Within the European Commission’s draft data protection framework is a provision for “the right to be forgotten and to erasure.” The provision’s concept isn’t entirely new to member states. Article 12 within the 1995 Data Protection Directive allows for the right to erasure. But where Article 12 grants data subjects rights to request that data controllers correct or erase data concerning them and to lodge a complaint to the supervisory authority, among others, the new proposal would allow data subjects to ask the data controller to delete their data and cease disseminating, even if consent was at one time given. The data controller would then also be responsible for taking all reasonable steps to alert third parties of a data subject’s request to correct or erase the data.
Tanguy Van Overstraeten, Partner at Linklaters in Brussels, said the right to be forgotten has been proposed to reinforce existing rights because there was a perception that these rights weren’t sufficient.
“The aim was not to significantly change the reality on the ground but the way the proposed provisions are drafted may have completely unintended and adverse consequences,” Van Overstraeten says.
Others say the provision will have major repercussions. George Washington Law Professor and legal commentator Jeff Rosen wrote for Stanford Law Review, for example, that despite European Commission Vice President Viviane Reding’s assertion that the right is a “modest expansion of existing data privacy rights,” in fact, “it represents the biggest threat to free speech on the Internet in the coming decade.”
Stakeholders have expressed particular concern with the proposal’s assertion that search engines and social media networks are defined in the draft as data controllers of the content users post and store on their sites.
Facebook UK Public Policy Director Simon Milner has said the proposal is troubling because “It is a right that someone can delete what they have posted but should not be able to delete what someone has posted about you.”
Vint Cerf, one of the co-founders of the Internet, has condemned the right to be forgotten provision, citing its impracticality. “It’s very, very hard to get the Internet to forget things that you don’t want it to remember because it’s easy to download and copy and re-upload files again later,” Cerf told The Daily Telegraph.
Van Overstraeten said the provision should at least draw a line between user-generated content—information a user voluntarily posts to a website, for example—and information posted by a third party.
User-generated content “should in principle be under your control. As a result, you may be entitled, to the extent of course it is still feasible, to have that information deleted if you decide at some point in time it is no longer suitable,” Van Overstraeten said. “On the other hand, the information that comes from third parties like information containing personal data posted by a journalist should remain subject to other individual rights such as the right of reply. In my opinion, there is no way the right to be forgotten could be exercised in that context.”
Spanish attorney Cecilia Alvarez Rigaudias of Uría Menéndez agreed.
“You may have other content posted by your family, friends or others, which at the end of the day may cause harm to you. This could also be the newspaper or media where the freedom of expression and freedom of speech, as fundamental freedoms, must be balanced vis-à-vis privacy,” she said. “There also could be situations where the legislation obliges to publish certain information like in judicial rulings, or information which is published in the official gazette in order to provide relevant information to the market, and therefore it’s difficult to assess whether you really have a “right to be forgotten” just because you do not want this to be available.”
Françoise Gilbert of IT Law Group adds that in the U.S., companies are “scratching their heads and saying, ‘How are we going to do this? We don’t think this is feasible at the very basic technical level.’”
Most troubling to her clients is the provision’s requirements that in the case of an individual’s request to remove data concerning him or her, “the entity not only has to remove the information but also has to contact third parties and tell them to remove the information. It’s very difficult to implement,” Gilbert said. “Only removing someone’s information can be difficult because, in one context, the information can be in many places. On top of that, you have to contact third parties.”
Ahead of the draft provision, courts in several jurisdictions have heard arguments based on varying interpretations of the right to be forgotten. In March, the UK government called for legislation that would force Internet companies to “proactively filter search results and require court-ordered material to be suppressed,” Deutsche Welle reported. In the same month, a Tokyo District Court approved a petition to require Google to delete terms from its auto-complete search feature after a man alleged the feature resulted in the loss of his employment. Earlier this year, the BBC unveiled a digital charter that will allow users of its web services to have all of their data deleted, and Spain’s government ordered Google to halt indexing of data on certain individuals after 90 complaints to Spain’s Data Protection Agency, a move Google said would have a “profound chilling effect on free expression without protecting people’s privacy,” according to The New York Times.
Also in March, a “right to be forgotten” case was dismissed by a Spanish court. A company argued online images harmed its reputation, but the court ruled that Google Spain “lacked standing to be sued” because it is a subsidiary.
Search engines are especially concerned with their level of responsibility under the draft proposal, according to Rigaudias.
“With respect to the fact that they don’t want to create precedent, they do not want to be held liable as intermediaries of information society services regarding contents that they have not created. I think they could be more worried and concerned about this specific issue than the data protection questions that are under discussion.”
Rigaudias said her clients feel “there is an overreaction with respect to the right to be forgotten, because the right to obtain a certain cancellation of data already exists in the data protection regulation since 1992.”
In a blog post, Google Chief Privacy Counsel Peter Fleischer wrote that because the Internet’s vitality shows no signs of slowing down, it is “vitally important that both those who provide online services and those who use them have a clear understanding of how a concept such as the right to be forgotten might apply.”
Fleischer noted there are practical and technical barriers to hosting platforms’ ability to comply with some of the proposal’s provisions, including the timeframe in which a platform must comply with a user’s request for data deletion and the expectation that a platform will ensure third-party compliance with data deletion. However, in the end, he said Google is “supportive of the principles behind the right to be forgotten” and believes “it’s possible to implement this concept in a way that not only enhances privacy online but also fosters free expression for all.”
Rosen told The Privacy Advisor freedom of expression is exactly what’s at stake.
“I think the proposal is so broadly drafted that it could require search engines to remove a lot of speech that they currently assume is protected on the net, and uncertainty about whether they could be liable up to one percent of their income might well lead them to remove even more speech that the proposal requires,” Rosen said.
Additionally, Rosen said the companies concerned aren’t staffed to make judgment calls on what material should be taken down upon a user’s request and which is exempted from the law because it falls under the right to “freedom of expression” or for reasons of “public interest in the area of public health” or for “historical, statistical and scientific research purposes,” as the proposal provides.
“Right now, the first responders at Google and Facebook who will decide whether or not to take down the request tend to be 17-year-olds in flip flops in Silicon Valley--not people who have the resources or training to be making these case-by-case decisions,” Rosen said.
Meanwhile, Rigaudias said third-party posts should be taken into consideration.
Gilbert wants to see clarifications from the EC on what the provision aims to achieve at its core.
“I see a pretty significant disconnect between the speeches that Ms. Reding has made or representatives of the European Commission have made about what this proposal is supposed to be doing and what the text of the actual proposal says,” Gilbert said.
Experts seem to agree that the current proposal needs some tweaking before it’s ready for the books.
“From a legal perspective, there is a need to revisit these clauses to make them more technically practicable in a complex digital environment, to specify their exact scope of application and make sure they are aligned with other fundamental or individual rights. I think some clarifications could be taken from recent speeches of Vice-President Reding and included in the draft which definitely needs additional specifications to make compliance with the rule more attainable in practice” said Van Overstraeten. “Businesses need certainty," he added.
“The proposal needs to be revised,” Rosen said. “I’m frankly surprised that in the face of vigorous criticisms, Viviane Reding has not narrowed the proposal to what she originally suggested, and I hope that she will. There are certainly lots of people who are concerned about this.”
Tanguy Van Overstraeten, Partner at Linklaters in Brussels, said the right to be forgotten has been proposed to reinforce existing rights because there was a perception that these rights weren’t sufficient.
“The aim was not to significantly change the reality on the ground but the way the proposed provisions are drafted may have completely unintended and adverse consequences,” Van Overstraeten says.
Others say the provision will have major repercussions. George Washington Law Professor and legal commentator Jeff Rosen wrote for Stanford Law Review, for example, that despite European Commission Vice President Viviane Reding’s assertion that the right is a “modest expansion of existing data privacy rights,” in fact, “it represents the biggest threat to free speech on the Internet in the coming decade.”
Stakeholders have expressed particular concern with the proposal’s assertion that search engines and social media networks are defined in the draft as data controllers of the content users post and store on their sites.
Facebook UK Public Policy Director Simon Milner has said the proposal is troubling because “It is a right that someone can delete what they have posted but should not be able to delete what someone has posted about you.”
Vint Cerf, one of the co-founders of the Internet, has condemned the right to be forgotten provision, citing its impracticality. “It’s very, very hard to get the Internet to forget things that you don’t want it to remember because it’s easy to download and copy and re-upload files again later,” Cerf told The Daily Telegraph.
Van Overstraeten said the provision should at least draw a line between user-generated content—information a user voluntarily posts to a website, for example—and information posted by a third party.
User-generated content “should in principle be under your control. As a result, you may be entitled, to the extent of course it is still feasible, to have that information deleted if you decide at some point in time it is no longer suitable,” Van Overstraeten said. “On the other hand, the information that comes from third parties like information containing personal data posted by a journalist should remain subject to other individual rights such as the right of reply. In my opinion, there is no way the right to be forgotten could be exercised in that context.”
Spanish attorney Cecilia Alvarez Rigaudias of Uría Menéndez agreed.
“You may have other content posted by your family, friends or others, which at the end of the day may cause harm to you. This could also be the newspaper or media where the freedom of expression and freedom of speech, as fundamental freedoms, must be balanced vis-à-vis privacy,” she said. “There also could be situations where the legislation obliges to publish certain information like in judicial rulings, or information which is published in the official gazette in order to provide relevant information to the market, and therefore it’s difficult to assess whether you really have a “right to be forgotten” just because you do not want this to be available.”
Françoise Gilbert of IT Law Group adds that in the U.S., companies are “scratching their heads and saying, ‘How are we going to do this? We don’t think this is feasible at the very basic technical level.’”
Most troubling to her clients is the provision’s requirements that in the case of an individual’s request to remove data concerning him or her, “the entity not only has to remove the information but also has to contact third parties and tell them to remove the information. It’s very difficult to implement,” Gilbert said. “Only removing someone’s information can be difficult because, in one context, the information can be in many places. On top of that, you have to contact third parties.”
Ahead of the draft provision, courts in several jurisdictions have heard arguments based on varying interpretations of the right to be forgotten. In March, the UK government called for legislation that would force Internet companies to “proactively filter search results and require court-ordered material to be suppressed,” Deutsche Welle reported. In the same month, a Tokyo District Court approved a petition to require Google to delete terms from its auto-complete search feature after a man alleged the feature resulted in the loss of his employment. Earlier this year, the BBC unveiled a digital charter that will allow users of its web services to have all of their data deleted, and Spain’s government ordered Google to halt indexing of data on certain individuals after 90 complaints to Spain’s Data Protection Agency, a move Google said would have a “profound chilling effect on free expression without protecting people’s privacy,” according to The New York Times.
Also in March, a “right to be forgotten” case was dismissed by a Spanish court. A company argued online images harmed its reputation, but the court ruled that Google Spain “lacked standing to be sued” because it is a subsidiary.
Search engines are especially concerned with their level of responsibility under the draft proposal, according to Rigaudias.
“With respect to the fact that they don’t want to create precedent, they do not want to be held liable as intermediaries of information society services regarding contents that they have not created. I think they could be more worried and concerned about this specific issue than the data protection questions that are under discussion.”
Rigaudias said her clients feel “there is an overreaction with respect to the right to be forgotten, because the right to obtain a certain cancellation of data already exists in the data protection regulation since 1992.”
In a blog post, Google Chief Privacy Counsel Peter Fleischer wrote that because the Internet’s vitality shows no signs of slowing down, it is “vitally important that both those who provide online services and those who use them have a clear understanding of how a concept such as the right to be forgotten might apply.”
Fleischer noted there are practical and technical barriers to hosting platforms’ ability to comply with some of the proposal’s provisions, including the timeframe in which a platform must comply with a user’s request for data deletion and the expectation that a platform will ensure third-party compliance with data deletion. However, in the end, he said Google is “supportive of the principles behind the right to be forgotten” and believes “it’s possible to implement this concept in a way that not only enhances privacy online but also fosters free expression for all.”
Rosen told The Privacy Advisor freedom of expression is exactly what’s at stake.
“I think the proposal is so broadly drafted that it could require search engines to remove a lot of speech that they currently assume is protected on the net, and uncertainty about whether they could be liable up to one percent of their income might well lead them to remove even more speech that the proposal requires,” Rosen said.
Additionally, Rosen said the companies concerned aren’t staffed to make judgment calls on what material should be taken down upon a user’s request and which is exempted from the law because it falls under the right to “freedom of expression” or for reasons of “public interest in the area of public health” or for “historical, statistical and scientific research purposes,” as the proposal provides.
“Right now, the first responders at Google and Facebook who will decide whether or not to take down the request tend to be 17-year-olds in flip flops in Silicon Valley--not people who have the resources or training to be making these case-by-case decisions,” Rosen said.
Meanwhile, Rigaudias said third-party posts should be taken into consideration.
Gilbert wants to see clarifications from the EC on what the provision aims to achieve at its core.
“I see a pretty significant disconnect between the speeches that Ms. Reding has made or representatives of the European Commission have made about what this proposal is supposed to be doing and what the text of the actual proposal says,” Gilbert said.
Experts seem to agree that the current proposal needs some tweaking before it’s ready for the books.
“From a legal perspective, there is a need to revisit these clauses to make them more technically practicable in a complex digital environment, to specify their exact scope of application and make sure they are aligned with other fundamental or individual rights. I think some clarifications could be taken from recent speeches of Vice-President Reding and included in the draft which definitely needs additional specifications to make compliance with the rule more attainable in practice” said Van Overstraeten. “Businesses need certainty," he added.
“The proposal needs to be revised,” Rosen said. “I’m frankly surprised that in the face of vigorous criticisms, Viviane Reding has not narrowed the proposal to what she originally suggested, and I hope that she will. There are certainly lots of people who are concerned about this.”
