Can the Internet Forget? – Rhe Eight to be Forgotten in the EU Law and its Actual Impact on the Internet. Comparison of the Approaches Towards the Notion and Assessment of its Effectiveness
| Jun 11, 2020
Published Online: Jun 11, 2020
Page range: 86 - 101
DOI: https://doi.org/10.2478/wrlae-2019-0006
Keywords
© 2019 Aleksandra Gebuza, published by Sciendo
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.
Nowadays, information has become one of the most important and valuable objects of commercial trade. Increased accessibility to information resulted in mass gathering and storing personal data for private purposes. This also caused privacy rights to be violated more frequently. The often-repeated phrase that perfectly describes this phenomenon is once we post the information on the Internet, it will stay there forever. What is more, these data often used without the knowledge of the data subject might be harmful to one's reputation, professional life or private relations. Particular countries attempted on finding a solution to such threats, unfortunately with little effect. The first legal instrument, which changed the approach to privacy on the Internet and raised further discussion in this matter, was introduced by the European Union in May 2014 as the right to be forgotten.
The right to be forgotten was for the first time implicitly introduced in Article 17 of the General Data Protection Regulation, which came into force on 25 May 2018 Regulation (EU) 2016/679 of the European Parliament of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (2016) OJ l 119/1 [hereinafter: “General Data Protection Regulation” or “GDPR”]. Case-131/12,
In the article, the author attempts to present the effects of the abovementioned debate and potential solutions for bigger effectiveness of the aforementioned right. First, a critical assessment of this right having considered violations of the freedom of speech will be presented. Then, the author will present a supportive approach arguing that the right is an inevitable tool necessary to protect individuals’ privacy on the Web and sets the balance between interests of all parties. By comparing various approaches, including European and American doctrine and jurisprudence, the author attempts to provide an analysis of the proposed solutions. Consequently, the author assesses whether the legal measures applied by the European Union are sufficient to ensure security of the EU residents or whether the right to be forgotten is just a utopian wish.
By juxtaposing the articles presented by the American and European doctrines, it has emerged that the majority of the articles published in the United States presented criticism towards the notion of the right to be forgotten. Contrary views had been developed by the European doctrine. Still, one should not treat the given division literally, because it only represents tendency of the majority in the United States and the European Union.
The right to be forgotten has been criticised by the representatives of the American doctrine, jurisprudence and journalists, considering the potential breaches of the freedom of speech. The judgement for Eltis Karen, ‘The Anglo-American/Continental Privacy Divide? How Civilian Personality Rights Can Help Reconceptualise the “Right to be Forgotten” Towards Greater Transnational Interoperability’ (2016) 94 La Revue du Barreau Canadien 355, 360. Micheal L Rustad and Sanna Kulevska, ‘Reconceptualizing the Right to be Forgotten to Enable Transatlantic Data Flow’ (2015) 28 Harvard Journal Law & Technology 349, 350, 355.
In order to fully understand the reason of the negative approach towards the judgement of the CJEU, one should consider the development of the right to freedom of speech and the right to privacy in the United States.
Since the founding fathers, American constitutional jurisprudence has strongly protected the principle enshrined in the First Amendment, namely, the right to free speech. As was stated in the
Processing of personal data by the search engines can be of example. In the recent decade, this medium has become one of the major forces on the Web. However, these engines made privacy rights to be infringed on a more frequent basis.
United States’ jurisprudence has acceded to the interpretation that the choice of what is included or excluded in the engines shall be protected under the First Amendment. This is because Google's ranking of websites consists of subjective results being constitutionally protected opinions. Hugh J. McCarthy, ‘All the World's a Stage: The European Right to be Forgotten Revisited from a US Perspective’ (2016) 11 Journal of Intellectual Property Law & Practice 360, 367.
One can observe that some scholars accuse the judgement of the CJEU of diminishing the strong position of the right to free expression, which is enforced by the American Internet giants, such as Google, Yahoo or Facebook. Karen (n 3) 365–370. Ibid.
