Should We Have A “Right to Be Forgotten” in the Digital Age?

The European Court of Justice (ECJ) ruled last May that all individuals within its jurisdiction have the right to prohibit Google from linking to information about them that is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.” In the months following the decision, Google received over 140,000 requests to take down more than 500,000 links—nearly half of which it granted. Yahoo and Bing have also implemented the Court’s decision. The ECJ’s recognition of a “right to be forgotten”—and the European Commission’s proposed Article 17 before that—has generated much controversy, especially in the United States, where the competing right to freedom of expression trumps privacy, or at least weighs much more heavily in a balance of the two. An editor of the Techdirt blog, for example, wrote that “[t]he idea that public information that is widely disseminated already can magically be made private because someone thinks it’s embarrassing and that it’s no longer important is simply a ridiculous assertion in the first place.” Professor Jeffrey Rosen even claimed that the right represents “the biggest threat to free speech on the Internet in the coming decade.” For both theoretical and administrative reasons, the ECJ’s recognition of a right to be forgotten is not a legitimate response to the loss of privacy and obscurity in the digital age.

Though not justifying the ECJ’s actions, it is important not to ignore the real human suffering that accompanies the erosion of privacy in the digital age, where previously unimaginable quantities of personal information can be stored and searched. This particular case arose in 2010 when Mario Costeja González, a Spanish lawyer, filed a complaint against Google Spain and Google Inc., arguing that an auction notice of his repossessed home on Google’s search results infringed his privacy rights because the proceedings were fully resolved more than 16 years ago. Another common scenario involves individuals haunted by criminal records that show up in a Google search long after they have been expunged. If Mr. González’s case does not elicit much sympathy, the Internet has also facilitated public abuse in so-called shame cultures like South Korea, resulting in humiliation and even suicide. When machines have made it easier to remember than to forget, it is very tempting to privilege the human need to grow and move beyond past incidents and mistakes, especially when accompanied by tangible harms and not just embarrassment or regret. But recognizing a right to be forgotten, for the reasons described below, would be a mistake.

A Theoretical Clash: Freedom of Expression vs. Privacy

While the Internet may have lead to a loss of control over one’s reputation and identity, heightening the tension between First Amendment values and privacy interests, it has not changed the centrality of freedom of expression to open and democratic societies. In fact, it is misleading to suggest that freedom of expression and privacy should or even can be balanced, especially if one understands freedom of speech and of the press—which protects the publication and dissemination of true information lawfully obtained—to include the corresponding right to information. While one can find a few examples of cases in the United States (mostly out of California) recognizing an invasion of privacy by publication of true but “private” facts, such as the 1931 case Melvin v. Reid or the 1971 case Briscoe v. Readers Digest Association, these are anomalies and have been overturned. Unlike the United States, many European countries, drawing on French law, recognize that privacy interests (such as in expunged criminal records, to give but one common example) may override the general public’s right to information. By granting individuals a general, quasi-property right in information about them in the possession of others—their “personal” data—the ECJ has privileged their interests over the rights of others to know, learn, think, express, and share.

