Skip to main content

Forget Me, Forget Me Not - Redefining the Boundaries of the Right to Be Forgotten to Address Current Problems and Areas of Criticism

  • Conference paper
  • First Online:
Privacy Technologies and Policy (APF 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10518))

Included in the following conference series:

Abstract

In the landmark decision Google Spain v AEPD and Mario Costeja González, the Court of Justice of the European Union has declared that individuals have a so-called ‘right to be forgotten’, that is, the right to demand search engines to erase search results obtained through searches for their names. The ruling has been praised by many and seen as a welcome relief for individuals who were gradually losing all control over the private information stored about them online. However, because the court has failed to provide proper guidance as to the application and scope of the new right, the ruling has opened risks to freedom of expression and the right to receive and impart information as well as introduced questions as to the legitimacy, fairness and international scope of the delisting process. Taking a closer look at the problems currently surrounding the right to be forgotten, this paper will attempt to narrow down and define the scope of the application of the new right. In order to do so, it will first argue that personal information should be predominantly protected by reliance on existing laws rather than through the creation of an ambiguous right to delist search results. It will then advocate for a rejection of the court’s broad formulation of the right to be forgotten and suggest that, in order to attain a fairer balance between the fundamental rights at stake, the right should be only permitted to apply in three, clearly defined and limited circumstances.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    ‘Personal data’ is defined in Directive, Art. 2(a) and GDPR, Art. 4(1). ‘Processing’ is defined in Directive, Art. 2(b) and GDPR, Art. 4(2).

  2. 2.

    ‘Controller’ is defined in Directive, Art. 2(d) and GDPR, Art. 4(7).

  3. 3.

    See, e.g. the website http://hiddenfromgoogle.afaqtariq.com/ which archives deleted links and displays them together with the relevant search term and the source that revealed the de-listed information.

  4. 4.

    Charter of Fundamental Rights of the European Union, Art. 11(1); European Convention on Human Rights, Art. 10.

  5. 5.

    Note that the European Convention on Human Rights does not contain a right to data protection but the ECHR largely includes such right in the Art. 8 right to respect for private life.

  6. 6.

    The EU Justice Commissioner stated that the RtbF must not ‘take precedence over freedom of expression or freedom of the media’ [20].

  7. 7.

    See also GDPR, Recital 65.

  8. 8.

    See [22,23,24] for a discussion of the problems associated with criterion 2 set out by the Article 29 Data Protection Working Party in its guidelines on the Google Spain decision [25].

  9. 9.

    The further retention of the personal data will be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

  10. 10.

    See, e.g. criterion 9 set out by the Article 29 Data Protection Working Party [25] and criterion 4.2.1.6 set out in the report prepared by The Advisory Council to Google on the Right to be Forgotten [26].

  11. 11.

    See, e.g. criterion 8 of Article 29 Data Protection Working Party [25] and criterion 4.2.2.6 of The Advisory Council to Google [26].

  12. 12.

    Since Google Spain, Google has evaluated over 1,835,005 URLs [34].

  13. 13.

    See also [7, 21].

  14. 14.

    Note that the term ‘RtbF’ is not used, even once, in that document.

  15. 15.

    See Sect. 2.2.

  16. 16.

    See also Shoor [26]; Code Civil (French Civil Code), arts. 9-10 and Grundgesetz für die Bundesrepublik Deutschland (Basic Law for the Federal Republic of Germany), §1–2.

  17. 17.

    See, e.g. the Rehabilitation of Offenders Act 1974. Note also the existence of the so-called ‘Mary Bell injunctions’ protecting the identity of offenders discussed, e.g. by Whitehead [48].

  18. 18.

    See also Graux, Ausloos and Valcke [58].

  19. 19.

    See also Rosen [66].

  20. 20.

    For example, an overwhelming number of people in Japan use pseudonyms on social network sites [68]. See also Madden [69] and note the option of using services providing expiration dates for data as discussed by Mayer-Schönberger [70].

  21. 21.

    See also Microsoft’s report on revenge porn removal requests on Bing [75].

  22. 22.

    See criteria 4.2.1.3 and 4.2.1.6 of the report prepared by The Advisory Council to Google [26].

