Abstract
After an evaluation of the current regulatory framework, this chapter addresses the fundamental role of the right to be forgotten in European Union legislation. The chapter will first analyse the pros and cons of current legislation, i.e. the Data Protection Directive, and, second, address the relevance of the proposed Data Protection Regulation. Based on the conflict between the right to oblivion on the one hand and freedom of speech, the right to memory and marketing purposes on the other, we conclude by proposing possible solutions for the enforcement of the right to be forgotten, assuming that a universal solution for a concrete right to oblivion requires not only a strong legislative basis but also economical and technical costs.
Rachele Ciavarella is a lawyer with ICT Legal Consulting Law Firm and a Blue Book Trainee at EU Commission DG CNECT Unit H4 Trust and Security. Cécile De Terwangne is a professor at the Law Faculty of the University of Namur (Belgium) and Research Director in the ‘Freedoms in the Information Society’ Unit of the Research Centre in Information, Law and Society (CRIDS—University of Namur).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
For the purposes of this document, the term “young people” will refer to legal minors. The meaning of legal minor depends on the jurisdiction in which the service is offered; normally this refers to users under 18 or 16 years of age. However, in the General Data Protection Regulation (see infra), while Article 4(18) states that ‘child’ means any person below the age of 18 years, Article 8.1 (Processing of personal data of a child) outlines that the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child’s parent or custodian.
- 2.
Casarosa 2010, available at http://ssrn.com/abstract=1561570.
- 3.
Livingstone et al. 2011, available at http://www2.lse.ac.uk/media@lse/research/EUKidsOnline/ShortSNS.pdf.
- 4.
EU Kids Online is a multi-national thematic network, founded by the EC Safer Internet Programme, that aims to stimulate and coordinate investigation into the use of new media by children, www2.lse.ac.uk/media@lse/research/EUKidsOnline/Home.aspx.
- 5.
Walz 1997, p. 3.
- 6.
For an example of reported cases about people seeking to have their data deleted from a social network and facing practical difficulties, see http://online.wsj.com/article/SB10001424052748703396604576087573944344348.html.
- 7.
See for example Mayer-Schönberger 2009.
- 8.
Legrand and Bellamy 2012, www.lesnumeriques.com/divers/touche-pas-a-e-reputation-enquete-a1548.html.
- 9.
‘Personal data’ means ‘any information relating to an identified or identifiable natural person (“data subject”)’ (Article 2, a) of the directive 95/46).
- 10.
Directive 95/46/CE of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ, 23 November 1995, L281/31.
- 11.
Reding 2010.
- 12.
Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), 2012/0011 (COD).
- 13.
European Commission Communication, ‘A comprehensive approach on personal data protection in the European Union’, 4 November 2010, COM (2010) 609 final, p. 8.
- 14.
Informational self-determination means control over one’s personal information, that is to say the individuals’ right to decide which information about themselves will be disclosed, to whom and for which purpose. See De Terwangne 2012, p. 112, also available at www.idp.uoc.edu.
- 15.
See Rouvroy 2008, available at http://works.bepress.com/antoinette_rouvroy/5/.
- 16.
On the risk of de-contextualisation in SNS, see Dumortier 2009, available at http://works.bepress.com/franck_dumortier/1.
- 17.
De Terwangne 2012, p. 112 and 117, also available at www.idp.uoc.edu.
- 18.
Moiny 2012.
- 19.
Copeland 2012, p. 1.
- 20.
De Terwangne 2012, p. 110.
- 21.
Article 6(1)(b), (e) of the 95/46 Directive.
- 22.
De Terwangne 2012, p. 114.
- 23.
Article 24 of the 95/46 Directive.
- 24.
A “controller” is “the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; […]” (Article 2, d) of the Directive.
- 25.
Article 14(1)(b) of the 95/46 Directive.
- 26.
Copeland 2012, p. 4.
- 27.
COM(2010)609 final.
- 28.
Van Alsenoy et al. 2009, pp. 65–79.
- 29.
Gomes de Andrade 2012, p. 124.
- 30.
Article 17.1. The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child, where one of the following grounds applies: (a) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or when the storage period consented to has expired, and where there is no other legal ground for the processing of the data; (c) the data subject objects to the processing of personal data pursuant to Article 19; (d) the processing of the data does not comply with this Regulation for other reasons. (emphasis added).
- 31.
Article 17 is entitled “Right to be forgotten and to erasure”. One could wonder whether Article 17 establishes two separate rights. This is not the case as these two rights are merged in the view of the authors of the Regulation Proposal (see recital 54: “To strengthen the ‘right to be forgotten' in the online environment, the right to erasure should also be extended […].” Also Opinion of the European Data Protection Supervisor on the data protection reform package (7 March 2012, point 146): “The right to erasure has been strengthened into a right to be forgotten to allow for a more effective enforcement of this right in the digital environment”.
- 32.
Article 19.1 of the Regulation Proposal states: “The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data which is based on points (d), (e) and (f) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject”.
- 33.
Recital 53 (emphasis added).
- 34.
European Parliament, Draft Report on the Proposal for a General Data Protection Regulation, Committee on Civil Liberties, Justice and Home Affairs, Rapporteur: Jan Philipp Albrecht, 17 December 2012, Amendment 34.
- 35.
Opinion of the European Data Protection Supervisor of the data protection reform package, 7 March 2012, p. 148.
- 36.
Opinion of the European Data Protection Supervisor of the data protection reform package, 7 March 2012, p. 147.
- 37.
Koops 2011, available at www.ssrn.com.
