Deplatforming

The NY Times reports on deplatforming at the Metropolitan Museum of Art, stating that the Met and the Sackler family 

jointly announced on Thursday that the Sackler name would be removed from seven exhibition spaces, including the wing that houses the Temple of Dendur. 

“Our families have always strongly supported the Met, and we believe this to be in the best interest of the museum and the important mission that it serves,” the descendants of Dr. Mortimer Sackler and Dr. Raymond Sackler said in a statement. “The earliest of these gifts were made almost 50 years ago, and now we are passing the torch to others who might wish to step forward to support the museum.” ... 

Other museums have refused Sackler money, such as the Serpentine Gallery in London, and some were quicker to remove the Sackler name, including the Louvre in Paris. But since the Met is a leader in the field, its announcement is likely to make more institutions reconsider their own Sackler galleries.  ...

The museum had already severed ties to the family’s funding, announcing in 2019 that it would no longer accept gifts from the Sacklers, given their links to the maker of OxyContin. 

Two spaces at the Met will continue to bear their Sackler names: the Arthur M. Sackler Gallery in the Asian wing and the Marietta Lutze Sackler Gallery in the Modern and contemporary wing (which will presumably carry over into its renovation). 

While the Met would not explain this, both galleries are associated with the family of Arthur Sackler, who died in 1987 before OxyContin’s creation. His side of the family, which has supported institutions like the Smithsonian and the Brooklyn Museum, sold his stake in the pharmaceutical business after his death. 

“The Met has been built by the philanthropy of generations of donors — and the Sacklers have been among our most generous supporters,” said Dan Weiss, the Met’s president and chief executive officer. “This gracious gesture by the Sacklers aids the museum in continuing to serve this and future generations. We greatly appreciate it.” 

In the immediate aftermath of the Met’s announcement, several other museums with Sackler-named spaces said they currently had no similar plans, including the National Gallery in London — where the Sackler Room contains some of the museum’s most prized works — and the Victoria & Albert Museum, whose entrance is named the Sackler Courtyard.

Obscurity

'The Right to Be Forgotten as a Fundamental Right in the UK After Brexit' by Stergios Aidinlis in (2020) 25(2) Communications Law comments

Will Brexit diminish digital rights protection in the UK or are domestic institutions better-placed to deliver such protection unencumbered by the oversight of EU institutions? This article scrutinises the validity of conflicting arguments about the future of human rights protection in the UK by reference to a paradigmatically ‘European’ digital right, the right to be forgotten (RTBF). Having considered the interplay between the multiple layers of UK law that an RTBF claim involves, the article argues that some legal implications of Brexit will have a graver impact on digital rights protection than others. In respect of EU law no longer being supreme in the UK, the analysis offered here calls for more nuance in critical arguments about losing fundamental protections when it comes to the RTBF. Brexit, however, will erode the protection of the RTBF in the longer term as a result of the loss of EU law’s direct effect. The scope of the ‘British RTBF’ will be gradually developed as ‘narrower’ compared to EU member states due to fundamental differences between the UK and European conceptions of privacy. The central place of ‘reasonable expectations’ of the data subject within the UK privacy conception, it is argued, sits at odds with social realities related to the RTBF and, thus, raises significant risks for the robust protection of the right in the future.

'The Right to Be Forgotten in the Digital Age: The Challenges of Data Protection Beyond Borders' by Federico Fabbrini and Edoardo Celeste in (2020) 21(s1) German Law Journal 55-65 comments

 This article explores the challenges of the extraterritorial application of the right to be forgotten and, more broadly, of EU data protection law in light of the recent case law of the ECJ. The paper explains that there are good arguments for the EU to apply its high data protection standards outside its borders, but that such an extraterritorial application faces challenges, as it may clash with duties of international comity, legal diversity, or contrasting rulings delivered by courts in other jurisdictions. As the article points out from a comparative perspective, the protection of privacy in the digital age increasingly exposes a tension between efforts by legal systems to impose their high standards of data protection outside their borders – a dynamic which could be regarded as ‘imperialist’ – and claims by other legal systems to assert their own power over data – a dynamic which one could name ‘sovereigntist’. As the article suggests, navigating between the Scylla of imperialism and the Charybdis of sovereigntism will not be an easy task. In this context, greater convergence in the data protection framework of liberal democratic systems worldwide appears as the preferable path to secure privacy in the digital age.

'As Darkness Deepens: The Right to be Forgotten in the Context of Authoritarian Constitutionalism' by Matthias Goldmann at 45-54 in the same issue comments

 There is no point in denying the significance of the Right to be forgotten for the state of judicial dialogue in Europe. It vindicates the position of the BVerfG as a court deserving international recognition for advancing the law in the crucial field of data protection. Nevertheless, restricting the scope of analysis to the narrow context of judicial dialogue misses the wider context of the rise of authoritarian constitutionalism in certain EU Member States. In this respect, it is of the highest significance that the decisions on the Right to be forgotten effectively eliminate the imagined normative hierarchy between domestic and EU law that provided the basis for the BVerfG’s jurisprudence ever since Solange I and Maastricht. Moreover, by reasserting the primacy of EU law, the BVerfG strengthens the position of embattled judges in Poland facing disciplinary action for implementing the primacy of EU law. The concern shown by some members of the First Senate for the situation in Poland corroborates this reading.

'Some Kind of Right' by Jud Mathews at 40-44 argues

 The Right to Be Forgotten II crystallizes one lesson from Europe’s rights revolution: persons should be able to call on some kind of right to protect their important interests whenever those interests are threatened under the law. Which rights instrument should be deployed, and by what court, become secondary concerns. The decision doubtless involves some self-aggrandizement by the German Federal Constitutional Court (GFCC), which asserts for itself a new role in protecting European fundamental rights, but it is no criticism of the Right to Be Forgotten II to say that it advances the GFCC’s role in European governance, so long as the decision also makes sense in the context of the European and German law. I argue that it does, for a specific reason. The Right to Be Forgotten II represents a sensible approach to managing the complex pluralism of the legal environment in which Germany and other EU member states find themselves. 

'Google LLC v. Commission Nationale de l’informatique et des Libertés (CNIL)' by Monika Zalnieriute in (2020) 114(2) American Journal of International Law comments

In Google LLC v CNIL, the Court of Justice of the European Union (CJEU or Court) held that the EU law only requires valid ‘right to be forgotten’ ‘de-referencing’ requests to be carried out by a search engine operator on search engine versions accessible in EU Member States, as opposed to all versions of its search engine worldwide. The ruling has been perceived as a ‘win’ for Google and other interveners, such as Microsoft and the Wikimedia Foundation, who argued against worldwide de-referencing; while the Court has been praised for its restraint in finding that the current EU law on the ‘right to be forgotten’ only applies within the EU. However, the CJEU went further and recognized the EU Parliament’s ability to extend the GDPR to apply extraterritorially and Member States’ ability to apply national de-referencing laws beyond their borders. Moreover, the CJEU appears to have reached these conclusions at the expense of the GDPR’s aims to harmonize the data protection framework across the EU. The decision allows Member States to decide individually the territorial scope of de-referencing obligations, thus creating the potential for different results based on where the requester resides. By creating the potential for national data protection authorities to apply stronger protections than those afforded by the GDPR, this decision could be seen as another brick in the ‘data privacy wall’ which the CJEU has built to protect EU citizens. This note thus argues that Google LLC v CNIL’s significance can only be understood by situating it in the broader context of CJEU’s recent data privacy decisions, which reveals the continued forcefulness of the CJEU’s stance on data protection after Snowden and Cambridge Analytica scandal.

Privacy Externalities and 'Forgetting'

'The Economic Consequences of Data Privacy Regulation: Empirical Evidence from GDPR' by Guy Aridor, Yeon-Koo Che, William Nelson and Tobias Salz comments

This paper studies the effects of the EU’s General Data Protection Regulation (GDPR) on the ability of firms to collect consumer data, identify consumers over time, accrue revenue via online advertising, and predict their behavior. Utilizing a novel dataset by an intermediary that spans much of the online travel industry, we perform a difference-in-differences analysis that exploits the geographic reach of GDPR. We find a 12.5% drop in the intermediary- observed consumers as a result of GDPR, suggesting that a nonnegligible number of consumers exercised the opt-out right enabled by GDPR. At the same time, the remaining consumers are more persistently trackable. This observed pattern is consistent with the hypothesis that privacy-conscious consumers substitute away from less efficient privacy protection (e.g, cookie deletion) to explicit opt out, a process that would reduce noise on remaining consumers and make them more trackable. Further in keeping with this hypothesis, we observe that the average value of the remaining consumers to advertisers has increased, offsetting most of the losses from consumers that opt-out. Our results highlight the externalities that consumer privacy decisions have both on other consumers and for firms.