  23. 23.

    This appears to be an apt conclusion considering that Google accounts for 93% of online and mobile search traffic worldwide [77].

  24. 24.

    See also the recent decision of the Brazilian courts not to recognise a RtbF, as discussed by Sganzerla [79].

References

  1. Internet Live Stats. http://www.internetlivestats.com. Accessed 28 Nov 2016

  2. Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. EMLR 27 (2014)

    Google Scholar 

  3. Brock, G.: The Right To Be Forgotten: Careless, Muddled And Risky (European Journalism Observatory, 13 October 2016) (2016). http://en.ejo.ch/media-politics/the-right-to-be-forgotten-careless-muddled-and-risky. Accessed 15 Nov 2016

  4. Siry, L.: Forget me, forget me not: reconciling two different paradigms of the right to be forgotten. Ky LJ 3(103), 311 (2015)

    Google Scholar 

  5. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. OJ L281/31 (1995)

    Google Scholar 

  6. de Azevedo Cunha, M.V., Itagiba, G.: Between privacy, freedom of information and freedom of expression: is there a right to be forgotten in Brazil? CLSR 32(4), 634 (2016)

    Google Scholar 

  7. House of Lords: European Union Committee, 2nd Report of 2015, ‘EU Data Protection law: a ‘right to be forgotten’?’, HL Paper 40 (2015)

    Google Scholar 

  8. Posner, E.: We All Have the Right to Be Forgotten (Slate, 14 May 2014) (2014). http://www.slate.com/articles/news_and_politics/view_from_chicago/2014/05/the_european_right_to_be_forgotten_is_just_what_the_internet_needs.html. Accessed 14 Nov 2016

  9. Bradley, P.: Data, data everywhere. LIM 14(4), 249 (2014)

    Article  Google Scholar 

  10. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). OJ L 199/1 (2016)

    Google Scholar 

  11. van Alsenoy, B., Kuczerawy, A., Ausloos, J.: Search engines after Google Spain: internet@liberty or privacy@peril? KU Leuven Interdisciplinary Centre for Law & ICT. https://ssrn.com/abstract=2321494. Accessed 8 Oct 2016

  12. Guadamuz, A.: Who Wants to be Forgotten? (Society for Computers & Law, 14 October 2014) (2014). http://www.scl.org/site.aspx?i=ed38893. Accessed 24 Oct 2016

  13. Peguera, M.: In the aftermath of Google Spain: how the “right to be forgotten” is being shaped in Spain by courts and the Data Protection Authority. IJLIT 23, 325 (2015)

    Google Scholar 

  14. Kulk, S., Borgesius, F.Z.: Google Spain v. González: did the court forget about freedom of expression? EJRR 5(3), 289 (2014)

    Google Scholar 

  15. Case C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy. ECR I-9831 (2008)

    Google Scholar 

  16. Case C-101/01 Lindqvist v Aklagarkammaren i Jonkoping. ECR I-12971 (2003)

    Google Scholar 

  17. Case No 24061/04 Aleksey Ovchinnikov v Russia (2011)

    Google Scholar 

  18. Case No 35841/02 Österreichischer Rundfunk v Austria (2006)

    Google Scholar 

  19. Case No 39954/08 Axel Springer AG v Germany (2012)

    Google Scholar 

  20. Reding, V.: The EU Data Protection Reform 2012: Making Europe the Standard Setter for Modern Data Protection Rules in the Digital Age’ (European Commission, 22 January 2012) (2012). http://europa.eu/rapid/press-release_SPEECH-12-26_en.htm. Accessed 12 Oct 2016

  21. Article 19: Policy Brief – The “Right to be Forgotten”: Remembering Freedom of Expression. https://www.article19.org/resources.php/resource/38318/en/policy-brief:-the-right-to-be-forgotten. Accessed 5 Oct 2016