The right to be forgotten is not simply, as was originally suggested, the right to demand deletion of personally identifiable stored data after a certain period of time. Instead, it contemplates a legal entitlement to demand deletion of truthful information about an individual that 1) the individual posts online; 2) the individual posts online, which is then copied and reposted by others; and that 3) someone else posts about the individual. The first category is least controversial, though it still implicates the right to information, and most social networking platforms already provide for it. Even in the United States, California enacted a digital privacy law for minors, nicknamed the “eraser button” bill, which will require websites and apps to provide a mechanism for minor users to remove content they post. It is only available to the minor who originally posted or uploaded the content and does not cover reposting, however. Nor would it require websites to delete the information from its data servers. Much more controversial is the ability to demand deletion of truthful information that has been shared, or was originally posted by another—this is a straightforward restriction on freedom of expression that would be prohibited under the First Amendment. Finally, while the ECJ’s ruling does not compel newspapers or other sources to take down information from their websites, requiring search engines to remove links to truthful and otherwise legally published information is equally problematic. Vice president for the digital single market at the European Commission said last year: “The European Court of Justice did not say that everybody has the right to be forgotten. ‘Right to be forgotten’ has to stay as an exception.” As recognized by the ECJ, the right to be forgotten must be balanced against other fundamental rights, such as the freedom of expression and the media. Accordingly, a case-by-case assessment should consider: (1) the type of information in question; (2) its sensitivity for the individual’s private life; and (3) the interest of the public in having access to that information. The European Commission’s proposed Article 17 also includes exemptions on grounds of freedom of expression (for works designated as artistic, literary, or journalistic, for example); public health; historical, scientific, or statistical research; and compliance with a national or EU legal obligation. How to determine the significance of data to “freedom of expression” or historical research remains unclear, however, when the right to be forgotten denies free speech and necessarily involves rewriting history on a selective basis. Furthermore, judging a piece of information by its “relevance,” or whether the person requesting deletion is a public figure, is even more problematic in an age of blogging and social media. It is difficult to see how even those in favor of recognizing privacy rights could agree on what privacy demands.

The “Deciders” and the Balkanization of the Internet

In addition to the theoretical impossibility of reconciling the right to be forgotten with freedom of expression, many commentators have objected to the role that the ECJ’s decision has given to Google, which must now internally adjudicate individual claims. For example, one Huffington Post article’s title reads: “Google Gets a Philosopher to Decide Who Gets ‘Forgotten.’” While it is not the case that Google only acts as a mere intermediary between reader and publisher, since Google and other search engines already have a system in place for copyright and trademark objections, the ECJ has forced Google to take on an independent adjudicatory role and assess fundamental rights. How, for example, should Google treat a data subject who is part of a group of data subjects that have not invoked their right to be forgotten? This role is especially problematic given the penalties for noncompliance of up to one per cent of global earnings, which will incentivize data controllers to take down even more content than a judge may consider legally necessary. Finally, in removing links search engines must take care to avoid the so-called “Streisand effect”: calling attention to the removed links (as Google does with copyright takedowns) would defeat the purpose of the ECJ’s ruling.

Many have also decried the beginning of end of the “global internet,” where decisions like the ECJ’s will prevent everyone from having access to the same information. In this case, the court held that even if the physical server of a company processing data is located outside Europe, EU rules apply to search engine operators if they have a branch or subsidiary in a member state that promotes the selling of advertising space offered by the search engine. But the decision begins to seem ridiculous when links that no longer appear on Google’s European pages will still be available on its American site and elsewhere. Some in Europe have therefore argued for extending the decision’s reach to force Google to take down the links in other parts of the world as well. Allowing courts and regulators in one country to dictate how websites work in other countries is not only impracticable but also wrong, however.

The ECJ’s recognition of a right to be forgotten is but one misguided legal response to life in the digital age. The Court would not dream of preventing people from speaking about Mr. González, and did not in this case force the newspaper that published the auction notice of his home to remove the article from its website. Everyone knows that it is not possible to actually make people forget, or remove every trace of a piece of information. Recognizing the Internet’s potential to disseminate information, and the ability of machines to store and preserve it in immense quantities, the Court and those in favor of its decision are not advocating for a literal right to be forgotten but instead want to give individuals the power to make information about them a bit less accessible. Not only is this a poor justification for abrogating free speech, but in many instances consumers are fully capable of protecting their own privacy—by foregoing use of Facebook and Twitter, for example. Though certain damaging information may become public anyway, that is why we have an entire industry in the United States devoted to “public relations,” including companies that monitor and improve search results. Meg Leta Ambrose has also criticized the ECJ for (perhaps unsurprisingly) overlooking recent research from the field of content persistence that 85% of online content disappears within a year and 59% within a week. What privacy advocates all too often ignore is that while the digital age is more dangerous, it is also more free, and democracy has never been for the faint-hearted.