'The European Data Protection Board’s Draft Guidelines for Search Engines and the Future of the ‘Right to be Forgotten’ Online, Part 1' by David Erdos comments

Securing workable, balanced and effective individual rights regarding personal data disseminated online is vital to the future of data protection and should be a significant focus of attention for the European Data Protection Board going forward. 

Consequent to the Court of Justice’s C-131/12 Google Spain (2014) judgment, the right to delisting and related ex post action by search engines has assumed particular practical importance. The European Data Protection Board (EDPB)’s draft guidelines on this topic – which recently closed for consultation – is, therefore, very welcome. Nevertheless, it is also vital that in due course the Board produce more comprehensive guidance. Indeed, under the General Data Protection Regulation (GDPR), it has a specific legal duty to “issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services” (GDPR, art. 70(1)(d)). This guidance will clearly need to encompass a much wider range of online actors than just search engines including individual websites, social networking sites such as Facebook and other online platforms such as Twitter. 

Nevertheless, the current Guidelines will be important starting point and so, based on what I sent into the consultation, I set out below some thoughts on the detail of the draft and how it might be improved. This is divided into the three main topics addressed: (1) the scope of the guidance and of ex post rights vis-à-vis search engines, (2) the substantive grounds for exercising these ex post rights, and (3) the substantive exemptions from these ex post rights.

Part 2 of his excellent piece is here.

Erdos' 'Disclosure, Exposure and the ʻRight to be Forgottenʼ after Google Spain: Interrogating Google Search’s Webmaster, End User and Lumen Notification Practices' (University of Cambridge Faculty of Law Research Paper No. 1/2020) argues

 Google’s essentially blanket and unsafeguarded dissemination to webmasters of URLs deindexed under the Google Spain judgment involves the disclosure of the claimant’s personal data, cannot be justified either on the purported basis of their consent or that this is legally required but instead seriously infringes European data protection standards. Disclosure of this data would only be compatible with the initially contextually sensitive context of collection where it was (i) reasonably necessary and explicitly limited to the purposes of checking the legality of the initial decision and/or bona fide research and (ii) was subject to effective safeguards that prevented any unauthorised repurposing or other use. Strict necessity thresholds would need to apply where disclosure involved special category data or was subject to reasoned objection by a data subject and international transfers would require appropriate safeguards as provided by the European Commission’s standard contractual clauses. Disclosing identifiable data on removals to end users would directly and fundamentally undermine a data subject’s rights and, therefore, ipso facto violate purpose limitation and legality, irrespective of a data subject claims rights in data protection, defamation or civil privacy. The public’s legitimate interests in receiving information on personal data removals should be secured through safeguarded scientific research that the search engines should facilitate and promote.

Obscurity

'The ‘Right to be Forgottenʼ Online within G20 Statutory Data Protection Frameworks' by David Erdos and Krzysztof Garstka comments

Although it is the EU’s General Data Protection Regulation and the Google Spain judgment which has brought the concept of the ʻright to be forgottenʼ online to the fore, this paper argues that its basic underpinnings are present in the great majority of G20 statutory frameworks. Whilst China, India, Saudi Arabia and the United States remain exceptional cases, fifteen out of nineteen (almost 80%) of G20 countries now have fully-fledged statutory data protection laws. By default, almost all of these laws empower individuals to challenge the continued dissemination of personal data not only when such data may be inaccurate but also on wider legitimacy grounds. Moreover, eleven of these countries have adopted statutory ʻintermediaryʼ shields which could help justify why certain online platforms may be required to respond to well-founded ex post challenges even if they lack most ex ante duties here. Nevertheless, the precise scope of many data protection laws online remains opaque and the relationship between such laws and freedom of expression is often unsatisfactory. Despite this, it is argued that G20 countries and G20 Data Protection Authorities should strive to achieve proportionate and effective reconciliation between online freedom of expression and ex post data protection claims, both through careful application of existing law and ultimately through and under new legislative initiatives.

Obscurity

'Search Engines and the Right to be Forgotten: Squaring the Remedy with Canadian Values on Personal Information Flow' by Andrea Slane in (2018) 55(2) Osgoode Hall Law Journal 349-347 states

The Office of the Privacy Commissioner of Canada (“OPC”) recently proposed that Canada’s private sector privacy legislation should apply in modified form to search engines. The European Union (“EU”) has required search engines to comply with its private sector data protection regime since the much-debated case regarding Google Spain in 2014. The EU and Canadian data protection authorities characterize search engines as commercial business ventures that collect, process, and package information, regardless of the public nature of their sources. Yet both also acknowledge that search engines serve important public interests by facilitating users’ search for relevant information. This article considers specifically what a Canadian right to be forgotten might look like when it is seen as an opportunity to re-balance the values at stake in information flow. This article aims to bring Canada’s existing legacy of balancing important values and interests regarding privacy and access to information to bear on our current information environment. 

Slane comments

As evidenced by slogans like ‘lest we forget’ and let ‘bygones be bygones,’ ‘remembering’ and ‘forgetting’ play important social functions: We need to both learn from history and be able to move on from the past. The right to be forgotten that has entered global public consciousness in the last few years has inspired both concerns about suppressing history1 and reminders that total remembering is both new and damaging to data subjects and communities. However, the impetus behind the right to be forgotten is less about grand social values of remembering and forgetting, and more about managing personal information flows in the digital age: It is about trying to address vast power imbalances between data subjects and various digital information brokers, including information location service providers such as search engines. 

In Canada, the Office of the Privacy Commissioner of Canada (“OPC”) recently proposed that the data protection regime governing the private sector, the Personal Information Protection and Electronic Documents Act (“PIPEDA”), should be interpreted to obligate search engines to abide by fair information principles, in particular the principles of accuracy and appropriate purposes. Applying PIPEDA to search engines would be a new practice, even though the OPC claims that it is merely applying the current legislation. As recently as 2017, it seemed that only voluntary cooperation would be requested of search engines. For example, in the Federal Court’s affirmation of the OPC findings in AT v Globe24h.com, the defendant’s website was found to have violated PIPEDA when it scraped court and tribunal documents containing personal information from publicly accessible legal databases and allowed them to be indexed by general search engines. The Federal Court issued a declaratory court order, as endorsed by the OPC, which allowed the complainant to appeal to Google to honour its voluntary search alteration policies: The court did not directly issue an order to compel Google to do so. 

The European Union (“EU”), however, already requires search engines to honour complainants’ requests to remove personal information from search results in certain circumstances. The data protection regime in the EU characterizes search engines as primarily commercial business ventures that collect, process, and package information, regardless of the public nature of their sources.  Search engine results are in this sense a product sold by the search engine company—not directly to the user, but rather to advertisers and other data brokers with an interest in search result content and compilation. If this understanding of search engine results as an information product were adopted in Canada, as currently proposed by the OPC, then a search engine company could be deemed to be subject to PIPEDA, in that it “collects, uses or discloses [personal information] in the course of commercial activities.” While the OPC has rightly suggested that it would be unreasonable to require search engines to abide by PIPEDA as a whole, in particular with regard to securing consent for all of its collection and use of personal information, there are nonetheless significant ways that PIPEDA could be applied in a workable and rights-balancing way. This article considers what a finding that search engines are subject to PIPEDA would mean, and how it could be justified and limited in a principled fashion that respects our commitment to privacy, access to information and freedom of expression. In other words, what would a Canadian right to be forgotten look like? 

The right to be forgotten is generally recognized as arising from European sensibilities regarding personality rights. European privacy and identity rights provide strong protections for individual autonomy in the domain of identity formation and presentation, giving individuals more control over how they are discussed and portrayed in public. European data protection law operates as an outgrowth of this broader and stronger protection of citizens’ identity. This commitment is rooted in European emphasis on human dignity, respect for one’s ‘private life,’ and protection from damage to one’s reputation by either government or private actors. These rights are enshrined in multiple constitutional documents of the EU, and illustrate the more general trust that European legal culture places in government regulation to protect these interests, and their distrust of private markets to do so. 

