The Right to Be Forgotten
Total Page:16
File Type:pdf, Size:1020Kb
THE RIGHT TO BE FORGOTTEN: AN ANALYSIS FROM AN AMERICAN PERSPECTIVE AND WHAT IT MEANS FOR THE U.S. TO ADOPT IT Ani Kristo 14 December 2018 ABSTRACT Today’s society is part of a shared digital life, with an Internet population of 3.2 billion people. Though this colossal data infrastructure enables communication, information sharing, and collaboration, it is a place that favors a paradigm of continuous collection and storage of data, without much analysis of how that disrupts certain social norms and induces cases of violations of fundamental rights like privacy, freedom, and protection from discrimination. In 2016, the European Union adopted the General Data Protection Regulation, which in- troduced a right for individuals to have their personal data erased. This opened a discussion on privacy and identity concerns in the context of perpetual stigmatization and discrimination due to obsolete data that remains on the web. Through analyses of some cases in the U.S. and E.U., this paper will investigate the challenges of importing a similar legal framework for the erasure of personal data in the U.S., while ensuring the freedom of expression and maintaining the quality of the search engines and respective websites. TABLE OF CONTENTS 1 INTRODUCTION 1 2 BACKGROUND ON G.D.P.R.3 3 THE CENTRAL DEBATE IN THE U.S.6 3.1 Existing legal frameworks in the U.S. ................. 8 4 RELEVANT CASES 11 4.1 Google Spain v. AEPD and Mario Costeja Gonzalez´ . 12 5 OPEN CHALLENGES AND SOLUTIONS 13 6 PROPOSED SOLUTIONS 15 7 CONCLUSION 17 2 14-Dec-18] AN ANALYSIS FROM AN AMERICAN PERSPECTIVE 1 1. INTRODUCTION The Information Age has led to an exponential increase in data collection from both private companies and government agencies. Thanks to the ubiquitous inter-connectivity brought by the Internet, user data is now easily captured, collected, and stored in massive data centers for its preciousness in automatic knowledge discovery and applications of pattern recognition in the marketing realm. Consequently, the storage centers keep growing as data is always stored by default, and not forgotten. Looking at the last few years, this has caused personal data to be too vulnerable to security breaches like the notorious incidents at Yahoo,1 Equifax,2 eBay,3 Adobe,4 and Cambridge Analytica.5 Despite being conscious that modern technology enables for unprecedented forms of data matching, de-anonymization, and mining, users are often unaware of what sorts of operations their data goes through, nor do they have control over how it is used. In addi- tion, most service providers use vague and inaccessible terms in their software agreements, which results in another opaque wall for the average user of their products, consequently contributing to the creation of extensive digital dossiers.6 While many observers in the U.S. used to perceive digital redemption as entirely unworkable and ridiculous, after the Snowden revelations, the general public has begun to consider the idea more seriously.7 1. Nicole Perlroth, “Yahoo Says Hackers Stole Data on 500 Million Users in 2014,” September 2016, https://www.nytimes.com/2016/09/23/technology/yahoo-hackers.html. 2. Seena Gressin, “The Equifax Data Breach: What to Do,” September 2017, https://www.consumer.ftc. gov/blog/2017/09/equifax-data-breach-what-do. 3. Gordon Kelly, “eBay Suffers Massive Security Breach, All Users Must Change Their Passwords,” May 2014, https://www.forbes.com/sites/gordonkelly/2014/05/21/ebay-suffers-massive-security-breach-all- users-must-their-change-passwords/. 4. Brad Arkin, “Important Customer Security Announcement,” October 2013, https://theblog.adobe.com/ important-customer-security-announcement/. 5. Emma Graham-Harrison and Carole Cadwalladr, “Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach,” March 2018, https://www.theguardian.com/news/2018/mar/ 17/cambridge-analytica-facebook-influence-us-election. 6. Meg Leta Ambrose and Jef Ausloos, “The right to be forgotten across the pond,” Journal of Information Policy 3 (2013): 1–23. 7. “Forgetting Made Impossible,” in Ctrl + Z: The Right to Be Forgotten, by Meg Leta Jones (NYU Press, 2016), 55–80, ISBN: 9781479881703, http://www.jstor.org/stable/j.ctt1803zhx.6. 