Shortly after publishing the judgement, strong criticism emerged in newspapers as well. The article published on Editorial Board, ‘UnGoogled: The Disastrous Results of the ‘Right to be Forgotten’ Ruling’ (2014) The Washington Post, <
The possibility of requesting any information to be deleted from databases may impact the accountability and the free speech. Erin Cooper, ‘Following in the European Union's Footsteps: Why the United States Should Adopt Its Own Right to Be Forgotten Law for Crime Victims’ (2015) 32 Journal of Information Technology & Privacy Law 185, 199.
The application of the principles under the Charter of Fundamental Rights of the European Union may also be criticised in the light of potential scope of application and transparency. It is necessary to cite the opinion of the Privacy Commissioner of Ontario, Ann Cavoukian, and co-chair of the Future of Privacy Forum, Christopher Wolf, who stated that the CJEU focused on the right to privacy and the protection of personal data enshrined in the Charter, without analysing the right to freedom of expression. Ann Cavoukian, and Christopher Wolf, ‘Sorry, But There's Online Right to be Forgotten’ (2014) National Post, < Christopher Wolf, ‘Impact of the CJEU's Right to be Forgotten. Decision on Search Engines and Other Service Providers in Europe’ (2014) 21 Maastricht Journal of European and Comparative Law 547, 553.
Even the Advocate General in its Opinion to the Case-131/12, Cavoukian and Wolf (n 13). Rustad and Kulevska (n 4) 372. Caroline Preece et al., ‘Google “Right to be Forgotten”: Everything You Need to Know’ [website], (2015) IT Pro, < Cunnigham McKay, ‘Free Expression, Privacy and Diminishing Sovereignty in the Information Age: The Internationalization of Censorship’ (2016) 69 Arkansas Law Review 71, 114.
The
This can be seen especially in the ruling of an Italian court, where the Privacy Authority reinforced the understanding of the fair balance test by stating, that the right to be forgotten shall be balanced with the freedom of the press, being strongly connected to the freedom of information. On 31 March 2015, the authority issued a decision in which it claimed that individuals cannot request delisting of search results concerning the recent news with relevant public interest. Decision No. 618 of Garante per la Protezione dei Dati Personali of (2014) (Italy), < Ibid. Ibid. Ibid.
The CJEU has developed a fair balance test in the
The test established in the Article 51, Charter of Fundamental Rights of the European Union [2012] OJ CHA2012/C 326/02, [hereinafter: Charter of Fundamental Rights of the European Union]; See also: Article 7 and 8 of Charter of Fundamental Rights of the European Union.
However, the fair balance test provided by the CJEU has met with the criticism. It has been due to its vagueness, which creates serious issues when it comes to execution.
The notion is accused of being too broad, allowing for too many individuals to request removal of their personal data and, at the same time, largely affecting free speech rights. Cooper (n 12) 199. European Parliament and Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of the personal data and on the free movement of such data, [1995] OJ L 281/31. Ibid. Editorial Board (n 11).
The question concerning the accountability arises again, as the lack of full transparency of the private companies’ actions causes that it is impossible to assess at which point the removal becomes balanced in the requester's favour. Cooper (n 12) 199–200.
The borderless nature of information's flow on the Internet is not without the significance, because it eludes traditional territorial-based jurisdiction and enforcement. Miriam Wugmeister, Karin Retzer, and Cynthia Rich, ‘Global Solution for Cross-Border Data Transfers: Making the Case for Corporate Privacy Rules’ (2007) 38 Georgetown Journal of International Law 449, 475–476. Shaffer Gregory, ‘Globalization and Social Protection: The Impact of EU and International Rules in the Ratcheting Up of U. S. Privacy Standards’ (2000) 25 Yale Journal of International Law 1, 6.
It has to be noted that information goes through unpredictable routes, and for this reason, it may be very elusive to find its origins, because the data are often augmented, duplicated or altered. Cunningham McKay ‘Privacy Law That Does Not Protect Privacy, Forgetting the Right to Be Forgotten’ (2017) 65 Buffalo Law Review 495, 503. Ibid.