The United States, on the other hand, is often regarded as having the opposite of European sensibilities when it comes to personal information flow. In the United States, privacy is rooted in liberty rather than dignity, as a right to be ‘free from’ government interference in one’s private life, with far fewer and more limited restrictions placed on private actors. Constitutional protection for privacy only extends to unreasonable search and seizure, and any private rights to privacy are consequently derived from statute or common law and often lose out to the much stronger constitutional protection for freedom of speech, which is notoriously strong in the United States. US legal culture stresses an acute distrust of government regulation, and instead places much more trust in markets to deal with private problems. 

Canada tends to fall somewhere in between these two interpretations: Our Charter of Rights and Freedoms does not contain express protection for privacy beyond protection from unreasonable search and seizure — although Quebec’s additional Charter of human rights and freedoms does, and is closer to the European approach to privacy, using similar language in fostering respect for “private life.” However, section 1 of the Canadian Charter has allowed privacy interests to be more readily balanced against freedom of expression than in the United States, as more restrictions can be justified as reasonable in a “free and democratic society.” Canada consequently approaches some issues of personal information flow differently than the United States—for example, publication bans to protect the privacy of some crime victims are constitutionally possible in Canada but not in the US. However, Canada has not embraced personality rights to the extent that the EU has, and significant recent gains in Canada for freedom of expression (specifically regarding publication of defamatory content) illustrate that Canada places more value on freedom of expression and less on protecting reputation than Europe. Canadian law on intermediary liability for information posted online by others is also less developed than in these jurisdictions. 

Discussions about the right to be forgotten are emerging along with the rapid development of our technology-based information landscape. Real concerns about actual and potential pervasive surveillance—from government, companies, peers, and the broader public—have resulted in heightened anxiety about being able to protect one’s identity and interests. Revelations of broad government surveillance of communications, commercial entities amassing vast quantities of data about consumer behaviour (including emotional responses to various stimuli, tracking online and app-enabled interactions with others, and geo-location technologies in many portable devices), as well as the explosion of social media, have fueled these concerns. Anonymity has always been a central strategy for protecting one’s privacy online, but it is becoming increasingly difficult to remain unidentified. We all now have large dossiers with data held by various public, private, and personal actors, with little knowledge of what is in them, and how they are combined (including from both private and public sources). Proponents of the right to be forgotten are attempting to intervene against this power imbalance. 

Search engines have become the primary means by which we find information, including of course about people: We search for people we know or hear about, and occasionally check our own names. Google has emerged as the worldwide leader in online search services, credited with over 90 per cent of the global market share. Google’s success has been attributed to its algorithms, by which the company processes information gathered from publicly available webpages and delivers the results in list form to a user, partly based on the user’s previous search history. The aim is to deliver the most relevant material at the top of the list. Information presented further down the list is deemed less relevant and most people do not even look at search results beyond the first page or two. Online reputation management services have long profited from the willingness of companies and individuals to pay for techniques such as Search Engine Optimization (“SEO”) to manipulate search results so positive information rises to the top and negative information is pushed down the list. These services are expensive, however, so only wealthy individuals can benefit from this private regulation of information flow: Without a right to be forgotten, ordinary people are at the mercy of the algorithms. 

Online identity — the profile that emerges when online information connected to a person’s name or other identifier is aggregated and made available to others — has increasingly become a central component of our social and professional lives. Youth are increasingly being taught about ‘self-branding’ as an important part of educational and professional success: They understand that online identity is central to many forms of social evaluation. Lisa Austin described privacy as the regime by which we secure and bolster the conditions for self-formation and presentation, online and off. She argued that data protection principles establish the ground rules for creating and safeguarding an identity-favourable environment. The problem with pervasive surveillance, then, is its possible effects on identity formation, revision, and tailoring to suit various social interactions. It can stifle one’s capacity to express “yourself freely in the here and now.” Erving Goffman noted that every individual has multiple identities, and that social interaction is built on which ‘face’ is put forward in a particular relational context. With the explosion of data collection from so many different directions and via so many channels, we have been rapidly losing the capacity to meaningfully influence, much less control, this process. The right to be forgotten, in its various forms, has the goal of allotting data subjects greater control over the flow of information about them. 

This article explores what a Canadian variant of the right to be forgotten might look like in relation to search engines as a particular type of business that collects and packages publicly available personal information about individuals. Part I will consider the different versions of this ‘right’ in the EU, specifically obscurity, oblivion, and erasure. In particular, it will explore how the EU deals with publicly and indirectly collected information, given that until now data protection regimes generally have not regulated the collection and processing of such information. Part II will consider the digital information dynamics related to publicly available personal information, and what the normative impetus behind regulating these information dynamics might be. It will include a discussion of the difference between what search engines do and what news sources do, and how it may be possible to restrict the former while preserving the importance of expression and access to information regarding the latter. Part III explores the possibility of dividing publicly available personal information into three subcategories: information that should not have been published in the first place; information that is publicly available from public sector sources, but to which public access has been legitimately restricted; and information that, while legitimately and publicly available, has been given more prominence than warranted by way of a search engine’s algorithm. Also important is whether this information has caused the data subject some harm. It also considers the current Canadian approach to each of these categories, and explores how the right to be forgotten might fit into our already established or developing normative approaches to personal information flow. Part III concludes by suggesting a creative solution to the especially complex and novel dynamics of information flow.

Obscurity

'All the World’s a Stage: The European right to be forgotten revisited from a US perspective' by Hugh J McCarthy in (2016) 11(5) Journal of Intellectual Property Law and Practice 360-371 comments

The Court of Justice (CJEU) ruling in Gonzalez v Google Spain has placed the ‘right to be forgotten’ at the centre of the global privacy debate. However, the decision leaves many questions unresolved, in particular the territorial scope of the ‘right to be forgotten’. 

The Gonzalez decision thereby generates tension with other jurisdictions due to the potential for the extra-territorial application of EU law norms beyond its borders. This tension is especially palpable in jurisdictions that are less than receptive to the principles underlying the ‘right to be forgotten’. In this respect, the Gonzalez decision is a discrete symbol of the disparity between the judicial approaches to privacy, data protection, reputation and freedom of expression under the respective American and EU constitutional systems. Although there are several fields of common ground between the EU and US at the intersection of these fundamental rights, it cannot be said that the ‘right to be forgotten’ is one of them. It is apparent that the body of First Amendment jurisprudence stands as an insurmountable obstacle to the implementation of an EU-style ‘right to be forgotten’ in the US. 

With the imminent codification of the ‘right to be forgotten’ in the EU’s General Data Protection Regulation, it appears that the two jurisdictions will end up ‘shadow-boxing on different plains’ when it comes to the ‘right to be forgotten’. As a consequence of these differences and the resulting regulatory disparity, informational asymmetries will probably emerge between the US and EU – and potentially other jurisdictions – as the ‘right to be forgotten’ is implemented elsewhere.

Forgetting Again

'A historian’s view on the right to be forgotten' by Antoon De Baets in (2016) International Review of Law, Computers and Technology explores

the consequences for historians of the ‘right to be forgotten’, a new concept proposed by the European Commission in 2012. I first explain that the right to be forgotten is a radical variant of the right to privacy and clarify the consequences of the concept for the historical study of public and private figures. I then treat the hard cases of spent and amnestied convictions and of internet archives. I further discuss the applicability of the right to be forgotten to dead persons as part of the problem of posthumous privacy, and finally point to the ambiguity of the impact of the passage of time. While I propose some compromise solutions, I also conclude that a generalized right to be forgotten would lead to the rewriting of history in ways that impoverish our insights not only into anecdotal lives but also into the larger trends of history. ...

