Daily Times

The internet has become omnipresent. It is so pervasive that its presence is hardly noticed anymore.  There is a cost associated with the digitisation of the world. Every tweet we send, every post we share, the online searches we make — stay in cyberspace, adding up incrementally. Nothing we share online ever goes away. It is like walking in snow; with every step, we leave behind a footprint — except it never really goes away.

This has raised global concerns about protecting people’s data, resulting in the creation of a new right: The right to be forgotten. It has been recognised in countries such as Japan, Canada, Argentina and the US (there is a pending bill in the UK). The precise scope of this right varies across different jurisdictions.

In the EU, the right in general, stems from privacy. In the famous case of Google Spain versus AEPD and Mario Costeja González (2014), a Spanish national had lodged a complaint against La Vanguardia newspaper, Google Spain and Google Inc. He contended that his privacy was being infringed on due to a reference in google search results of the auction notice concerning his repossessed home. The issue was resolved years ago and therefore links to stories or articles of proceedings for recovery of his social security debts were entirely irrelevant.

He sought that the newspaper be directed to either remove or alter its pages on the web, remove his personal data and secondly Google Spain or Google Inc be required to remove his personal data so that it no longer appeared in the search results.

The Data Protection Agency of Spain rejected his request regarding the newspaper but directed Google Inc and Google Spain to remove the links from its searches. Google challenged the decision in the Spanish High Court that referred the case to Court of Justice of the European Union (CJEU).

CJEU ruled that Data Protection Directive (Directive 95/46) applied to search engines such as Google even if the physical server of a company processing data was located outside Europe. More significantly, the Court recognised the right to be forgotten in exceptional circumstances especially when the information appears to be ‘inadequate, irrelevant or no longer relevant or excessive … in the light of the time that had elapsed’. The Court ruled that the right to be forgotten must be balanced against the competing interests of freedom of expression and media.

The scope of right to be forgotten could be significantly enhanced after France’s Supreme Administrative Court, Conseild’État’s, referral to the CJEU in a case involving Google and French data protection agency; CNIL. The issue (pending final adjudication), before the Court is whether the right to be forgotten must apply universally.

Should delistings apply globally across all web domains rather than geo-limiting delistings to the person’s home territory (as Google prefers)? CNIL questions why antecedents or past record of complainant, which are based in France be visible to those based in the US or ‘geeky curious neighbours’ who can simply fake his IP address to a non-EU country. Google had appealed to the French top court after the CNIL’s order, for global delisting in May last year. Google was also fined … 100,000 in March, 2016 for non-compliance.

The General Data Protection Regulation (GDPR), seeks to repeal Directive 95/46/EC of 1995. The regulation will come into effect on 25th May 2018. Importantly, in its Article 17, the regulation recognises the right to be forgotten codifying the trends of administrative law in EU’s member countries. Pursuant to the regulation, an individual could request the deletion or removal of personal data where there is no compelling reason for its continued processing.

The right to be forgotten confers a freedom to delete different instances of the digital past. It is an acknowledgement that the past may be imperfect and that alone must not disentitle anyone from the promise of a future

It is not an absolute right under GDPR and a request can be granted in specific circumstances such as; where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed; the personal data was unlawfully processed (otherwise in breach of the GDPR) or the personal data has to be erased in order to comply with a legal obligation etc. Such requests can be denied in public interest, scientific or historical research, statistical purposes or to protect competing rights of freedom of expression and information etc.

The right to be forgotten confers a freedom to delete different instances of the digital past. It is an acknowledgement that the past may be imperfect and that alone must not disentitle anyone from the promise of a future. Every saint, as they say, has a past and each sinner a future. Therefore, there is an alternative perspective in recognition of this right. Essentially, the right to be forgotten is a right to ownership of one’s identity and the individual choice to define it.

This alternative perspective, different from privacy per se, is rooted in International Human Rights Law. Article 15 of the International Covenant on Economic, Social and Cultural Rights is an affirmation to individual’s prerogative to control his or her identity as that person enjoys “the benefits of scientific progress and its applications.”

Regardless of how we may choose to pin it, its about time that our country caught up and recognised the right to be forgotten. The first step is for the parliament to enact a law imposing obligations on processors and controllers of data and extending protection to natural persons. This is essential for a country, that has roughly 34,342,400 internet users and most of them are young adults. As we pivot to regulate cyber space, besides empowering the law enforcement we must also protect our citizens, especially our children, not just from the state but also, at times, from consequences of their own reckless behavior.

The writer attended Berkeley and is a Barrister of Lincoln’s Inn

Published in Daily Times, December 27^th 2017.