“The right will not apply to journalistic archives, comments on articles or posts by bloggers, who will be exempted on the grounds of freedom of expression.” Let’s see how long that freedom lasts.
Via The Guardian:
Britain is attempting to opt out of a European initiative enabling anyone to delete their personal details from online service providers – a power known as the “right to be forgotten”.
The clash between Brussels and the Ministry of Justice has erupted in the final stages of negotiations over the EU’s General Data Protection Regulation, which aims to rebalance the relationship between the individual and the internet.
The debate reflects growing tensions between freedom of expression and privacy as increasing numbers of people complain that their online reputation is being corroded by outdated, inaccurate or malicious information that cannot be removed. In France, the number of complaints concerning the right to be forgotten rose 42% last year. A Guardian project has unearthed hundreds of cases of people alarmed at the mishandling of their data or personal information.
The UK’s chief objection to the EU move is that unrealistic expectations will be created by the right’s expansive title because the controls proposed will be relatively modest in their impact on the way data spreads, or is traded, across websites.
The right to be forgotten, article 17 of the Data Protection Regulation, has been developed by the EU justice commissioner’s office primarily in response to complaints about the way social media, such as Facebook, retain and handle information. Although the terms of the regulation have not yet been finalised, its current form provides for punitive fines – up to 2% of global turnover – for companies that refuse to comply with requests to erase customers’ personal details.
Viviane Reding, the EU justice commissioner, said: “At present a citizen can request deletion only if [data is] incomplete or incorrect. We want to extend this right to make it stronger in this internet world. The burden of proof shall be on the companies. They will have to show that data is needed.
“This piece of legislation is one of the biggest market-openers of the last few years. It eliminates 27 conflicting rules [one for each EU state] and replaces them with … a mechanism for the whole continent. This means saving €2.3bn (£1.9bn) a year.
“[But] the British government have asked us not to do this and [would prefer] two laws: one for Britain and one for other people, meaning there would be separate layers of complication. I have exchanged letters with [the UK justice secretary] Chris Grayling on this, which is rather like Kafka. Britain is meant to oppose red tape; here Britain wants a supplementary layer of red tape. It’s crazy. The UK wants 27 rules – one for each country.”
In a letter to Grayling dated 8 March, Reding wrote: “You raise the possibility of specific rules for SMEs [small and medium-sized enterprises] which operate nationally rather than cross-border.
“I am surprised to learn that it would be the intention of the UK to introduce a new layer of complexity, cost and risk of non-compliance by having one set of obligations for domestic operations and one for cross-border operations.”
The UK is lobbying for the changes to be part of a directive, which would give the government more flexibility about how it is adopted, rather than being contained in a more prescriptive internal market regulation.
Reding, who is from Luxembourg and also a vice-president of the European commission, stressed the new right to be forgotten would “not be absolute” and would be assessed in relation to other rights, such as freedom of expression, retention of medical records or data for tax purposes. It would, for example, permit students who post embarrassing pictures of themselves on social media sites to remove them at a later date. If those images had spread to a third party, however, the right of removal would be significantly diluted: the site that initially held them would be required to contact other sites to which it is linked informing them that a request had been made to erase information.
“[There will be] no power to remove it from third parties but if a company has given it to another [firm] without asking if they can sell it, then the individuals’ rights will be re-enforced.”
The right will not apply to journalistic archives, comments on articles or posts by bloggers, who will be exempted on the grounds of freedom of expression. Material posted by other people – friends or antagonists – would also remain unaffected: there is an exemption in data protection regulations for material of a “personal or household” nature.
Reding added: “The European rules [will] apply to every company … which operates in the internal market. The EU is a large market with 500 million citizens. If you want to take advantage of this goldmine, then apply the rules. Facebook and such providers like the one-stop shop. They like the fact that the rules are the same everywhere. There’s no opt-out. This is an internal market regulation. It’s a decision that will be taken by majority rule.”
The case of the Austrian law student Max Schems, who battled Facebook for months to recover his personal data and eventually received 1,222 pages of material in 2011, is emblematic of the problems Reding believes need addressing. Facebook subsequently altered its data-retention policies as a result of the case.
Ireland, where Google and Facebook’s European headquarters are based, holds the presidency of the EU. It has said that enacting the data protection regulation is a key priority for its presidency, which ends in June.
The UK’s Information Commissioner’s Office agrees that the new regulation will shift the balance between consumers and “data controllers”. But it cautions: “Our concern is about how difficult (or impossible) this may be to achieve in practice and how it could lead individuals to believe falsely that they can achieve the absolute erasure of information about them.
“We know from the efforts of well-resourced and motivated individuals that it can in fact be impossible to remove information from the internet once it has been posted. We are concerned that this right, as billed, could mislead individuals as to the degree of protection the law can offer them in practice.”
The London-based lobby group Privacy International is similarly sceptical. Anna Fielder, one of the organisation’s trustees, said: “We think the right to erasure is essential and that’s likely to stay; the right to delete your information once you have left a service provider. If you left a bank you wouldn’t like them to keep your data for ever.
“But it’s no more than a right to delete your data. It’s got so many exceptions. It’s specifically targeted at Facebook users. For example, photos of drunken teenagers. [Facebook] should try and make all the people who have shared the data remove it as well. [But] it’s not a compulsion. It has so many exceptions: freedom of expression, public interest in public health and scientific research.”
The MoJ said: “The UK does not support the right to be forgotten as proposed by the European commission. The title raises unrealistic and unfair expectations of the proposals.
“We are also concerned about potentially impossible requirements for data controllers to manage third-party erasure; the ‘reasonable steps’ required by the draft regulation would promise much, but deliver little.”
Stewart Room, a privacy specialist at the law firm Field Fisher Waterhouse, said article 17 covers where consent is withdrawn for information being held. “This is intended to address the idea that a kid may stick something on Facebook and later on there should be a way of taking it down.
“In Silicon Valley, there’s a lot of venture capital going into tech companies that can achieve erasure of data. There’s a lot of demand in the market for cleansing online information.”
Richard Allan, Facebook’s director of policy for Europe, Middle East and Africa, said: “The core concept that you as a data subject should be able to delete your personal data is absolutely reasonable. It’s something we implement on our service.
“[But] we have concerns about about the workability and consequences of a mechanism where organisations start sending each other instructions about data that needs to be removed. Our worry is that it will take up resources and won’t be effective.”
Individuals, he said, should approach data controllers directly to ask for material to be removed. Facebook, which has a billion users, has a social reporting mechanism that allows users to request that material is taken down from other accounts on the site, Allan said. “Our users like the mechanism.
“We think the most responsible service providers will offer the right to erasure. Where people are dealing with irresponsible service providers it may be that the national data protection authorities take action.”
A different legal development that could be equally far-reaching emerged in a UK court of appeal judgment this year in the case of Tamiz vs Google, which ruled that, in principle, the internet search engine may also be a publisher and therefore liable to defamation proceedings for material on a blog hosted on one of its platforms.