In this essay, I strongly defended a right to forget. But whereas I see much quality in forgetting acts of others and much necessity in privacy for oneself, as a historian I see neither quality nor necessity in forcing others to forget you, for basically the same reason why I reject forcing others to remember you: it is an act of coercion in the realm of holding and expressing opinions. Oddly enough, some seem to think that when persons are able to invoke a right to be forgotten, they will also be encouraged to freely express themselves because their opinions are then reversible. In contrast, I think that a generic chilling effect is more likely. The protection of A's privacy bolsters A's free expression, but A's right to be forgotten, as a radical offshoot of A's privacy and regulator of sources about A, chills B's rights to information and expression. A right to be forgotten disproportionally distorts the balance between free expression and privacy in favour of privacy in the already privacy-favourable European context. It will encourage data controllers to err on the safe side. As Van Hoboken wrote, this effect may produce a bias towards uncontroversial information in search engines and related services. This is a fatal bias for any scholar of internet resources (Van Hoboken 2011). Only in the case of children do I see legitimacy in erasing information previously posted by themselves on the internet. Only for spent convictions do I see legitimacy in minimum anonymization upon request and in a right of reply. A generalized right to be forgotten, however, would lead to the rewriting of history in ways that impoverish our insights not only into anecdotal lives (which is justified in a small class of recent cases) but also into the larger patterns and trends of history. If we remember this, we better forget it.

'The right to be forgotten in the light of the consent of the data subject' by Cesare Bartolini and Lawrence Siry in (2016) Computer Law and Security Review takes a more nuanced view, commenting

Recently, the Court of Justice of the European Union issued decision C-131/12, which was considered a major breakthrough in Internet data protection. The general public welcomed this decision as an actualization of the controversial ‘right to be forgotten’, which was introduced in the initial draft for a new regulation on data protection and repeatedly amended, due to objections by various Member States and major companies involved in massive processing of personal data. This paper attempts to delve into the content of that decision and examine if it indeed involves the right to be forgotten, if such a right exists at all, and to what extent it can be stated and enforced. ...

In an age of instant access to vast amount of material, policy makers must search for solutions which allow digital citizens the ability to maintain control over the image they present to the world. The DPD represented a step in this direction. Adopted in 1995, during the infancy of digital age, it represented a progressive protection regime which addressed technological developments of that age. Since then the Internet has exploded and changed the landscape of what it means to be a digital citizen. It has transformed the concepts of privacy, access and consent.

Yet with each action comes a reaction. One such action is currently being undertaken in the form of the GDPR, which seeks to shift the balance of power away from the data controllers in favor of the DSs, if only ever so slightly. Through its adoption of a right to be forgotten the EU will simplify and embolden citizens' right to control their image in the web. The existing provisions which allow limited editorial control based on objection or consent will be replaced. Yet, in the meantime, the CJEU's decision against Google Spain has, to a certain extent, complicated the debate. Does the decision recognize a previously existing right to be forgotten? Or rather is the Court simply morphing the right to objection in order to fill a void in existing law in order to protect rights of users within the spirit of existing legislation?

The Court could not enforce a right that does not exist in the current legislation. And yet, what it could do was to plant the seeds, to affirm something that goes in the direction of the right to be forgotten, although it is a mere application of the right to object.

What did the Court achieve? Very much, and very little. The clear statement that the search engine is a data controller is a definite step forward in adapting the existing data protection principles to the new technological context. And yet, on a concrete ground, the effect on the case was the opposite than the upholding of the claim actually aimed at. The original content on the Spanish website is still available; it cannot be found on Google Spain using only the name of the claimant as the search string, but the search service from different countries still displays those results, as does the Spanish service by using a more detailed search string; and the claimant has earned a lot of visibility, which was probably the opposite of what he wanted.

Under the existing legal framework, the Court could not require the original data to be erased. At any rate, those data (actually a copy of an old issue of a newspaper from the archive repository) were unlikely to be looked for in the original website, thus not causing any harm to the claimant's reputation. The harm came from the fact that the search engine brought under present light something that had no real interest. The decision finds a balance between the rights granted by Articles 8 and 11 of the Charter: once the public interest in the information on the subject has ceased, the right to the DS's personal data must prevail.

The Court stopped here. The decision was based on the context “here and now”, and several critical issues were left open. First off, many search strings, involving or not the name of the DS, display those results. To what extent should the search engine be forced to disable those results? Of course, if Google is obliged to avoid the indexing of those results in response to more search strings, the limitation to the freedom of information is stronger, and at some point the balance shifts. Finding the perfect balance is extremely hard, but that topic was not discussed in the decision.

Second, the Court discussed the facts in a static perspective. If the DS runs for a political career or a position with significant public responsibilities, then maybe what has been considered an obsolete and irrelevant information about his past financial problems may become interesting again in the eyes of the public. The transparency of the information to the public might suddenly shift the balance back in favor of the ease in finding those results. A dynamic analysis of the possible scenarios is not available yet.

It seems that the Court planted a seed. Possibly, it used the case to put its endorsement upon an idea which has been struggling to gain full approval from the legislature of the European Union, even without recognizing its existence under the current legal framework: the right to be forgotten. Quite possibly, the Court is sending a signal that it will recognize the essence of a right until it is adopted into codified law.

'The right to be forgotten – a Dutch perspective' by AJ Verheija in (2016) International Review of Law, Computers and Technology investigates

to what extent the right to be forgotten as proposed by the European Commission is already recognized in Dutch tort law. The focus of this paper will be on the existence and the desirability of such a right and not on questions of enforcement. It is submitted that although Dutch law does not recognize the right to be forgotten as such, several judicial decisions can be identified that afford protection to interests that are also protected by the proposed right to be forgotten. This indicates that in the Netherlands a right to be forgotten in some form or another might have developed over time but this would have been a lengthy affair. A more precise formulation of this right by the legislator is therefore welcomed. It has been remarked that the name ‘right to be forgotten’ may give rise to unrealistic expectations but the Dutch experience shows that people do not seem to be very aware of their rights. ‘A right to be forgotten’ – however imprecise from a legal viewpoint – might be catchy enough to remedy this.

Verheija concludes

On the basis of the above decisions, it can be concluded that there is a right not to be confronted with one's past after a certain time has elapsed. When exactly this right comes into existence is unclear; everything depends upon the individual circumstances of the case. Despite its constitutional roots, this right therefore seems to offer less protection than more traditional, well-delineated rights that are recognized by private law. Judges attach a lot of weight to the context in which past crimes are raked up. A political debate on immigration law does not justify a detailed description of an over-a-decade-old crime that reveals the identity of the convict. In their contextual approach, judges seem sensitive to mitigating measures by defendants that strike a balance between the right to privacy and to reputation on the one hand and the right to free speech on the other hand. Illustrative of this are the considerations of the Court of Amsterdam on the disclaimer of the movie based on the kidnapping of Freddy Heineken. It estimated that although the disclaimer was not in sight for a long time and was difficult to read, the public who went to see the movie in the cinema would be aware of the fictitious character of many scenes due to current newspaper coverage. The Court acknowledged that this might not be the case for people who would see the DVD version in the future but it was satisfied by the fact that in the DVD version the disclaimer would be shown for longer.

In the last two cases, the right to privacy did not protect against internet publications about children without the consent of their legal representative. Again, the courts did not formulate a hard and fast rule but weighed all the circumstances of the case. Of special relevance were the nature of the information, the extent to which the information was public, and the fact that defendants were the fathers of the children concerned. The mere possibility that this information might be used by third parties to the detriment of the mothers and/or the children was in itself deemed insufficient to support a prohibition. A prohibition was granted, however, when such a risk could be made concrete with reference to the work of the mother.

This means that Dutch tort law does not in any general way protect people who disclose personal (but not embarrassing or defaming) information on the internet themselves and later on wish to delete it. Only when this information is used by others to harass them or when a very long time has elapsed does the law offer protection. When companies collect information on the internet, the Wbp (by which Directive 95/46/EC was implemented) provides some protection but there is evidence that this law does not work very well in practice.

It is therefore submitted that although Dutch law does not recognize the right to be forgotten as such, several judicial decisions can be identified that afford protection to interests that are protected by the proposed right to be forgotten. This indicates that, in the Netherlands, a right to be forgotten in some form or other might have developed over time. Both the structure of Dutch tort law with its emphasis on conduct and not on protected interests and the open-ended nature of tort law principles are likely to have made development of such a right to be forgotten a lengthy and cumbersome process. A more precise formulation of this right is therefore to be welcomed. This would create a foundation to build without stifling further development. It has been remarked, with some justification, that the name ‘right to be forgotten’ may give rise to unrealistic expectations, but the Dutch experience with Directive 95/46/EC shows that people do not seem to be very aware of their rights. ‘A right to be forgotten’ – however imprecise from a legal viewpoint – might be catchy enough to remedy this.

