To forget, or not to forget: that is the question
After a widely reported judgment of the European Court of Justice, Google has been flooded with requests from EU-based users, aimed at having links containing personal data ‘removed’.
Countless EU citizens freely release their data in the online environment making them accessible to a potentially vast number of persons (let’s think, for example, of Facebook, Twitter, LinkedIn). However, do they necessarily want them to stay there ‘forever’ or even ‘for a long time’? And are they really aware of the long-term consequences of their online behaviour? These simple questions exemplify the current, heated debate on the so-called ‘right to be forgotten’. What makes the topic even more stimulating is the fact that the EU Court of Justice recently chimed in, issuing an eagerly awaited judgment in which, while touching upon many important aspects for data protection in the online environment, it positioned itself in favour of the aforesaid right.
The European Court of Justice on the ‘right to be forgotten’
Can a person state his/her wish that true information lawfully published by third parties in some web pages and concerning him/her personally be ‘forgotten’ after a certain amount of time, asking for the relevant links to be removed from a search engine list of results? The Court’s answer is ‘yes, upon certain conditions’.
The key is to prove that the inclusion of the above-said links in the list is incompatible with the 1995 EU Directive. This can derive from the inaccuracy of the data, but also from their inadequacy, irrelevance/no-longer-existing relevance or its being excessive in relation to the purposes of the processing and in the light of the time that has elapsed; as well as from the fact that they have not been updated or have been kept for a period longer than necessary (an exception is made for historical, statistical or scientific purposes). The Court underlines that in such cases it is necessary to examine, in particular, whether the data subject has a right that the information relating to him/her personally should, at this point in time, no longer be linked to his/her name by a list of results displayed following a search made on the basis of his/her name. No prejudice to him/her deriving from the inclusion of the information in question is considered necessary. All circumstances of the case have to be taken into consideration.
In the presence of the aforesaid elements, the information and links must be erased, as the rights to respect for private and family life and to protection of personal data (Articles 7 and 8 of the EU Charter) override, as a rule, both the economic interest of the search engine operator and the interest of the general public in having access to that information. This is the course to be followed except in cases where are ‘particular reasons’ (e.g. the role played by the data subject in public life, in which case the interest of the general public in having access to the information in question is preponderant).
Data protection and freedom of expression and information: a veritable dilemma
The judgment as such has been met with varied reactions. The clash between the ‘right to be forgotten’ and freedom of expression and information has been a prominent feature in the relevant debate and it is one of the main reasons for the unease caused by the decision among a number of Member States. The issue is extremely delicate, if one considers, for instance, that the effectiveness of search engines (and more generally of archives), with regard to their considerable contribution to knowledge and research, cannot be endangered. The matter would be further complicated by extending the reflection to the impact and application of the ‘right to be forgotten’ in a traditional, non-electronic/paper-based environment.
The ongoing data protection reform
In its original proposal for a General Data Protection Regulation the Commission included an Article 17 devoted to the ‘right to be forgotten and to erasure’. The ’95 Directive, still in force, foresees for the data subject a right to erasure of data, which is specified and reworked in this provision of the Regulation. The impression is that by drawing upon the hazy and rather controversial ‘label’ of a ‘right to be forgotten’, the Commission created unnecessary questions and confusion around the existing, acceptable frame of reference. Not by chance, both the EU Council and the European Parliament have resisted the use of the terminology, refocusing the above-said provision on ‘erasure’.
The importance of a sound EU data protection framework: not ‘to be forgotten’
A discussion on the ‘right to be forgotten’ can help reflection on more fundamental questions. The fact that our society is increasingly dependent on modern information and communication technologies renders the online environment a setting where more and more frequently infringements of the right to protection of personal data, as well as more broadly of human dignity, surface. A society where data (and consequently lives) of citizens are treated as goods to be disposed of should be firmly opposed: it is not just about ‘objects’, but about persons.
Education in the use of media, especially although not exclusively for children and young people, should also receive priority attention: it is essential to show how sharing and publishing personal data online can have huge consequences (not always pleasant), users can become victims of abuse and violations of one’s right scan occur (e.g. cases of online bullying among teenagers). Incessantly and liberally exposing one’s information and (ultimately) life online, potentially to millions of people, may tell us something very worrying about personality and responsibility. In the field of non-formal teaching with and for young people, Churches and their organisations stand out for making an important contribution in the contexts of youth ministry, youth social work, youth association work and the teaching in many Catholic academies, that not only train young people but provide assistance to them in many areas. Churches and their organisations, in their work as providers of non-formal education, have a relevant contribution to make in this regard, and could put a greater emphasis on educating and accompanying young people to a responsible use of social media and more generally online behaviour.
Whatever legal shape this matter eventually takes, the ‘right to be forgotten’ needs to a proper balance between avoiding abuses by those who process the data towards the ‘data subject’ and preventing undue obstacles to (or chilling effects on) legitimate activities, that also need certain data in order to be carried out. The clear favour shown by the Court for privacy over freedom of expression and information should not lead to undesirable consequences.
The commented judgment points to the need for the EU to provide effective legislative and non-legislative mechanisms and solutions. This also means giving the final and decisive impulse to the, by now too long-lasting, negotiations on the General Data Protection Regulation. The solutions to be identified in that context must be flexible and sufficiently ‘open’ (in relation to the rapid development of modern technologies) but they will also have to have in them the potential for effectiveness and meaningfulness. The question marks raised by the response produced by Google, with an apparently higher and higher number of users’ requests receiving a negative answer, only reinforces the message: a solid legislative solution, with a clear focus on the ‘erasure’ element, is essential.
As for the judgment, while one cannot expect from this single decision an exhaustive answer to the multifarious questions on the application of the right to be forgotten, the EU Court has certainly provided a commendable contribution to the work in progress on the issue.