In May 13, 2014 the Court of Justice of the European Union (ECJ) held in Google Spain v. Agencia Española de Protección de Datos that search engines must consider requests from individuals to remove links that reference the name of the requesting individual.[1] Across the Atlantic, just a year before, the California legislature passed SB 568.[2] In its own words, the bill grants “privacy rights to California minors in the digital world.[3] In doing so, California became the first American state to require website operators to allow minors to remove information that they had previously posted to a website.[4] Together, these developments represent a movement toward recognition of the right to erase personal information from the Internet – more widely known as the “right to be forgotten.”  The recognition of these rights is controversial; it has not been, and perhaps could not be, universal. American freedom of speech jurisprudence, for example, is especially strong and could be fatal to domestic establishment of a similar right.

This tradition, however, has not deterred California from enacting its own right to be forgotten, albeit abridged and targeted towards minors. SB 568, dubbed the “eraser law” by the media, reflects California’s status as a leader in data privacy law.[5]  Section 22581(a)(1) stipulates that website operators shall “permit [minors] to remove or request and obtain removal of content or information posted on the [website]”, as well as provide notice of such ability and clear instruction on how to do so.[6] Section 22581(b)(1)-(5) lists exceptions- most importantly, for information that is required by federal or state law to be disclosed, content posted by third parties on such websites, information that is anonymized, and for minors that are compensated for the content they pose.[7]

Domestic U.S. groups including the Electronic Frontier Foundation (EFF) and the Center for Democracy and Technology (CDT) have been critical of both the Google Spain v. AEPD ruling and SB 568.[8] Citing concerns ranging from implementation and practicality to structural and rights-based issues, these criticisms highlight the complex nature of the discussion on digital rights – an area in which practicality, in both pragmatically and technically, intertwine with conceptual rights. However, complexity should not deter an important discussion. The advent of practices such as doxxing (the broadcasting of personal identifiable information about individuals), cyber-bullying, cyber-stalking, and other attacks unique to the data on the Internet have given rise to this discussion. Consequently, we must ask whether the “right to be forgotten” is the right solution to these problems.

Broadly, the issue with the right to be forgotten is that it is essentially a limit on the corner stone human right to freedom of expression.[9] Of course, this is not an absolute right: even the exceptionally strong American tradition, stemming from the First Amendment, bears certain exceptions: libel and slander, incitement, obscenity, child pornography, threats, and fighting words.[10] Similarly, the rights enjoyed by public actors and certain types of broadcaster are also not given the same breadth of speech rights.[11] These exceptions to the American constitutional right to speech is reflective of value decisions made over centuries balancing free speech against a broad number of other competing interests. Other democracies have opted to carve out more exceptions.[12] For example, in the Canadian legal tradition, freedom of expression is not absolute, and is subject to “reasonable limits.”[13] Such limits must take into account that some versions of speech are “more central to constitutional guarantees than others.”[14] Ultimately, a discussion about limiting free speech requires inquiry into the type of speech it is, and cannot reasonably be a blanket ban.

In Google Spain v. AEPD, the ECJ ruled that Google (and other search engine providers) have a responsibility to delete links concerning personal information upon request as long as the links are not relevant or in the public interest. In response to the ruling, Google has been complying with takedown requests by weighing each on a case-by-case basis, balancing the “right to be forgotten [with] the public’s right to the information.”[15]

However, the AEPD ruling gave Google no real instruction on how to comply with the requests. Google has essentially had to create their own process on how to obey the takedown requests, in which the company attempts to balance the public’s right by categorizing the individual as a private or a public individual, and then categorizing the information based off of its weaker or stronger privacy interest.[16] It seems absurd that a private institution is essentially given the responsibility of setting their own guidelines for the takedown requests, considering that the ECJ ruling essentially asks Google to balance deeply important human rights in their processing of these requests.[17] The CDT published an article criticizing the right to be forgotten, arguing “it is the role of legislatures and ultimately to ensure that human rights are protected and respected [and] to address conflicts where they arise between right.”[18]

The Google Spain ruling also poses structural issues. Because there are no clear guidelines as to how to obey the right to be forgotten, particularly litigious individuals can still choose to sue Google to get their information removed, should their request through Google’s process be denied.[19] These unclear boundaries can easily lead Google to decide that the cost of litigation is not worth it, and accept more takedown requests than it reasonably should. Such litigation, on top of the burden of being mandated to police their own website, is particularly unfair strain to push onto a private actor, no matter how important they are in today’s world. The right to be forgotten forces Google to answer difficult questions about speech rights and human rights that should not be answered by a private actor, and react in ways that are not necessarily in the best interests of speech rights.