2 THE RIGHT TO BE FORGOTTEN [14-Dec-18 Incentivized by these and additional issues, in 2016, the European Union adopted the General Data Protection Regulations (G.D.P.R.)8 - a massively complex law aimed at reg- ulating data protection and privacy for E.U. citizens, as well as personal data export by service providers outside the European Economic Area. In Article 17, this new law in- troduces the Right to Erasure, more commonly referred to as the Right to Be Forgotten, as a basic and universal right for all data subjects9. It asserts that data subjects have the right to request the removal of their personal data from any data controller without undue delay.10 The law specifies cases when this right is applicable, including when the personal data is no longer necessary for the purposes for which it was collected and when the data subject revokes their consent. If the personal data has been publicized, the regulations require the data controller11 to “take reasonable steps, including technical measures, to in- form controllers which are processing the personal data that the data subject has requested the erasure [...] of any links to, or copy or replication of, those personal data”.12 One of the main use-cases for the safeguards that G.D.P.R. provides is that of protection against perpetual stigmatization as a consequence of a specific action performed in the past. Individuals whose personally identifiable information is still present and discoverable by online services in the context of unflattering events, such as arrests or public scandals, could be subject to ostracism and discrimination from employers or creditors. In these cases, the Right to Be Forgotten allows them to request the online erasure of their past, 8. “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),” Official Journal of the European Union L119 (May 2016): 1–88, http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L:2016: 119:TOC. 9. Article 4 of the G.D.P.R. defines the term ‘data subjects’ as an “identified or identifiable natural person”, - in other terms - a user of an online service whose data is present (given or collected) in the service provider’s storage facilities. 10. “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),” Article 17. 11. Article 4 of the G.D.P.R. defines the term ‘data controller’ as “natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”. 12. “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),” Article 17. 14-Dec-18] AN ANALYSIS FROM AN AMERICAN PERSPECTIVE 3 after a reasonable amount of time has passed, and at a point when the information would no longer bear interest for the public. In addition, this right extends facility for protection against instances of cyberbullying, non-consensual pornography, and the commercial use of arrest information, by enforcing online service providers to build this functionality as an inherent part of their products. To date, the United States has not adopted this right and there are no legal frameworks that directly grant data subjects that degree of control over their personal data online. Al- though there have been public and legal debates on this subject matter, the First Amendment rights, specifically freedom of speech, have always trumped any claim to privacy when data was truthful, used fairly, and collected in a legal manner. However, American companies that operate in the E.U. and provide online services for E.U. citizens are required to abide to the G.D.P.R. and have started adopting measures that respect such regulations. There- fore, the question whether the U.S. will adopt the Right to Be Forgotten has not necessarily reached closure. In this paper I will provide an analysis of the possibility and feasibility of importing the Right to Be Forgotten in the U.S., through the lens of relevant legal cases in the E.U. and U.S. and look at possible solutions that reconcile these conflicting views. 2. BACKGROUND ON G.D.P.R. European lawmakers and courts have a long history of protecting privacy. In 1995, at the time when Internet was still at infancy, the European Council issued the Data Protection Directive13 “on the protection of individuals with regard to the processing of personal data and on the free movement of such data”, which was superseded, in 2016, by a more com- prehensive reform called the General Data Protection Regulation (G.D.P.R.), which enlists provisions that are better suited for the modern technologies and the recent data usage 13. Council of European Union, Directive 95/46/EC, 1995, https://eur-lex.europa.eu/LexUriServ/LexUri Serv.do?uri=CELEX:31995L0046:en:HTML.