  22. Sartor, G.: The right to be forgotten: balancing interests in the flux of time. IJLIT 24, 72 (2016)

    Google Scholar 

  23. Korenhof, P., Ausloos, J., Szekely, I., Ambrose, M., Sartor, G., Leenes, R.: Timing the right to be forgotten: a study into “Time” as a factor in deciding about retention or erasure of data. In: Gutwirth, S., Leenes, R., de Hert, P. (eds.) Reforming European Data Protection Law. LGTS, vol. 20, pp. 171–201. Springer, Dordrecht (2015). doi:10.1007/978-94-017-9385-8_7

    Google Scholar 

  24. McNealy, J.: The emerging conflict between newsworthiness and the right to be forgotten. N Ky L Rev. 39, 119 (2012)

    Google Scholar 

  25. Article 29: Data Protection Working Party, ‘Guidelines on the implementation of the Court of Justice of the European Union judgement on “Google Spain and INC v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González” C-131/12’. WP225, 26 November 2014

    Google Scholar 

  26. The Advisory Council to Google on the Right to be Forgotten, 6 February 2015. https://www.google.com/advisorycouncil. Accessed 12 Oct 2016

  27. Fraser, D.: You’d better forget the right to be forgotten in Canada (Canadian Privacy Law Blog, 28 April 2016) (2016). http://blog.privacylawyer.ca/2016/04/youd-better-forget-right-to-be.html. Accessed 25 Oct 2016

  28. Lee, D.: Google reinstates ‘forgotten’ links after pressure (BBC News, 4 July 2014) (2014). http://www.bbc.co.uk/news/technology-28157607. Accessed 4 Oct 2016

  29. Gratton, E.: Challenges with the Implementation of a Right to be Forgotten in Canada (Eloïse Gratton, 28 April 2016) (2016). http://www.eloisegratton.com/blog/2016/04/28/challenges-with-the-implementation-of-a-right-to-be-forgotten-in-canada/. Accessed 25 Oct 2016

  30. Trillmich, P., Hickman, T.: UK ICO recommends personal liability of directors for breaches of data protection law (Lexology, 27 October 2016) (2016). http://www.lexology.com/library/detail.aspx?g=45767c9b-1759-456b-b77c-8e4100302fa3. Accessed 9 Nov 2016

  31. Shoor, E.: Narrowing the right to be forgotten: why the European Union needs to amend the proposed data protection regulation. Brook J. Int. L. 39(1), 487 (2014)

    Google Scholar 

  32. Lee, E.: Judge Google: Why the EU Should Embrace Google’s Role in the Right to Be Forgotten (The Huffington Post, 5 July 2015) (2015). http://www.huffingtonpost.com/edward-lee/judge-google-why-the-eu-s_b_7232688.html. Accessed 24 Oct 2016

  33. Kuner, C.: The Court of Justice of the EU Judgement on Data Protection and Internet Search Engines, LSE Law, Society and Economy Working Papers 3/2015. https://www.lse.ac.uk/collections/law/wps/WPS2015-03_Kuner.pdf. Accessed 12 Oct 2016

  34. Google: Transparency Report: European privacy requests for search removals’ (Google, 26 December 2016) (2016). https://www.google.com/transparencyreport/removals/europeprivacy/?hl=en>. Accessed 26 Dec 2016

  35. Kerr, J.: What is a search engine? The simple question the court of justice of the European Union forgot to ask and what it means for the future of the right to be forgotten. Chi J. Int. L. 17(1), 217 (2016)

    Google Scholar 

  36. Kaye v Robertson. FSR 62 (1991)

    Google Scholar 

  37. OBG Ltd. v Allan. UKHL 21 (2007)

    Google Scholar 

  38. Peck v UK. ECHR 44 (2003)

    Google Scholar 

  39. CTB v News Group Newspapers Ltd. EWHC 1326 (2011)

    Google Scholar 

  40. Murray v Big Pictures (UK) Ltd. EWCA Civ 446 (2008)

    Google Scholar 

  41. Campbell v MGN Limited. UKHL 22 (2004)

    Google Scholar 

  42. Applause Store Productions Ltd. v Raphael. EWHC 1781 (2008)

    Google Scholar 

  43. Prince Albert v Strange. 47 ER 1302 (1849)

    Google Scholar 

  44. Lachaux v Independent Print Ltd. EWHC 620 and the Defamation Act 2013 (2015)

    Google Scholar 

  45. Edmund Irvine v Talksport Ltd. 2 All ER 414 (2002)

    Google Scholar 

  46. Ratcliffe v Evans. 2 QB 524 (1892)

    Google Scholar 

  47. Pagallo, U., Durante, M.: Legal memories and the right to be forgotten. In: Floridi, L. (ed.) Protection of Information and the Right to Privacy - A New Equilibrium?. LGTS, vol. 17, pp. 17–30. Springer, Cham (2014). doi:10.1007/978-3-319-05720-0_2