That being said, these problems are not fatal to the right to be forgotten. The European Commission could pass a directive clarifying how to comply best comply with the Google Spain v. AEPD ruling. It could also attempt to eliminate any cause of action against Google by creating a separate type of procedure for takedown requests, such as creating an arbitration body, for such takedown requests.[20]

California’s SB 568, on the other hand, is a much narrower limitation on speech rights. SB 568 limits the right to be forgotten to allowing all minors to delete personal information about them that appears on the Internet. The Internet and social media have become a core part of minors’ lives, with 95% of all teens having an online presence.”[21] In light of issues such as cyber-bullying, and the unfairness of allowing someone’s childhood to impact their future, it is sensible to give such a narrow band of people the right to be forgotten. Such a narrowly carved out exception makes more sense than a broader right to be forgotten, though.

The right to be forgotten highlights many of the themes central to the intersection of the Internet and laws. For example, although Google may be a private actor, its status as the world’s primary search engine may require that we force it to adhere to certain governmental regulations. Given that the Internet is now so ubiquitous to everyday life, it is clear that some individuals’ previous conception of the Internet as an anonymous crypto-anarchic haven be reexamined. However, on the other hand, any regulations must be considered within the scope of the technical capabilities that we have to regulate content on the Internet and the realities of how people behave when using the Internet. Proxies and VPNs, for example, remain popular ways to circumvent domestic Internet filtering. Whether the right to be forgotten as conceived by the ECJ will ever extend outside of Europe remains to be seen.

 


 

[1] C-131/12, Google Spain v. Agencia Española de Protección de Datos, not yet reported.

[2] SB-568, California, http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140SB568

[3] Id.

[4] Lee, James, SB 568; Does California’s Online Eraser Button Protect the Privacy of Minors?, 48 UCD L. Rev. 1173

[5] Shaheen, Randy and Arredondo-Santistebar, Laura. California Enacts Law Protecting Minors’ Digital Privacy Rights. Venable LLP, (November 24, 2014)

[6] SB-568.

[7] Id.

[8] O’Brien, Danny and York, Jillian. Rights That Are Being Forgotten: Google, the ECJ, and Free Expression. Electronic Frontier Foundation, (July 8, 2014)

[9] Universal Declaration of Human Rights. United Nations, (16 December, 1948)

[10] Ruane, Kathleen. Freedom of Speech and Press: Exceptions to the First Amendment. Congressional Research Service, (September 8, 2014).

[11] The FCC and the Freedom of Speech. Federal Communications Commission, (October 17, 2014)

[12] For example, unlike the US, Canada, France, and Germany all have exemptions for hate speech.

[13] Canadian Charter of Rights and Freedoms, Part I of the Constitutional Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11.

[14] W.S. Tarnopolsky, The Canadian Bill of Rights, 2d ed. (Toronto: McClelland and Stewart, 1975).

[15] Floridi, Luciano et. al, The Advisory Council to Google on the Right to be Forgotten, Google, (November 4, 2014)

[16] Id.

[17] C-131/12, Google Spain v. Agencia Española de Protección de Datos, not yet reported.

[18] On the “Right to be Forgotten”; Challenges and Suggested Changes to the Data Protection Regulation, Center for Democracy and Technology, (May 2, 2013) <https://www.cdt.org/files/pdfs/CDT-Free-Expression-and-the-RTBF.pdf>

[19] Id.

[20] On the “Right to be Forgotten”; Challenges and Suggested Changes to the Data Protection Regulation, Center for Democracy and Technology, (May 2, 2013) <https://www.cdt.org/files/pdfs/CDT-Free-Expression-and-the-RTBF.pdf>

[21] Madden, Mary et. al. Teens and Technology 2013, Pew Research Center, (March 13, 2013). < http://www.pewinternet.org/2013/03/13/teens-and-technology-2013/>