'Germany’s ‘Right to be forgotten’ – between the freedom of expression and the right to informational self-determination' by Claudia Koddea in (2016) International Review of Law, Computers and Technology argues that

Although never having defined it explicitly, German law and jurisprudence imparted a right to be forgotten which could be described as a right to delete long ago. Its basis can be found in the constitution where it is torn between the freedom of expression and the right to informational self-determination. Also, German legislature introduced non-constitutional provisions ensuring the deletion of personal data in specific cases that are applied regularly. This article aims to give an overview of the ‘German’ right to be forgotten, its legal framework and its application in court. ....

The first part of this article has shown that the Grundgesetz provides a right for data subjects to decide for themselves about release and use of their personal data. This right to informational self-determination is an implementation of the right of personality and does not only grant a right to decide about the circumstances of a disclosure of data but also a right to remain the ‘master of one's private data’, meaning that the data subject also has the right to ask for the erasure of his/her data. However, as the data subject is only a small part of society, his or her constitutional right has to be balanced against the rights of others.

The second part covered the current legal framework concerning a right to be forgotten or, more narrowly, a right to delete. The relevant Section 35 Paragraph (2) BDSG transposes Art. 12 Paragraph (b) of the Directive 95/46/EC and grants a right to delete in a number of cases. One of the most problematic points regarding these provisions is the question of responsibility, especially in the case of search engines. A data subject generally has the right to withdraw consent, which would lead to a right to delete, but it must not be forgotten that the right to revoke consent has to take possible legitimate interests of the service providers into consideration.

Furthermore, if the data in question are openly accessible, a deletion becomes even more difficult. If one argues that data on profiles in social networks where the user did not restrict the visibility or privacy settings are openly accessible, even a deletion of this social network profile will be only of limited help because the withdrawal of consent does not affect the lawfulness of the processing prior to the withdrawal.

The last part of this article dealt with different court cases in which plaintiffs had asked for a deletion of personal data. In all cases, no matter if the BDSG was applicable or the claims had to be based on the more general provisions of Sections 823 and 1004 BGB, the Court had to balance the constitutional rights of the defendant, such as the right to the freedom of expression or the right to information, with the right to informational self-determination of the plaintiff. One can say that, although Germany has adopted a rather protective system of data protection, the right to information of the public is one of the most important constitutional rights, which often outweighs the other rights.

It appears that not only scholars but also judges and other jurists either do not like the notion of a ‘right to be forgotten’ or do not see a basis for it in the German law. Otherwise, it is difficult to explain why not a single decision can be found mentioning this term. The main reason for this might be the biggest problem of the right to delete in the BDSG and it is not a legal one. Although the legislature tries to protect the citizens the best it can, the enforcement of the rights in practice is almost impossible. Often internet users will not know to whom their data was transmitted and they will not even try to pursue their claim in court. Although one has to admit that a right to be forgotten, where the data subject only has to ask a single controller to delete the data and the controller will ensure the deletion of every copy whoever holds it, does not exist in German law, the existing provision grants at least ‘a small right to be forgotten’. The fact that it is hardly used shows the need for other solutions, especially technical ones. In short: the theory is ready. It only waits for the practice.

Leaks, Lies and Memory

'Can Technology Prevent Leaks?' by Nathan Alexander Sales in (2015) 8(1) Journal of National Security Law and Policy 73-101 comments

The Obama Administration has prosecuted a record number of government employees for leaking classified information. Yet despite this prosecutorial surge — nine cases in less than seven years — a steady stream of high-profile leaks continues and shows no sign of abating. This essay considers why the threat of criminal punishment sometimes fails to deter leakers. It argues that the expected penalty for leaking is quite low; very few leakers ever face criminal charges and those who are convicted receive relatively modest sentences. The essay therefore proposes that authorities seeking to prevent catastrophic leaks should make greater use of technological controls. Examples include access controls that restrict which users may view what information for which purposes (including biometric identity verification), immutable audit logs that record users’ system activity, and automated processes to verify that users are entitled to access the information they seek and to monitor for suspicious patterns of behavior.

The BBC reports that Enric Marco, purportedly a survivor of Mauthausen, has been exposed as an  unrepentant imposter (albeit less colourful and unpersuasive than Defonseca).

94 year old Marco claim to have been an anarchist forced to flee from Barcelona in the Spanish Civil War, being interned in the Flossenbuerg and Mauthausen concentration camps. He has served as president of the Amical de Mauthausen, Spain's main association of Nazi victims and given emotive speeches featuring his supposed experience in those camps. In reality he appears to have signed up as a voluntary worker in Nazi Germany under the 1941 labour agreement between Franco and Hitler.

Historian Benito Bermejo comments that Marco's version of events changed each time he told it.

Marco became Secretary General of the Confederación Nacional del Trabajo (ie the anarchist National Confederation of Workers - CNT - familiar to many readers of George Orwell) in 1980, was awarded the Creu de Sant Jordi by the Catalan government in 2003 and became president of Amical de Mauthausen in 2005. It appears that Marco pulled out of a ceremony at Mauthausen after being confronted with Bermejo's research, admitting that he had been a volunteer worker and had never been in a concentration camp.

 He reportedly claims that he sought to keep alive the memory of Hitler's Spanish victims: "Who would have listened to me if I hadn't created that persona?".

Archives and memories

Intellectual property students have a short reminder of copyright in letters in the current controversy over correspondence from Jacqueline Kennedy to a Vincentian priest.

Under Australian, UK, US and Irish law the recipient of a letter gains legal ownership of the medium - ink, paper, envelope, stamp (even sealing wax, if you are lucky) - but the author of the letter retains copyright. The recipient can legally read, destroy or sell the medium but typically does not have authority to publish what was written.

Some recipients have sold correspondence at auction or sold a cache of letters to a collecting institution, in some instances for over US$1 million. On occasion they or biographers and other scholars have been restrained from reproducing the correspondence as a whole or from extensive quotation. A much cited example is action by JD Salinger to block quotation of intimate correspondence. Henry James, just as famously, retrieved letters from recipients and burnt them - along with manuscripts of novels and short stories - in a regrettable bonfire in his garden at Rye.

In the US there has been interest in what the New York Times describes as "an unlikely friendship" and "an extraordinary correspondence" in which Jacqueline Bouvier (later Jacqueline Kennedy) "revealed her private thoughts" during courtship and marriage with John F. Kennedy. Her letters were addressed to Vincentian priest Joseph Leonard, whom she met in Ireland in 1950. The published snippets - including characterisation of JFK as consumed with ambition “like Macbeth” - reinforce perceptions that she was more acute than the charismatic, golden-haired and somewhat empty-headed President.

The Times reports that

The letters were uncovered in April at a financially strapped college in Ireland, which had planned to sell them at auction as part of a plan to raise money. But earlier this week, the auction was called off, and on Friday, officials at the college, All Hallows in Dublin, said they had learned that the institution did not own the letters after all, and announced that it was closing its doors.

It seems doubtful that the Kennedy family, which stepped in to object to the auction, even knew of the letters’ existence until excerpts were published earlier this month in newspapers on both sides of the Atlantic. ... Phillip Sheppard, the head of the auction house that planned to conduct the sale, told news outlets that a “private source,” whom he has not identified, had brought the letters forward.

Mr. Sheppard estimated that the letters from the famously private former first lady might fetch as much as $5 million. ... 

On Wednesday, the auction was abruptly called off, and the college said that the Kennedy family had stepped in. A further twist emerged Friday, when the college announced that Father Leonard had bequeathed the letters in a will to his religious order, the Vincentian Fathers. The will, which had been presumed lost, had been discovered in recent days, the college said. ...

Whether the letters will ever become public remains unclear. The revelation of candid thoughts written to a priest, with the likely expectation that they would remain confidential, has roiled an age-old debate over privacy and the obligations of public figures to illuminate the historical record.

'Ae Fond Kiss: A Private Matter?' by Hector Lewis MacQueen in Burrows, Johnston and Zimmermann (eds), Judge and Jurist: Essays in Memory of Lord Rodger of Earlsferry (Oxford University Press, 2013) 473-488 discusses the 1804 case of Cadell & Davies v Stewart, in which the existence of rights to publish or to prevent publication of private letters between poet Robert Burns and his close friend Agnes McLehose was ventilated at length by the advocates and judges. MacQueen assesses the evidence for what really happened between Burns and Agnes, and discusses the contemporary significance of the court's decision to prevent publication.