- 38.
- 39.
ECJ, 6 November 2003 (Lindqvist), C-101-01, Rec. p. I-12971, § 47.
- 40.
Article 29 Data Protection Working Party, Opinion 5/2009 on online social networking, WP 163, p. 6.
- 41.
ECJ, 16 December 2008, Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy, C-73/07. See comment of this case by De Terwange 2008, Satakunnan Markkinapörssi Oy et Satamedia Oy, Affaire C-73/07, R.D.T.I., 2010, n° 38, pp. 132–146.
- 42.
Article 29 Data Protection Working Party, Opinion 5/2009 on online social networking, WP 163, p. 6.
- 43.
In Google’s legal advisor’s view, there should be no expectation of privacy on the Internet and the right to oblivion represents the biggest threat to Internet free speech in our time, http://peterfleischer.blogspot.com/2011/03/foggy-thinking-about-right-to-oblivion.html; see also Mayes 2011.
- 44.
Gomes de Andrade 2012, p. 130.
- 45.
- 46.
De Terwangne 2012, p. 117.
- 47.
- 48.
Opinion of the European Data Protection Supervisor on the data protection reform package, 7 March 2012, p. 24 and Article 29 Working Party Opinion 01/2012 on the data protection reform proposals, 23 March 2012, WP 191, p. 13.
- 49.
Also Article 17, § 7: “The controller shall implement mechanisms to ensure that the time limits established for the erasure of personal data and/or for a periodic review of the need for the storage of the data are observed.”
- 50.
- 51.
Recommendation CM/Rec(2012)4 of the Committee of Ministers to member States on the protection of human rights with regard to social networking services.
References
Casarosa F (2010) Child privacy protection online: how to improve it through code and self-regulatory tools. http://ssrn.com/abstract=1561570
Copeland N (2012) Online privacy: the right to be forgotten. Library of the European parliament
Daly S (2011) Le doit a l’oubli—can we achieve ‘oblivion’ on the internet? http://emergingbusinessadvocate.wordpress.com/2011/03/15/le-doit-a-loubli-can-we-achieve-oblivion-on-the-internet/
De Terwangne C (2012) Internet privacy and the right to be forgotten/right to oblivion. Revista de internet, derecho y politica, pp 109–121. www.idp.uoc.edu
Dumortier F (2009) Facebook and risks of ‘de-contextualization’ of information. http://works.bepress.com/franck_dumortier/1
ENISA (2012) The right to be forgotten—between expectations and practice. https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/the-right-to-be-forgotten/
European Commission (2010) A comprehensive approach on personal data protection in the European Union. COM (2010) 609 final
Gomes de Andrade NN (2012) Oblivion: the right to be different…from oneself reproposing the right to be forgotten. Revista de internet, derecho y politica
Koops B-J (2011) Forgetting footprints, shunning shadows. A critical analysis of the ‘right to be forgotten’ in big data practice. www.ssrn.com
Legrand F, Bellamy A (2012) Touche pas à ma e-réputation! Enquête. www.lesnumeriques.com/divers/touche-pas-a-e-reputation-enquete-a1548.html
Livingstone S, Haddon L, Görzig A, Ólafsson K (2011) Risks and safety on the internet: the perspective of European children. Full findings. LSE, EU kids online, London
Mayer-Schönberger V (2009) Delete—the virtue of forgetting in the digital age. Princeton University Press, Princeton
Mayes T (2011) We have no right to be forgotten online. The Guardian. www.theguardian.com/commentisfree/libertycentral/2011/mar/18/forgotten-online-european-union-law-internet
Moiny JP (2010) Facebook au regard des règles européennes concernant la protection des données. Eur J Consumer Law, 2: 235–271
Moiny JP (2012), Cloud based social network sites: under whose control? In: Dudley A, Braman J, Vincenti G (eds). Investigating cyber law and cyber ethics: issues, impacts and practices. Hershey, Information Science Reference, pp 147–219
Reding V (2010) Why the EU needs new personal data protection rules? In: the European Data Protection and Privacy Conference, Brussels, 30 November 2010, http://europa.edu/rapid/pressReleasesAction.do?reference=Speech/10/700, accessed 18 February 2014
Rouvroy A (2008) Réinventer l’art d’oublier et de se faire oublier dans la société de l’information?. http://works.bepress.com/antoinette_rouvroy/5/
Van Alsenoy B et a1 (2009) Social networks and web 2.0: are users also bound by data protection regulations? Springer, Heidelberg
Walz S (1997) Relationship between the freedom of the press and the right to informational privacy in the emerging information society. In: 19th International Data Protection Commissars Conference, Brussels
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 © T.M.C. Asser Press, The Hague, The Netherlands, and the author(s)
About this chapter
Cite this chapter
Ciavarella, R., De Terwangne, C. (2014). Online Social Networks and Young People’s Privacy Protection: The Role of the Right to Be Forgotten. In: van der Hof, S., van den Berg, B., Schermer, B. (eds) Minding Minors Wandering the Web: Regulating Online Child Safety. Information Technology and Law Series, vol 24. T.M.C. Asser Press, The Hague. https://doi.org/10.1007/978-94-6265-005-3_9
Download citation
DOI: https://doi.org/10.1007/978-94-6265-005-3_9
Published:
Publisher Name: T.M.C. Asser Press, The Hague
Print ISBN: 978-94-6265-004-6
Online ISBN: 978-94-6265-005-3
eBook Packages: Humanities, Social Sciences and LawLaw and Criminology (R0)
