The Right to Be Forgotten

The right to be forgotten can be traced back to the French right to oblivion. In France, after a criminal serves his sentence, he or she retains the right to object publications that contain information about his or her crime.[1] Similarly, the right to be forgotten grants “individual citizens the ability to demand the permanent removal of personal content from the Internet. This could be content posted either by themselves or by third parties.”[2]

In Europe, the right to be forgotten was established through legislation and as of 2014, through case law.  Article 12(b) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 (the “Directive”), expressly provides the individuals with the ability to rectify, erase or block their personal information. The Grand Chamber of the European Court’s decision in Google v Gonzalez was based on this legislation. Pursuant to this decision and the legislation, search engines, such as Google, must delink websites that contain personal information of an individual, upon his or her request.

In 1998, A Spanish newspaper with an order from Spanish Ministry of Labour and Social Affairs published two announcements in its print version for an auction that involved selling properties because of social security debts of the plaintiff, Mr. Gonzalez. The announcements also contained information on the related legal proceedings. The purpose of the announcements was to attract bidders. Later on, the newspaper also published the announcements on their website.

On March 5, 2010, Mr. Gonzalez filed a complaint against the newspaper, Google Spain SL, and Google Inc with Agencia Española de Protección de Datos (“AEPD”). He argued that because the issue related to the announcements were “fully resolved for a number of years and that reference to them was now entirely irrelevant”, he should have the right to ask Google to delete the links to the stories and that Google should be ordered to comply with his removal request.[3]

AEPD rejected the complaint against the newspaper but allowed it against Google. AEPD held that the announcements were lawfully published as “ it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible.”[4] However, they decided that since search engines such as Google, control, process and store data, they are subject to data protection legislation, namely the Directive.

The Grand Chamber, in order to render their decision, addressed the following questions[5]:

  1. Can Google be classified as a “data processing system”?

The court held that since a search engine constantly “collects”, “retrieves”, “records”, “organizes” and “stores” data and, upon requests of users, could possibly disclose those data in the form of a link, it should be considered as a data processing system within the meanings of the Directive.[6]

  1. Can Google be classified as a data controller”?

Article 2(d) of the Directive defines a data controller as “…the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data”. The court by relying on this definition held that search engine operators, in this case, Google, is a data controller and therefore has to comply with the Directive.

  1. Is Google, as a non-European company, subject to European data protection legislation?

The court held that even though the processing of the data happens outside Spain, the fact that Google sold advertising spaces in Spain which is the main source of revenue for the company’s Spain branch was enough to establish that the Directive is applicable to their activities.

  1. What should have Google done under the Directive?

Finally, the court held that since the Directive is applicable to Google, they have to remove the links to information upon the request of the information subject if the data is “inadequate, irrelevant or no longer relevant, or excessive in relation to purposes and in the light of the time that has elapsed.”[7]

In Canada, the idea of being able to erase personal information has not been recognized in any legislation. The Charter, Privacy Act, and PIPEDA and its provincial variations, do not guarantee the erasure of personal information if such request is made. This is of course pending the new amendments to Privacy legislation. However, in the decision of Google v Equustek, 2017 SCC 34, the Supreme court of Canada introduced the right to be forgotten into our law, by requiring Google to deindex a website that had infringed IP rights of Equutstek Inc, globally.

Although decisions such as Google v Equustek and Google v Gonzalez are arguably a win for privacy advocates, they are controversial, with dire repercussions on the internet industry, freedom of expression, freedom of media and possibly other rights and freedoms. It has been argued that such decisions do not consider competing rights of the publisher, the search engines and on a larger level, the society as a whole.[8]

Whether the right to be forgotten is a fundamental human right is debatable. It has been categorized as an “ethical and social value or a policy aim” or as a “legitimate interest”.[9] Some critics say that the right to be forgotten, in essence, is a duty that is imposed on others to forget.[10]

 

 

Sources:

[1] Jeffrey Rosen, “The Right to Be Forgotten”, online: (13 February 2012) 64 Stanford L Rev 88.

[2] Anne Bezanco, “The Right to Be Forgotten: Protecting Digital Privacy” (2 August 2012), Forbes.

[3]Google Spain SL v. Agencia Española de Protección de Datos, Case C-131/12, Final Judgment (May 13, 2014) at para 15.

[4] Ibid at para 16.

[5] Niilo Jääskinen,”Recent Case: Google Spain SL v. Agencia Española de Protección de Datos” (2014) 128 Harvard LJ 735 at 737.

[6] Supra note 3 at para 28.

[7] Supra note 3 at para 93.

[8] Allen Mendelsohn, “Whoops! I forgot to write a post about the right to be forgotten” (29 May 2014), Allen Mendelson (blog), online: <http://allenmendelsohn.com/2014/05/whoops-i-forgot-to-write-a-post-about-the-right-to-be-forgotten/&gt;

[9] Aidan Forde, “Implications of the Right To Be Forgotten” (2015) 18 Tul. J. Tech. & Intell. Prop. 83 at 1.

[10]  IntelligenceSquared Debates, “The U.S. Should Adopt The ‘Right To Be Forgotten’ Online” (17 March 2015), online: YouTube < https://www.youtube.com/watch?v=yvDzW-2q1ZQ > at 00h:15m:34s.

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s