MacQueen comments

On 16 May 1804, the Court of Session decided to prohibit the continued publication of 25 passionate personal letters written by Robert Burns to “Clarinda”, the love of his life (at least between December 1787 and February 1788, when most of the letters were written). The letters had been published in a slim pocket-sized volume in spring 1802, whereupon proceedings were commenced in November by the holders of Burns’ copyrights and, subsequently, his family. The Court’s decision came even though Burns had been dead for eight years, and his physical relationship with Clarinda, so far as could be told from the letters, had involved only heavy breathing and perhaps, late at night, the occasional fond kiss and cuddle (of which more anon). But Clarinda was still very much alive at the time of the case and living in Edinburgh; she was in possession of the originals of the letters in question; and, averred the publisher of the book, Mr Thomas Stewart, bookseller of Glasgow, she had consented to their publication. 

Not being a party to the case, however, Clarinda (whose real name was Agnes McLehose, and who was usually known to her friends as Nancy) was in no position to deny Stewart's allegation before the court. Nor did she really want to "go public" about her affair with Burns. At the most intense period of their relationship, they were each married to someone else: Burns in his irregular relationship with Jean Armour,4 who had already borne him twins in 1786 and was again pregnant by him back in Ayrshire; Clarinda to a dissolute Glasgow lawyer, James McLehose, from whom, however, she had been estranged and living apart since 1782. In itself this was scandalous by contemporary standards, since quite apart from the disgrace of leaving her husband, how she managed to survive thereafter was unclear unless it was on immoral earnings or with the covert support of a rich lover. … Robert Burns spent the winter of 1787-88 in Edinburgh, where he was seeking to follow up the success of the Kilmarnock edition of his poetry published in 1786, obtain money and patronage, and widen his experience and influence. At the beginning of December 1787 he went to a tea-party and there met the attractive, yet religiose and bookish, Agnes McLehose. Like Burns, she was 28 years old, and lived with her two surviving children and her servant Jenny Clow at General’s Entry just off Potterrow on the south side of Edinburgh – not the best part of town in those days, but not the worst either. 

After the tea-party, Burns and Nancy began a high-flown but increasingly amorous correspondence which lasted for the next three months, addressing each other and signing themselves as "Sylvander" and "Clarinda" respectively. They wrote initially because Burns had managed to fall out of a carriage (possibly due more to the coachman’s than Burns’ consumption of alcohol) and was consequently laid up at home with a dislocated knee, unable to get about on foot or, indeed, at all. So the two communicated via the hourly penny postal service, sometimes also using Jenny Clow as a private courier. The pseudonyms provided at least a fig-leaf of protection for their identities should letters delivered by third hands miscarry in some way. Burns’ womanising reputation was already well established and well justified, so it was a great risk to any female’s good name to be seen alone with him. Email, texting and tweeting, had they existed in the late eighteenth century, would have been useful to the couple, although their words would have had to be fewer and shorter, if not abbreviated. 

When Burns' knee recovered in January 1788, he began paying visits to Nancy late at night in Potterrow as well as continuing to write between visits. Nancy urged him to walk to her house rather than come conspicuously in a sedan chair, or even worse a coach: “A chair is so uncommon a thing in our neighbourhood, it is apt to raise speculation.” But he could go home in a chair, since the neighbours were "all asleep by ten". 

Burns died in Dumfries on 21 July 1796, leaving behind him his wife Jean and their surviving children. Friends and admirers of the dead poet concocted a plan to support the family by publication of all his writings, including his letters. They wanted initially to include in this project Burns' letters to Clarinda, which presumably they knew about because Burns had kept at least some of Clarinda's letters to him. She however refused permission for this, and on her own account asked for the return of the letters she had written to Burns. This was eventually achieved in 1797. Three years later, the first edition of James Currie’s four-volume Works of Robert Burns was published by Cadell and Davies of London (the current members of a long-established and very successful firm of booksellers or publishers, later to be the raisers of the action that came to its culmination in May 180419). The second volume included the full text of a number of Burns’ letters recovered from some of his correspondents, but there was no hint anywhere in the book of his exchanges with Agnes McLehose. … 

Currie’s quasi-apology for publishing private letters in his preface to the second volume is indicative of contemporary attitudes, at least among the letter-writing classes:

It is impossible to dismiss this volume of the correspondence of our Bard, without some anxiety as to the reception it may meet with. The experiment we are making has not often been tried; perhaps on no occasion, has so large a portion of the recent and unpremeditated effusions of a man of genius been committed to the press.

Currie emphasized the fact that the publication was generally with permission from both the family of Burns and those to whom he had written, and also that it had been “found necessary to mutilate many of the individual letters, and sometimes to examine parts of great delicacy - the unbridled effusions of panegyrics and regard",  to make them fit for public viewing. 

Despite, or perhaps because of this, Currie’s book caught the in-coming tsunami of Burns mania. Bardolatry was already manifesting itself, not only in the spread of annual suppers on the anniversary of his birth (the very first was held in the birthplace, Alloway, in January 1797), but also in projects for the creation of monuments around the country. Currie’s Works enjoyed three further editions in 1801, 1802, and 1803, and the book’s immediate success was, as we shall see, an important part of the background to the litigation in 1804. 

While Clarinda might successfully prevent her letters from Burns going into print, she did allow visitors to her house in Edinburgh to see them. She authorised someone called Finlay to quote from Sylvander’s letters when she let him have possession of them for a period. But, as she wrote in 1834, "Besides making this use of the letters, Mr Finlay gave permission to a bookseller to publish all the letters which had been intrusted to him, and added, most falsely, in an advertisement prefixed to them, that this was done with my permission (‘condescension’, as he termed it) ... Nothing could be more contrary to truth."

Meanwhile in Germany it is reported that the Oberlandesgerichte Koblenz (Higher Regional Court of Koblenz) in case reference 3 U 1288/13 has apparently ordered the deletion of intimate photos and videos after a personal relationship came to an end. (Commentary relies on the Court's media release rather than the judgment, which has not yet appeared.)

The defendant and then partner had made a range of images during the relationship; some were intimate (including nude photographs, unsurprising given that the defendant is a professional photographer), others were not. After the relationship ended the partner demanded destruction of both intimate and 'everyday' images in which she appeared. Off to court, after the defendant resisted.

In the District Court the defendant agreed not to publish the images (e.g. place them on the web) or otherwise provide them to third parties. However, he did not agree to delete all electronic images, which we might regard as equivalent to pulling photos of a formerly happy couple out of a personal photo album. So much for the memories.

On appeal the Court appears to have decided that the complainant had some rather than comprehensive personality rights regarding unpublished images. Intimate images were associated with the personal relationship and when that relationship ceased the complainant could accordingly require deletion of those images (presumably by the photographer expunging files from hard drives and cards). That destruction reflects Articles 1(1) and 2(1) of the federal Constitution. The defendant's professional freedom (protected as a human right under Article 12) would not be affected, as the images were made on a personal rather than professional basis.

The 'everyday' images should be treated differently, as exposure would not lower the claimant's reputation in the eyes of third parties. The court noted that it was common practice for the production of still images and video at "celebrations, festivals and on vacation", with people legitimately possessing those images and using them (on a non-commercial basis) in perpetuity.

Forgetting

Posts over several years have noted disagreements about conceptualisation and practicality of a narrow or broad 'right to be forgotten', in particular mechanisms that would enable individuals and businesses to require search engine operators such as Google to suppress to particular third-party sites/pages when providing lists of search results.

As I discussed in an article in Privacy Law Bulletin some time ago, that requirement would not delete all sites, pages and comments. It would however inhibit identification by many searchers, given that people who are not savvy and/or diligent often rely on superficial searches of the web that don't extend much beyond scanning the first two pages of Google search results.

The requirement has been criticised as a commercial burden and an inappropriate restriction of free speech. Proponents have characterised it as an appropriate compromise, given that it may be impractical for an individual to successfully take action against publishers and other entities in different jurisdictions.

The European Court of Justice (Grand Chamber) has now disregarded the Opinion of 25 June 2013 warning against the 'Right' and in Case C‑131/12 - Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González - found for Gonzalez, i.e. recognised the right in relation to search engines.

The Opinion was discussed here.

Importantly the court has not required other parties - such as newspapers, broadcasters and bloggers - to expunge contested personal information from their pages and has accordingly not established a comprehensive, readily enforceable 'right to be forgotten'.