    Chapter  Google Scholar 

  48. Whitehead, T.: Venables protected by rare identity ban (The Telegraph, 4 March 2010) (2010). http://www.telegraph.co.uk/news/uknews/law-and-order/7361451/Venables-protected-by-rare-identity-ban.html. Accessed 3 Dec 2016

  49. Information Commissioner’s Office: Information Commissioner’s Office, ‘Bankruptcy’. https://ico.org.uk/for-the-public/bankruptcy/. Accessed 12 Oct 2016

  50. Conway, L.: Discharge from bankruptcy (House of Commons Library, 8 October 2015) (2015). http://researchbriefings.parliament.uk/ResearchBriefing/Summary/SN03043. Accessed 12 Oct 2016

  51. Klug, F., Starmer, K., Weir, S.: The Three Pillars of Liberty: Political Rights and Freedoms in the United Kingdom. Routledge, London (1996)

    Google Scholar 

  52. Public Order Act 1986

    Google Scholar 

  53. Obscene Publications Act 1959

    Google Scholar 

  54. Obscene Publications Act 1964

    Google Scholar 

  55. Protection of Children Act 1978

    Google Scholar 

  56. Terrorism Act 2006

    Google Scholar 

  57. Ambrose, M., Ausloos, J.: The right to be forgotten across the pond. J. Inf. Policy 3, 1 (2012)

    Google Scholar 

  58. Graux, H., Ausloos, J., Valcke, P.: The Right to be Forgotten in the Internet Era (ICRI Working Paper, 12 November 2012) (2012). https://ssrn.com/abstract=2174896. Accessed 27 Oct 2016

  59. Mosley v News Group Newspapers Ltd. EWHC 1777 (2008)

    Google Scholar 

  60. Facebook: How do I hide or delete posts I’ve shared from my Page? https://www.facebook.com/help/252986458110193. Accessed 12 Nov 2016

  61. Korea Communications Commission: KCC Takes Measures to Guarantee “Right to be Forgotten”. http://eng.kcc.go.kr/download.do?fileSeq=43299. Accessed 14 Oct 2016

  62. California Penal Code. §647 (2014)

    Google Scholar 

  63. Bolton, R.L.: The right to be forgotten: forced amnesia in a technological age. J. Marshall J. Inf. Technol. Priv. L. 31, 133 (2015)

    Google Scholar 

  64. Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) COM. 11 final (2012)

    Google Scholar 

  65. Charter of Fundamental Rights of the European Union. Art. 1

    Google Scholar 

  66. Rosen, J.: The right to be forgotten. Stan. L. Rev. Online 64, 88 (2012)

    Google Scholar 

  67. Sellars, S.: Online privacy: do we have it and do we want it? A review of the risks and UK case law. EIPR 33(1), 9 (2011)

    Google Scholar 

  68. Tabuchi, H.: Facebook Wins Relatively Few Friends in Japan (The New York Times, 9 January 2011) (2011). http://www.nytimes.com/2011/01/10/technology/10facebook.html. Accessed 8 Dec 2016

  69. Madden, M.: Privacy management on social media sites (Pew Research Centre, 24 February 2012) (2012). http://www.pewinternet.org/2012/02/24/privacy-management-on-social-media-sites. Accessed 30 Nov 2016

  70. Mayer-Schönberger, V.: Delete: The Virtue of Forgetting in the Digital Age. Princeton University Press (2009). or Weber, R.: The right to be forgotten – more than an Pandora’s Box? JIPITEC. 2, 120 (2011). http://www.jipitec.eu/issues/jipitec-2-2-2011/3084. Accessed 12 Oct 2016