What is more, it is not hard to track origin of search results processed by Google, but in case of small websites that are operated by anonymous persons, it is not that easy. Therefore, a fully effective legal instrument could be created only by the international public law.
However, at the moment, such vision seems to be highly unlikely. At present, no international law that applies outside of the EU territory contains explicit provisions concerning the right to be forgotten. Enactment of such rules would be extremely difficult, because of huge differences in each country's fundamental values, constitutional principles, legislation and case law. Julia Kerr, ‘What Is a Search Engine: The Simple Question the Court of Justice of the European Union Forgot to Ask and What It Means for the Future of the Right to Be Forgotten’ (2016) 17 Chicago Journal of International Law 217, 232.
It is quite often argued that the judgement of the CJEU has reinforced the right to private and family life stemming from Article 7 and the right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights of the European Union Article 7 and 8, Charter of Fundamental Rights of the European Union.
The policy behind the creation of the right to be forgotten is in overall beneficial to society, because it gives to the EU citizens an opportunity for a fresh slate. This comes without the old and prejudicial information affecting their lives, which, at the same time, are irrelevant towards the public interest. Cooper (n 12) 198. Julia Powles, and Enrique Chaparro, ‘How Google Determined Our Right to be Forgotten’ (2015) The Guardian, <
Moreover, publication of certain information online can be not only breaching their privacy but also might be detrimental to their lives. Once more it should be underlined that when information is put on the Internet, it can stay there forever. The removal process is, therefore, crucial, because it allows people to remove potentially harmful information. Cooper (n 12) 198; see also: Ted Claypoole, Theresa Payton, ‘Protecting Your Internet Identity: Are You Naked Online? Rowman & Littlefield, 2017, 1–11.
The critics of the Kulk Stefan, and Frederik Zuiderveen Borgesius, ‘Google Spain v. Gonzalez: Did the Court Forget About Freedom of Expression?’ (2014) 5 European Journal of Risk Regulation 389, 395–396.
The CJEU clearly stated that the person's right to privacy in general overrides ‘as a rule, not only the economic interest of the operator of the search engine, but also the interest of the general public’.
As Giancarlo Frosio stated, ‘privacy itself is censorship and stands in contradiction with freedom of expression’. Giancarlo F Frosio, ‘The Right to Be Forgotten: Much Ado About Nothing’ (2017) 15 Colorado Technology Law Jorunal 307, 315. Ibid. Ibid.
What is more, the CJEU considered the freedom of expression as one of the pre-requisites on implementing the right to be forgotten. Frosio (n 42) 316.
In fact, when some information has a minimal value for the society, but its publication may deeply infringe someone's privacy, there are no grounds to claim that the freedom of speech is infringed. The literal interpretation of the right to free speech is deeply hampering the right to privacy (not less important). That is why in the case of the right to be forgotten so crucial is a provision of balance.
The ruling of the Highest National Court in Belgium from 29 April 2016 can be of an example. In this ruling, the Belgian court analysed when the right to be forgotten shall prevail over the freedom of speech. In that case, defendant – newspaper Judgement of Cour de Cassation of 29 April 2016, (C.15.0052.F.), (Belgium), par. 1. Ibid.
The Highest National Court acceded to the arguments presented by the plaintiff and obliged the newspaper to remove the name of the driver from the article. Whilst rendering the ruling, the Belgian Court has made a reference to the Ibid., par. 4. Ibid., par. 6–9.
One cannot state that the CJEU by rendering the decision in the
After the judgement, the EU officials tried to face the challenges set by the borderless flow of information by adopting the General Data Protection Regulation. The main aim of implementing this new regulation was to protect – to the maximum possible extent – the privacy of personal data, including the flow of information outside the European Union.
In order to achieve these goals, it was decided that the maladjustment to the data protection rules shall have financial consequences. Article 58, GDPR. European Commission, Article 3 (1), GDPR. Dan Jerker B. Svantesson, ‘Extraterritoriality in the context of Data Privacy Regulation’, (2013) 7(1) Masaryk University Journal of Law and Technology 87, 90.
What is more, in order to prevent the flow of personal data to countries, where adequate safeguards of data protection rules are not met, GDPR prohibits the transfer of data, unless the country meets the EU law's standard. Article 41, GDPR. European Commission,
The above-mentioned provision constitutes an attempt on regulating the ‘sofar’ unsettled issue of the uncontrolled flow of the information on the Web. The judgement of the CJEU and the GDPR provide for more effective means of executing the right to privacy. Indeed, the
In fact, the full protection of the right to be forgotten could be provided only by the international law. Julia Kerr saw the possibility of developing this institution within the international community by applying the existing international treaties, which could incorporate the right to be forgotten and act as baselines on which states could develop their own national systems. Kerr (n 35) 232. Ibid., p. 232–233; see also: Article 17, ICCPR.
Still, the solutions proposed by the EU law may become a kind of the model law for countries, which are developing their interest in creating elevated rules on privacy law on the Web. The tendency observed by the scholars concerning privacy law of Germany can be seen as an example. Germany is perceived as a pioneer and champion in recognising the privacy rights. In accordance with Marc Rotenberg, other countries that observed the developments in German law adopted similar solutions in their domestic legal systems. Marc Rotenberg, ‘Preserving Privacy in the Information Society’, (2000) Chelsea E Carbone, ‘To be or not to be Forgotten: Balancing The Right to know with the Right to Privacy in the Digital Age’ (2015) 22 Virginia Journal of Social Policy & Law, 545.
Thomas Webb stated in his Article on hate speech that ‘when the fundamental rights compete, many States protect human dignity and privacy rights at the expense of unrestrained speech’. Thomas J Webb, ‘Verbal Poison – Criminalizing Hate Speech: A Comparative Analysis and a Proposal for the American System’ (2011) 50 Washburn Law Journal 445. Olivia Solon, Robert S Sandler,
The right to be forgotten is undoubtedly essential for the protection of privacy on the Web. However, its shape is still far from perfection. Digitalisation of data, easy retrieval, cheap storage and jurisdictional uncertainties causes that our privacy is nowadays more endangered than even before.
The
However, the fair balance test provided by the CJEU, which aims in safeguarding the equilibrium between the right to privacy and freedom of expression, is vague and brings uncertainties when applied. The introduction of the GDPR did not resolve the issue of the vagueness of the fair balance test, but it still somehow ensured and secured the application of the above-mentioned right towards the EU residents.
It should be also noted that by introducing this right, a discussion on censorship on the Internet emerged. These fears should be considered in part as unfounded. The judgment neither violates the right to freedom of expression and information nor allows for potential breaches of the freedoms in the future. On the contrary, by creating the fair balance test, the CJEU levelled out the application of both fundamental freedoms. Indeed, still some national authorities may wrongly interpret the right to be forgotten and cause potential infringement to the freedom of expression. However, the same situation may occur as for hampering privacy. The decision of the Italian national authority may be seen as an example. The fair balance test may seem an imperfect solution when it comes to implementation of this institution. Although one cannot provide for precise laws, in case of the fundamental laws, they are inherently general and broad in their scope.
The perfect solution would be the development of an international accord, which would set minimum and uniform standards for protecting the fundamental rights. However, at present time, this scenario seems unrealistic.
The right to be forgotten does not solve all the issues connected with privacy online. Nevertheless, the introduction of the right into the EU law initiated a discussion on implementing it in domestic legal systems beyond the borders of the EU. In countries such as South Korea, China and India, legislative bodies have started to analyse the right to be forgotten, in order to introduce it into their national laws. In other countries, such as the United States and Canada, it launched a debate on the need of such right. The voices of criticism, however, weakened because of the recent news on data leaks. The most recent of them, that is, the Cambridge Analytica leakage, proves that unlimited and unregulated access to personal data on the Internet results in an immense violation of the right to privacy of persons, whose personal data became object of commercial trade.
Therefore, the establishment of effective privacy laws applied also on the Internet should not be perceived as a threat towards the freedom to expression and information but as an attempt to balance out both rights safeguarding interests of all.