The Agencia Española de Protección de Datos (AEPD) - counterpart of national data protection bodies such as CNIL and the OAIC - had ordered Google "to adopt the measures necessary to withdraw personal data relating to Mr Costeja González from its index and to prevent access to the data in the future".

Neither the AEPD nor the Court have ordered that all content on the web to which González objects should be expunged. However, Google should ensure that Google does not point to particular sites when it provides search results.

The judgment notes that  EU Directive 95/46

has the object of protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data, states in recitals 2, 10, 18 to 20 and 25 in its preamble:

‘(2) … data-processing systems are designed to serve man; … they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to … the well-being of individuals; ... 

(10) … the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [, signed in Rome on 4 November 1950,] and in the general principles of Community law; … for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community; 

… the principles of protection must be reflected, on the one hand, in the obligations imposed on persons … responsible for processing, in particular regarding data quality, technical security, notification to the supervisory authority, and the circumstances under which processing can be carried out, and, on the other hand, in the right conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances’.

The Court goes on to note that

On 5 March 2010, Mr Costeja González, a Spanish national resident in Spain, lodged with the AEPD a complaint against La Vanguardia Ediciones SL, which publishes a daily newspaper with a large circulation, in particular in Catalonia (Spain) (‘La Vanguardia’), and against Google Spain and Google Inc. The complaint was based on the fact that, when an internet user entered Mr Costeja González’s name in the search engine of the Google group (‘Google Search’), he would obtain links to two pages of La Vanguardia’s newspaper, of 19 January and 9 March 1998 respectively, on which an announcement mentioning Mr Costeja González’s name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts. 

By that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to remove or alter those pages so that the personal data relating to him no longer appeared or to use certain tools made available by search engines in order to protect the data. 

Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia. Mr Costeja González stated in this context that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant. 

Importantly, in its 30 July 2010 decision the AEPD rejected the complaint in relation to La Vanguardia (i.e. did not require the publisher to expunge the print/online coverage or publish an apology, correction or annotation). The Court notes that the AEPD viewed La Vanguardia's publication as

legally justified as it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible.

However

On the other hand, the complaint was upheld in so far as it was directed against Google Spain and Google Inc. The AEPD considered in this regard that operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society. The AEPD took the view that it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties. The AEPD considered that that obligation may be owed directly by operators of search engines, without it being necessary to erase the data or information from the website where they appear, including when retention of the information on that site is justified by a statutory provision. 

The Court notes that

Google Spain and Google Inc. brought separate actions against that decision before the Audiencia Nacional (National High Court). The Audiencia Nacional joined the actions. 

That court states in the order for reference that the actions raise the question of what obligations are owed by operators of search engines to protect personal data of persons concerned who do not wish that certain information, which is published on third parties’ websites and contains personal data relating to them that enable that information to be linked to them, be located, indexed and made available to internet users indefinitely. The answer to that question depends on the way in which Directive 95/46 must be interpreted in the context of these technologies, which appeared after the directive’s publication. 

In those circumstances, the Audiencia Nacional decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling.

It concludes that

processing of personal data, such as that at issue in the main proceedings, carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous (see, to this effect, Joined Cases C‑509/09 and C‑161/10 eDate Advertising and Others EU:C:2011:685, paragraph 45). 

In the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life. 

Following the appraisal of the conditions for the application of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 which is to be carried out when a request such as that at issue in the main proceedings is lodged with it, the supervisory authority or judicial authority may order the operator of the search engine to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages published by third parties containing information relating to that person, without an order to that effect presupposing the previous or simultaneous removal of that name and information — of the publisher’s own accord or following an order of one of those authorities — from the web page on which they were published. 

As has been established in paragraphs 35 to 38 of the present judgment, inasmuch as the data processing carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites and affects the data subject’s fundamental rights additionally, the operator of the search engine as the controller in respect of that processing must ensure, within the framework of its responsibilities, powers and capabilities, that that processing meets the requirements of Directive 95/46, in order that the guarantees laid down by the directive may have full effect. 

Given the ease with which information published on a website can be replicated on other sites and the fact that the persons responsible for its publication are not always subject to European Union legislation, effective and complete protection of data users could not be achieved if the latter had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites. 

Furthermore, the processing by the publisher of a web page consisting in the publication of information relating to an individual may, in some circumstances, be carried out ‘solely for journalistic purposes’ and thus benefit, by virtue of Article 9 of Directive 95/46, from derogations from the requirements laid down by the directive, whereas that does not appear to be so in the case of the processing carried out by the operator of a search engine. It cannot therefore be ruled out that in certain circumstances the data subject is capable of exercising the rights referred to in Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 against that operator but not against the publisher of the web page. 

Finally, it must be stated that not only does the ground, under Article 7 of Directive 95/46, justifying the publication of a piece of personal data on a website not necessarily coincide with that which is applicable to the activity of search engines, but also, even where that is the case, the outcome of the weighing of the interests at issue to be carried out under Article 7(f) and subparagraph (a) of the first paragraph of Article 14 of the directive may differ according to whether the processing carried out by the operator of a search engine or that carried out by the publisher of the web page is at issue, given that, first, the legitimate interests justifying the processing may be different and, second, the consequences of the processing for the data subject, and in particular for his private life, are not necessarily the same. 

Indeed, since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.

In the light of all the foregoing considerations, the answer to Question 2(c) and (d) is that Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. ...

As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public by its inclusion in such a list of results, it should be held, as follows in particular from paragraph 81 of the present judgment, that those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question.

Mugshots

Today's NY Times features an article on commercial mugshot site, of interest in relation to the 'right to be forgotten', consumer protection law, privacy and personality rights.

the mug shot from [name's arrest for an offence resulting in a spent conviction] is posted on a handful of for-profit Web sites, with names like Mugshots, BustedMugshots and JustMugshots. These companies routinely show up high in Google searches; a week ago, the top four results for “[name]” were mug-shot sites.

The ostensible point of these sites is to give the public a quick way to glean the unsavory history of a neighbor, a potential date or anyone else. That sounds civic-minded, until you consider one way most of these sites make money: by charging a fee to remove the image. That fee can be anywhere from $30 to $400, or even higher. Pay up, in other words, and the picture is deleted, at least from the site that was paid.

To Mr. [name], and millions of other Americans now captured on one or more of these sites, this sounds like extortion. Mug shots are merely artifacts of an arrest, not proof of a conviction, and many people whose images are now on display were never found guilty, or the charges against them were dropped. ...

It was only a matter of time before the Internet started to monetize humiliation. In this case, the time was early 2011, when mug-shot Web sites started popping up to turn the most embarrassing photograph of anyone’s life into cash. The sites are perfectly legal, and they get financial oxygen the same way as other online businesses — through credit card companies and PayPal. Some states, though, are looking for ways to curb them. The governor of Oregon signed a bill this summer that gives such sites 30 days to take down the image, free of charge, of anyone who can prove that he or she was exonerated or whose record has been expunged. Georgia passed a similar law in May. Utah prohibits county sheriffs from giving out booking photographs to a site that will charge to delete them.

But as legislators draft laws, they are finding plenty of resistance, much of it from journalists who assert that public records should be just that: public. The Reporters Committee for Freedom of the Press argues that any restriction on booking photographs raises First Amendment issues and impinges on editors’ right to determine what is newsworthy. That right was recently exercised by newspapers and Web sites around the world when the public got its first look at Aaron Alexis, the Navy Yard gunman, through a booking photograph from a 2010 arrest.

“What we have is a situation where people are doing controversial things with public records,” says Mark Caramanica, a director at the committee, a nonprofit organization based in Arlington, Va. “But should we shut down the entire database because there are presumably bad actors out there?”

Mug shots have been online for years, but they appear to have become the basis for businesses in 2010, thanks to Craig Robert Wiggen, who served three years in federal prison for a scheme to lift credit card numbers from diners at a Tex-Mex restaurant in Tallahassee, Fla. He was looking for another line of work, according to news articles, and started Florida.arrests.org.

The idea soon spread, and today there are more than 80 mug-shot sites. They Hoover up most of their images from sheriffs’ Web sites, where rules and policies about whose mug shot is posted and for how long can vary, from state to state and from county to county.