  71. Ambrose, M.: It’s about time: privacy, information life cycles, and the right to be forgotten. Stan. Technol. L. Rev. 16(3), 101 (2013)

    Google Scholar 

  72. BBC News: Internet trolls targeted with new legal guidelines (BBC News, 10 October 2016) (2016). http://www.bbc.co.uk/news/uk-37601431. Accessed 14 Oct 2016

  73. Garsd, J.: Internet Memes and “The Right To Be Forgotten” (NPR, 3 March 2015) (2015). http://www.npr.org/sections/alltechconsidered/2015/03/03/390463119/internet-memes-and-the-right-to-be-forgotten. Accessed 24 Oct 2016

  74. Google: Remove “revenge porn” from Google. https://support.google.com/websearch/answer/6302812. Accessed 4 Dec 2016

  75. Microsoft: Content Removal Requests Report. https://www.microsoft.com/about/csr/transparencyhub/crrr/. Accessed 10 Dec 2016

  76. Angelo, M.: You Are What Google Says You Are (Wired, 2 November 2009) (2009). https://www.wired.com/2009/02/you-are-what-go. Accessed 12 Nov 2016

  77. eMarketer: How Much Search Traffic Actually Comes from Googling? (eMarketer, 13 January 2015) (2015). https://www.emarketer.com/Article/How-Much-Search-Traffic-Actually-Comes-Googling/1011814. Accessed 30 Nov 2016

  78. Yan, M.N.: Protecting the right to be forgotten: is mainland China ready? Eur. Data Prot. L. Rev. 1, 190 (2015)

    Article  Google Scholar 

  79. Sganzerla, T.: Brazil Superior Court Rules in Google’s Favor, Against “Right to Be Forgotten” (advox, 21 November 2016) (2016). https://advox.globalvoices.org/2016/11/22/brazil-superior-court-rules-in-googles-favor-against-right-to-be-forgotten/. Accessed 12 Dec 2016

  80. Toobin, J.: The Solace of Oblivion - in Europe, the right to be forgotten trumps the Internet (The New Yorker, 29 September 2014) (2014). http://www.newyorker.com/magazine/2014/09/29/solace-oblivion. Accessed 12 Oct 2016

  81. Cunningham, M.: Free Expression, Privacy and Diminishing Sovereignty in the Information Age: The Internationalization of Censorship. Arkansas Law Review (2015). https://ssrn.com/abstract=2706730. Accessed 14 Oct 2016

  82. Werro, F.: The right to inform v the right to be forgotten: a transatlantic clash. In: Ciacchi, A.C., et al. (eds.) Liability in the Third Millennium. FRG (2009)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Beata Sobkow .

Editor information

Editors and Affiliations

Appendix

Appendix

1. Directive 95/46/EC

Article 12 - Right of Access

Member States shall guarantee every data subject the right to obtain from the controller:

  1. (a)

    […];

  2. (b)

    as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;

  3. (c)

    notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.

Article 14 - The Data Subject’s Right to Object

Member States shall grant the data subject the right:

  1. (a)

    at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data; […].

2. Google Spain v AEPD and Mario Costeja González

94. Therefore, if it is found, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of the directive because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.

3. Regulation (EU) 2016/679

Recitals

(65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ […]. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. […]

Article 17 - Right to Erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  1. (a)

    the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  2. (b)

    the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

  3. (c)

    the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

  4. (d)

    the personal data have been unlawfully processed;

  5. (e)

    the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

  6. (f)

    the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. […]

Article 19 - Notification Obligation Regarding Rectification or Erasure of Personal Data or Restriction of Processing

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Sobkow, B. (2017). Forget Me, Forget Me Not - Redefining the Boundaries of the Right to Be Forgotten to Address Current Problems and Areas of Criticism. In: Schweighofer, E., Leitold, H., Mitrakas, A., Rannenberg, K. (eds) Privacy Technologies and Policy. APF 2017. Lecture Notes in Computer Science(), vol 10518. Springer, Cham. https://doi.org/10.1007/978-3-319-67280-9_3

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-67280-9_3

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-67279-3

  • Online ISBN: 978-3-319-67280-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics