The European Commission concept proposal for a data protection regulation contains the so-called right to be forgotten in Article 15. This is not a surprise but the way it has been drafted is quite terrible as I will try to explain below.
Commissioner Viviane Reding made a right to be forgotten into one of the central themes of the privacy directive‘s review of the last two years and her plans to modernize the existing legal framework for the processing of personal data in the EU. While there are some valuable improvements to the existing data protection rules in the EC’s concept proposal, this right to be forgotten is amongst the worst legal inventions I have ever encountered. Below I first shortly discuss the proposal and give 9 reasons why it is really wrong and why it should be abolished.
The basic principle of the ‘right to be forgotten’ is that data subjects can ask for deletion of personal data. This right to be forgotten is an extension of the existing right of erasure with regard to personal data processing in Article 12 of the Privacy Directive, and specifically targets personal data which have been made public, such as the name or picture of a natural person on a discussion forum. It also extends to links to publications containing personal data, for instance in search engines. The proposed right in Article 15 reads as follows:
Article 15 Right to be forgotten and to erasure
1. The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data where:
(a) the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed; or
(b) the data subject withdraws consent on which the processing is based according to Article 5(1)(a), or when the storage period consented to has expired; or
(c) the data subject objects to the processing of personal data pursuant to Article 17; or
(d) their processing otherwise does not comply with this Regulation.
This right shall apply especially in relation to personal data which are made available by the data subject while he or she was a child.
2. Where the controller referred to in paragraph 1 has made the data public, it shall in particular ensure the erasure of any public Internet link to, copy of, or replication of the personal data relating to the data subject contained in any publicly available communication service which allows or facilitates the search of or access to this personal data.
3. The controller shall carry out the erasure without delay, except to the extent that the retention of the personal data is necessary:
(a) for exercising the right of freedom of expression in accordance with Article 79; or
(b) for historical, statistical and scientific research purposes in accordance with Article 83; or
(c) for compliance with a legal obligation to retain the data by Union or Member State law to which the controller is subject; this law shall meet an objective of public interest, respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued; or
(d) in the cases referred to in paragraph 4.
4. Instead of erasure, the controller shall restrict processing of personal data where:
(a) their accuracy is contested by the data subject, for a period enabling the controller to verify the accuracy of the data
(b) the controller no longer needs them for the accomplishment of its task but they have to be maintained for purposes of proof;
(c) the processing is unlawful and the data subject opposes their erasure and requests the restriction of their use instead;
(d) the data subject requests to transmit the personal data into another automated processing system in accordance with Article 16(2).
5. Personal data referred to in paragraph 4 may, with the exception of storage, only be processed for purposes of proof, or with the data subject’s consent, or for the protection of the rights of another natural or legal person or for an objective of public interest.
6. Where processing of personal data is restricted pursuant to paragraph 4, the controller shall inform the data subject before lifting the restriction on processing.
7. The controller shall implement mechanisms to ensure that the time limits established for the erasure of personal data and for a periodic review of the need for the storage of the data are observed.
8. Where the erasure is carried out, the controller shall not otherwise process such personal data.
9. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying:
(a) the criteria and requirements for the application of paragraph 1 for specific sectors and in specific data processing situations;
(b) the criteria for deleting public Internet links, copies or replications of personal data from publicly available communication service as referred to in paragraph 2;
(c) the criteria and conditions as regards personal data identified for the purpose of restricting its processing as referred to in paragraph 4.
In case that some party does not comply with the right to be forgotten, Article 79 provides for a possibly hefty fine by Data Protection Authorities:
Article 79 Administrative sanctions
3. The supervisory authority shall impose a fine between 500 EUR and 600 000 EUR, or in case of an enterprise up to 3 % of its annual worldwide turnover, to anyone who, intentionally or negligently
(c) does not comply with the right to be forgotten or to erasure, or fails to put mechanisms in place to ensure that the time limits are observed or does not erase any public Internet link to, copy of, or replication of the personal data relating to the data subject contained in a publicly available communication service pursuant Article 15.
So what is wrong about this right to be forgotten ( if that isn’t already clear from reading the text of the proposal)? Let me list 9 reasons why this proposal looks like a terrible idea:
1. A right to be forgotten with regard to public information is anti-historical. The idea is that the further dissemination of publications of personal data becomes problematic because they have merely historical value. In very specific cases this can arguably make sense. In some European jurisdictions, Germany for instance, there is what could be called a ‘interest to be forgotten’ for criminals that have had their share of punishment and need to reintegrate into society. But careful balancing needs to take place in such contexts as well. The regulation contains a reference to processing for historical purposes, for instance in recital 46, but this reference is way too vague.
2. A right to be forgotten actually doesn’t exist. The existing right to erasure was never absolute in the first place. It is merely the expression of the general principle of purpose limitation that underlies many of the data protection rules. If a company of government agency processes personal data about you, it needs a legitimate reason to do that. If they no longer have that reason it follows they need to stop processing the data and the ‘right to erasure’ gives you a specific legal provision to ask them to do so. To call this a right is an overstatement and gives the wrong impression to those that want information deleted as well as those that would like to keep it public. To improve data protection law through the addition of welcome overstatements is quite generally misguided. There are arange of other provisions in the proposal and exieting rules that suffer the same deficit, such as the prohibition of automated decision making.
