|
Law in the Internet Society
|
|
The Right to be forgotten-- By RemicardSereme - 13 January 2021 This essay focuses on the « right to be forgotten » guaranteed to citizens of European Union Member States. This idea came to me during one of our discussions on the usefulness of regulations as a tool to protect privacy on the net. I wanted to take a look at some of the regulations passed by the European Union, as it has been particularly active and vocal on these issues these past few years, especially with the General Data Protection Regulation (GDPR). The right to be forgotten struck me as a good case study because of all the debate which has surrounded it since it came into being in 2014. I aim to make a brief inquiry into what exactly is this right, how it came to be, and the extent of its effectiveness three-quarters of a decade later.I. The History of the “right to be forgotten"The right to erasure, commonly referred to as “the right to be forgotten”, is guaranteed in Article 17 of the GDPR. It provides a right for individuals to “to obtain from the controller the erasure of personal data concerning him or her without undue delay”. This right is, however, not an absolute one, it can only be exercised in a list of specific circumstances and is subject to several exceptions. The right to be forgotten as inscribed in the GDPR was established by the Court of Justice of the European Union (ECJ) Google Spain SL and Google Inc judgment in 2014. The ECJ held that European citizens can request that search engines, like Google, delist certain links from their search index if the results contain personal information that is « inadequate, irrelevant, or no longer relevant, or excessive ». Before that, it was actually introduced in early 2012 during a press conference by Viviane Reding, the former European Commissioner for Justice, Fundamental Rights, and Citizenship. She affirmed that “people shall have the right - and not the “possibility” - to withdraw their consent to the processing of the personal data they have given out themselves”. However, it seems that the Commission as a whole wasn’t necessarily on board with this affirmation as they made an observation to the ECJ in the Google Spain case, explaining that “Article 14 of Directive 95/46 confer rights upon data subjects only if the processing in question is incompatible with the directive or on compelling legitimate grounds relating to their particular situation, and not merely because they consider that that processing may be prejudicial to them or they wish that the data being processed sink into oblivion.” However, following the Court’s decision in 2014 and general public worry over data privacy within the EU, the right to be forgotten ended-up being made into law anyway as a right to de-indexing, which is quite different, but is designated under the same name because of the instant and resounding success of “the right to be forgotten” as a slogan to answer the mounting anxieties within the EU about the potential harm that can be caused by information stored and searchable on the internet.II. An Illusory RightThree-quarters of a decade later, “the right to be forgotten” has gained some traction around the world. In 2015, Russia enacted its own “right to be forgotten” bill, it has been recognized to some extent in Turkey and is currently being debated in India. It has been successfully invoked in a few cases: a dutch surgeon obtained the deletion of certain links to websites containing an unofficial blacklist of healthcare professionals on which she was listed; the ECtHR ruled that an order by Belgian national courts to a Belgian newspaper to anonymize the name of the driver for a fatal accident in 1994 in an article included in the newspaper’s digital archives on the basis of the right to be forgotten, didn’t constitute a violation of the publisher’s right to freedom of expression under Article 10 ECHR. However, more often than not these cases don’t go to court or are unsuccessful like in the M.L. and W.W. v. Germany case. The best argument for this “right to delisting” is to empower people who are harmed or distressed by information about them on the internet and don’t have the means to hire lawyers and allow them to obtain a certain form of remedy. However, it can hardly be argued that this regulation achieves that goal. Shortly after the 2014 decision, Google set up a web form that allows people to signal links which they want to be taken down and why. However, Google barely shares any statistics about how many complaints it has processed and enjoys broad discretion on how to decide these cases. Furthermore, in a 2019 case opposing Google and the CNIL, the top data-protection regulator in France, the ECJ ruled that Art 17 GDPR cannot be enforced outside of the European Union, which means that one only needs to search on Google.com for the de-listed link in Europe to be accessible. Final Thoughts We can therefore conclude that the right to be forgotten hasn’t and wasn’t meant to achieve any great strides to protect privacy on the net for European citizens. It only achieved to make search engines like Google the ultimate arbiters of privacy, without any oversight, even though ironically enough the whole point of this regulation was to respond to anti-Google sentiment within the EU. I believe that rather than a “right to be forgotten”, the EU should enact a “right to be remembered” which would require users to opt-in for being tracked and for companies to store their personal information. The idea would be to promote a net without surveillance, but I am aware that it is not within the powers of the EU to do so as they have no real control over the major players of the net like Google.
|
|
