basis of a person’s name.
In more particular, in response to the question whether the directive enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time, the Court held that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased.
The Court stressed out that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.
It also added that it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.
This decision has had significant repercussions; it was criticized by Wikipedia founder Jimmy Wales who called it ‘astonishing’ and free speech advocates at the Index on Censorship said this ruling “should send chills down the spine of everyone in the European Union who believes in the crucial importance of free expression and freedom of information”.7 Google received immediately after the decision was issued takedown requests, some of which are indeed ambiguous, such as the request of an ex-politician seeking re-election to have links to an article about his behavior in office removed and a man convicted of possessing child abuse images to have pages about his conviction wiped and a doctor asking negative reviews to be removed from search results.8
In order to cope with the flood of takedown requests Google launched a service to allow Europeans to ask for personal data to be removed; it created a a webform through which people can submit their requests for the erasure of links to information regarding them.9 This solution was criticized by EU regulators, since it restricted the removal of Internet links to European sites only and it notified the owners of websites that have been removed from search results when it proceeds to such removal.10
4. Perspectives
The CJEU ruling find direct application on search engines and concerns the right of the individual to erasure links to names of data subjects by a list of results displayed after a search is made on the made of his name. However, the court recognized that the data subject has to the right to object to the processing of personal data published on the Internet. As a result, data subject may invoke this ruling when filing takedown requests against content providers. It remains to be seen whether the right to be forgotten would acquire a more general scope of application even before the adoption of the Data Protection Regulation.
REFERENCES:
Alsenoy, B., Van/Kuczerawy, A./Ausloos, J., Search engines after Google Spain: internet@liberty or privacy@peril?, ICRI working paper 15/2013, online available at: https://www.law.kuleuven.be/icri/ and http://ssrn.com/link/ICRI-RES.html.
Ausloos, J., The ‘Right to be Forgotten’ Worth remembering?, (2012) Computer Law & Security Review 28, pp. 143-152.
Costa, L./Poullet, Y., Privacy and the regulation of 2012, (2012) Computer Law & Security Review 28, pp. 254-262.
Fleischer, P., Foggy Thinking About the Right to Oblivion, Privacy…? (Mar. 9, 2011), online available at: http://peterfleischer.blogspot.com/2011/03/foggy-thinking-about-right-to-oblivion.html.
Iglezakis, I., The right to digital oblivion and its restrictions (2014), Sakkoulas ed. (in Greek).
Koops, B.–J., Forgetting Footprints, Shunning Shadows. A Critical Analysis of the “Right to Forgotten” in Big Data Practice, (2011) scripted vol. 8, Issue 3, Dec. 2011.
Mayer-Schönberger, V., Delete: The Virtue of Forgetting in the Digital Age (2009), Princeton University Press.
Mitrou, L./Karyda, M., EU’s Data Protection Reform and the Right to be Forgotten: A Legal Response to a Technological Challenge? (February 5, 2012). 5th International Conference of Information Law and Ethics 2012, Corfu-Greece, June 29-30, 2012, online available at SSRN: http://ssrn.com/abstract=2165245
Rosen, J., Free Speech, Privacy, and the Web that Never Forgets, (2011) 9 J. on Telecomm. and High Tech. L. 345.
Rosen, J., The Right to Be Forgotten, 64 Stan. L. Rev. Online 88, February 13, 2012, online available at: http://www.stanfordlawreview.org/sites/default/files/online/topics/64-SLRO-88.pdf
Rouvroy, A., Reinventer l’art d’oublier et de se faire oublier dans la de l’information? version augmentée, (2008) online available at: http://works.bepress.com/antoinette_rouvroy/5/
ENDNOTES:
2. http://www.googleguide.com/cached_pages.html, http://www.cachedpages.com/, http://www.viewcached.com/
4. Court of Justice of the European Union, case C-131/12 – Google Spain SL, Google Inc. v. Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez.
6. Directive 1995/46/EC.
7. D. Lee, Google ruling ‘astonishing’, says Wikipedia founder Wales, http://www.bbc.com/news/technology-27407017
8. J. Wakefield, Politician and paedophile ask Google to ‘be forgotten’, http://www.bbc.com/news/technology-27423527
9. ”Google launches ‘right to be forgotten’ webform for removal requests”, theguardian, Friday 30 May, 2014, www.theguardian.com
10. See J. Fioretti, Google under fire from regulators on Eu privacy ruling, Reuters, July 24, 2014.