3. A right to be forgotten wrongly treats freedom of expression as an exception in relation to the right to privacy. Article 15 states the right to be forgotten as the rule. The interest of communicating about others publicly, which notably includes public figures, celebrities, etc…, is tailored as an exception. Under the proposal, the burden of proof is placed on the one that publishes information and one needs to defend engaging in such communications on the basis that they are necessary to exercise one’s right to free speech, instead of justified. From a European perspective, this does not respect the need to provide for a balance between the competing interests that are typically at stake. (Notably, from a U.S. perspective and the First Amendment, the proposal is even more problematic.) Relatedly, it strengthens the idea that there is a right to control one’s image and reputation in public and the idea that conflicts over making information about others public should be legally resolved through a system of granting rights to control over information flows. This is clearly a short-cut that oversimplifies the values that are at stake in the context of publicity of and about natural persons.
4. A right to be be forgotten will be a tool for censorship. It will strengthen those that want to censor the Web instead of helping those with justified claims to have their personal information removed. The right that is being created is a stick to hit with, the strength of which will heavily depend on the financial means to enter into a legal fight about prolonged publicity of personal information on the Internet. It will be used most effectively by those that have the strongest interest in cleaning up their reputation online.
5. A right to be forgotten strengthens the questionable role of data protection law in the context of public information and networked media. Notably, what is new in the proposal, in comparison with the existing right of erasure of personal data, is that it specifically targets public information. While data protection law has developed in reaction to the use of automated personal data processing systems for government, administrative, and business decision making, it has slowly but steadily extended into the realm of public information and the media, due to the open ended nature of its definitions and the lack of a proper restriction for the public information environment. Unfortunately, the new proposal does nothing to stop this extension of a priori legal regulation of making information about others public. The exception for the media and freedom of expression in Article 81 remains narrow and many of the rules still apply. It also leaves a problematic amount of space to the Member States to interpret the scope of the exception. It is unclear to what extent search engines, social networks, internet archives and non-professional Web publishers such as bloggers or social network users fall under the exception. Data protection law includes a range of rules and principles that apply to any processing of personal data. To apply this legal framework to the media and other contributors to the public information environment is like making journalistic ethics into actual legal rules. This legal prescription of fair treatment of others in public communications violates the principle of free speech.
6. A right to be forgotten as proposed is a frontal attack on linking, search and archiving. Article 15, second paragraph contains the heart of the attack on publicity that is being proposed in the new regulation. The idea is that data subjects should have a right to claim the removal of all sorts of links to ‘their’ personal data on the Internet. It is no surprise that linking and search are being targeted specifically. These services are fundamental to establishing robust publicity in an information environment characterized by abundance. While the provision does not explicitly establish obligations for third parties (not the source of the publication) such as search engines to remove links to personal information, it is important to realize that the regulation does not resolve whether these third parties can be considered controllers themselves.
7. The proposal includes the threat of a fine, which can go up to millions and millions of Euros. While a right to be forgotten does not actually exist and would be legally problematic due to competing fundamental legal principles, the threat of a hefty fine may help to bring it into existence in practice. The chilling effects of fining those that do not comply with the ‘right to be forgotten’ or can be considered negligent in this respect are predictable. Imagine running a blog in a way that extends what is traditionally considered as journalism. Or consider running an association, which tends to publish its proceedings of the yearly general assembly online in view of the value it attributes to transparency. Or consider running a music fan-site with a forum with discussions about concerts and related matters. Clearly, such publications will sometimes contain information related to others. Now consider receiving a letter of an attorney of a now public figure that wants to see information removed and points out you can be fined between 500 and 600.000 EURO if you would fail to defend the prolonged publication of the now historical information in question.
8. A right to be forgotten will chill publishers into restricting access to potentially controversial material. The provision, and the threat of a fine, will incentivize web publishers to limit access to controversial information for search engines. Web publishers can prevent running into claims of a right to be forgotten by restricting access for search engines to publications containing personal data, for instance by using robots.txt. Can this sometimes be a good idea? Perhaps, but clearly the information remains accessible for Web users, even though they may not find it so easily. Can this be a bad idea? Of course, it will incentivize Web publishers that would like to open up their offering as widely as possible to restrict its findability elsewhere, thereby producing a bias towards uncontroversial information in search engines and related services.
9. It is reactionary and fashionable. A right to be forgotten alligns with reactionary sentiments about new forms of publicty made possible by the Internet. If there is any support to be found for this right to be forgotten, it must be amongst those who consider the relative uncontrolled nature of such communications as a threat perse. In addition, European politicians may be charmed by the idea of showing their teeth and passing a provision that they understand as actually protecting people’s privacy online. Finally, a right to be forgotten! Hopefully, they will in time start to understand the highly problematic nature of this proposal.