.... Justmugshots is one of several sites named in a class-action lawsuit filed last year by Scott A. Ciolek, a lawyer in Toledo, Ohio. Mr. Ciolek argues that the sites violate Ohio’s right-of-publicity statute, which gives state residents some control over the commercial use of their name and likeness. He also says the sites violate the state’s extortion law.

“You can’t threaten to embarrass someone unless they pay you money,” he said, “even if they did exactly what you are threatening to embarrass them about.”

Lance C. Winchester, a lawyer in Austin who represents BustedMugshots and MugshotsOnline, both named in the lawsuit, says Mr. Ciolek’s lawsuit is a stinker because the United States Supreme Court has ruled time and again that mug shots are public records.

“I understand people think there is a dilemma presented by a Web site where you can pay to have a mug shot removed,” he said. “I understand that people don’t like to have their mug shots posted online. But it can’t be extortion as a matter of law because republishing something that has already been published is not extortion.”

The Times comments that

The trick is balancing the desire to guard individual reputations with the news media’s right to publish. Journalists put booking photographs in the same category as records of house sales, school safety records and restaurant health inspections — public information that they would like complete latitude to publish, even if the motives of some publishers appear loathsome.

The Reporters Committee for Freedom of the Press favors unfettered access to the images, no matter how obscure the arrestee and no matter the ultimate disposition of the case. Even laws that force sites to delete images of the exonerated, the committee maintains, are a step in the wrong direction.

“It’s an effort to deny history,” says Mr. Caramanica, the committee director. “I think it’s better if journalists and the public, not the government, are the arbiters of what the public gets to see.”

People eager to vanish from mug-shot sites can try a mug-shot removal service, a mini-industry that has sprung up in the last two years and is nearly as opaque as the one it is intended to counter. “I’m not going to go into what we do,” said Tyronne Jacques, founder of RemoveSlander.com (Motto: “Bailout of the Internet for good!”). “Whatever works.”

Removal services aren’t cheap — RemoveMyMug.com charges $899 for its “multiple mug shot package” — and owners of large reputation-management companies, which work with people trying to burnish their online image, contend that they are a waste of money.

“Their business model is to find someone willing to pay to take down their image, which marks them as a target who is willing to pay more,” says Mike Zammuto, president of the reputation company Brand.com.

... AS painful as they are for arrestees, mug shots seem to attract big online crowds. Google’s results are supposed to reflect both relevance and popularity, and mug-shot sites appear to rank exceptionally well without resorting to trickery, according to Doug Pierce, founder of Cogney, a search engine optimization company based in Hong Kong. At the request of The New York Times, Mr. Pierce studied a number of the largest mug-shot sites and found that they were beloved by Google’s algorithm in part because viewers who open them tend to stick around.

“When others search your name, that link to Mugshots.com is way more attention-grabbing than your LinkedIn profile,” Mr. Pierce said. “Once they click, they stare in disbelief, and look around a bit, which means they stay on the page, rather than returning immediately to the search results. Google takes that as a sign that the site is relevant, and that boosts it even more.”

What’s curious is that Google doesn’t penalize these sites for obtaining their images and text from other places, a sin in the company’s guidelines. The idea is that Web sites should be rewarded for coming up with original material and receive demerits for copying.

If it acted, Google could do what no legislator could — demote mug-shot sites and thus reduce, if not eliminate, their power to stigmatize.

Initially, a Google spokesman named Jason Friedenfelds fielded questions on this topic with a statement that amounted to an empathetic shrug. He wrote that the company felt for those affected by mug-shot sites but added that “with very narrow exceptions, we take down as little as possible from search.”

Two days later, he wrote with an update: “Our team has been working for the past few months on an improvement to our algorithms to address this overall issue in a consistent way. We hope to have it out in the coming weeks.”

Mr. Friedenfelds said that when he sent the first statement, he was unaware of this effort. He added that the sites do, in fact, run afoul of a Google guideline, though he declined to say which one. Nor would he detail the algorithmic changes the company was considering — because doing so, he explained, could spur mug-shot sites to start devising countermeasures.

As it happens, Google’s team worked faster than Mr. Friedenfelds expected, introducing that algorithm change sometime on Thursday. The effects were immediate: on Friday, two mug shots ... which had appeared prominently in an image search, were no longer on the first page. For owners of these sites, this is very bad news.

And, it turns out, these owners face another looming problem: getting paid.

Asked two weeks ago about its policies on mug-shot sites, officials at MasterCard spent a few days examining the issue, and came back with an answer.

“We looked at the activity and found it repugnant,” said Noel Hanft, general counsel with the company. MasterCard executives contacted the merchant bank that handles all of its largest mug-shot site accounts and urged it to drop them as customers. “They are in the process of terminating them,” Mr. Hanft said.

PayPal came back with a similar response after being contacted for this article.

“When mug-shot removal services were brought to our attention and we made a careful review,” said John Pluhowski, a spokesman for PayPal, “we decided to discontinue support for mug-shot removal payments.”

American Express and Discover were contacted on Monday and, two days later, both companies said they were severing relationships with mug-shot sites. A representative of Visa wrote to say it was asking merchant banks to investigate business practices of the sites “to ensure they are both legal and in compliance with Visa operating regulations.”

Forgetting

'The EU General Data Protection Regulation: Toward a Property Regime for Protecting Data Privacy' by Jacob M. Victor in Yale Law Journal (Forthcoming) considers

the new EU draft regulation on data privacy - especially its controversial provision establishing a "right to be forgotten" - and argues that the regulation implicitly creates the kind of propertized data regime that scholars proposed and debated a decade ago. 

The Comment identifies the key conceptual features of a data property regime, explains how the draft regulation implicitly embodies these features, and compares this property-centric framing to the human-rights framing that tends to dominate discussions of data privacy.

Victor comments that

The European Union recently released draft legislation that has the potential to transform EU data privacy law. The draft General Data Protection Regulation proposes a range of new individual rights designed to protect consumers whose personal information is collected, processed, and stored by corporations. Most notably, the draft Regulation would establish a consumer’s “right to be forgotten,” mandating that entities that collect or process data—which, for ease, I will call “data users”—must delete any data relating to an individual “data subject” upon his request. Furthermore, any third parties with whom this information has been shared would also be required to respect the data subject’s request for deletion. 

The draft Regulation, which was approved by the European Commission in January 2012, is unlikely to be finalized and enter into force for at least another several months. But the legislation has already proven highly controversial for its potential applicability to any corporation that processes the data of EU citizens (including U.S. corporations), for its potential effects on free speech rights and criminal investigations, for its alleged technological unfeasibility, and for the possibility that it may impede bilateral policymaking efforts between the U.S. and EU. 

A yet unexplored dimension of the draft Regulation, however, is its relationship to broader questions about what rights-and-remedies scheme is most appropriate for protecting consumer privacy in data collection. Though the Regulation is framed in the fundamental- human-rights terms typical of European privacy law, this Comment argues that it can also be conceived of in property-rights terms. The Regulation takes the unprecedented step of, in effect, creating a property regime in personal data, under which the property entitlement belongs to the data subject and is partially alienable. More specifically, the data protection plan takes for granted that personal data has become akin to a commodity capable of changing hands. Working off of this reality, it allows for some, highly regulated exchanges of data while also adapting rights and remedies commonly associated with property in service of the goal of protecting consumer privacy. The proposal includes three elements in particular that lend themselves to a property-based conception: consumers are granted clear entitlements to their own data; the data, even after it is transferred, carries a burden that “runs with” the data and binds third parties; and consumers are protected through remedies grounded in “property rules.” In these respects, the proposed scheme is remarkably similar to existing, heretofore purely theoretical, proposals for property regimes for protecting personal data, especially the model proposed by Paul Schwartz in 2004. But the draft Regulation seems to be one of the first legislative proposals that would actually implement this kind of propertized personal data regime. 

This Comment proceeds in two parts. Part I outlines some of the theoretical proposals for propertized personal information designed to remedy the shortcomings of contemporary data protection law, exploring the features of property regimes that scholars have seized on in presenting these proposals. Part II argues that these property-oriented safeguards are present in the draft Regulation, even though the Regulation is not framed in property terms. The Conclusion briefly explores the implications of this analysis for the broader question of whether propertizing personal data can be reconciled with treating privacy as a human right, pointing out that the draft Regulation seems to transcend this debate by adapting the rights and remedies commonly associated with property in service of a human-rights-driven approach to privacy.