The ‘right to be forgotten’: a risk to free speech?

The story of the ‘right to be forgotten’ is the story of well-established principles – free speech and privacy – coming up against new circumstances. The question is whether new technology requires us to alter the operation or the balance of those older principles and values?

The internet and wireless networks changed three things on a vast scale:

• The quantity and velocity of information available
• The permanence and ‘searchability’ of that information. The internet is not just about information on the move: it is massively and indelibly accumulative
• It has brought into existence very powerful new intermediaries which broker our access to information.

The digital pundit Clay Shirky recently remarked that the internet allowed us to discover what other people really think. And that has been, as he put it, a ‘huge disappointment’.

Freedom of expression laws were often passed in the 18th century to protect printers cranking out publications on presses not much bigger than a modern kitchen fridge. Now information pours through your phone every second. Is all that ‘speech’ equally deserving of the shield of law?

The ‘right to be forgotten’ – which is really a conditional right to be taken out of an internet search – is a key, emblematic battle at the new frontier between privacy and freedom – both of speech and to know.  It is a case study of the dilemmas we will increasingly face. Who gets to decide whether speech or privacy prevails in any given case? And on what criteria?

In 2009 a Spaniard, Mario Costeja Gonzalez, complained to Google that a search for his name produced, at the top of the first page, a newspaper item from 1998 which recorded that some of his property had been sold to pay debts. Unfair prominence and out of date said Sr Costeja. He asked La Vanguardia, the newspaper, to erase the item. Both search engine and newspaper rejected his complaint.

The case went to court. The court ruled out any action against the paper but referred the question of the search link to the EU’s Court of Justice. In 2014, the court said that Sr Costeja did indeed have a right to ask Google to de-index items which would be produced by a search on his name – under certain conditions.

The conditions are the heart of the matter

Google routinely de-indexes material from search results: copyright infractions (by the million), revenge porn, details of bank accounts or passport numbers.

The court said that search results could be incompatible with the EU’s data protection directive if: “…that information appears…to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine.” If that was the case, “the information and the links…must be erased.”

The judges went on to say that, as a rule, the individual’s ‘data’ or privacy rights outrank the search engine’s commercial interest or the public’s right to know. But that would not be the case if the public had a ‘preponderant interest’ in the information – as would be the case if the person was in public life.

You might well say, what could be more natural than this? The internet has unleashed a flood of stuff: we must have some way of protecting ourselves from the obvious harm it can cause. Carefully, transparently and accountably done, it ought not be ‘censorship’ – the claim from many voices when the judgement first appeared.

My study, The Right to be Forgotten: privacy and the media in the digital age does not argue that wanting something to be forgotten is wrong. As of this week in the EU, Google has taken down 1.720m URLs after 566,000 requests. Sr Costeja was on to something: he had no redress. Press freedom and free expression never were absolute: we allow some criminal convictions to be forgotten, we have libel and contempt of court laws. All restrain publication.

The problem lies with data protection law – principally in the EU – which fails to balance the competing rights.

And it lies in that judgement, whose tests for whether something ought to be de-indexed are vague and opaque. How do we test for the relevance of information? Relevant to whom? When does information go out of date?

The case was not about defamation: no one claimed Sr Costeja has been libelled. It was not about correcting inaccuracy. It wasn’t private: it had been made public quite legally. The court made clear that a successful claim did not have to show that harm or distress has been caused.

The roots of data protection law lie in the traumas of 20th century Europe. The Dutch government in the 1930s recorded, with characteristic thoroughness, the details of every one of their citizens: name, age, address and so forth. When Nazi Germany occupied the Netherlands, to locate and identify the country’s Jewish and gypsy populations, all they had to do was open the filing cabinets. The secret police of communist states in the second half of the century and their carefully-filed surveillance reinforced the lesson that secretly stored data can inflict damage.

But we are now in an era when an algorithm, rather than storage, can cause harm. Auto-complete functions, which guess what you’re searching for, have caused occasional distress by associating innocent individuals with crimes.

The ‘right to be forgotten’ is a muddled, sweeping solution which fails to clarify a specific remedy for a particular problem.

Issues to be dealt with:

• Although the Costeja case made the compromise of leaving the online newspaper archive untouched, while stopping search engines finding it, we have now have two cases – in Italy and Belgium – where courts have ordered news media archives to be altered.
• Although several Latin American countries – Argentina in the lead – were strengthening rights before 2014, there were moves towards imitation in Hong Kong, Japan and Russia.
• Google’s chief privacy counsel once said his company is creating new jurisprudence about privacy and free speech. What he did not say is that Google is doing this virtually in secret. Their decisions can be taken to court by a litigant with money and patience, but should a private corporation be doing this at all?
• There’s a major unsolved problem about how far the right to be forgotten reaches. The French government think that it should be as far as the internet can go: worldwide. That might be logical in one way, but it is disproportionate as well as unfeasible. Most of the people Sr Costeja was worried about were probably in Barcelona. They certainly weren’t in Boston.

There are upsides:

• Judges, in places as far apart as, Amsterdam and Buenos Aires have insisted on placing limits on the right. In one Dutch cases, a judge reversed a de-indexing decision.
• The General Data Protection Regulation – the unexciting name given to the EU’s revision of its influential data law – does contain more provisions to protect free speech in the public interest. Not all they might be, but something.
• The regulation comes into force in 2018. The UK looks as if it may be outside the EU in 2019. Will the regulation come into force in the UK? We shall see. (The UK Data Protection Act will stay in place).

What’s to be done?

1. The hi-tech giants must acknowledge that they are producing not just a product but public goods. Companies like Facebook like to say – as Google once used to – that they are not ‘media’ companies. True in the narrow sense: they don’t create content. But they are part of what someone called the ‘infrastructure of free expression’. That implies a public responsibility to account more fully for what they do and how they do it.
2. The market isn’t doing very well at providing ways in which control of information is in very few hands and individuals often part with it barely knowing that they have surrendered some privacy. Take heart from the fact that Tim Berners-Lee is working on the problem.
3. The history of free expression has surely taught us that we should be very cautious about restrictions. If you want an alternative to the sweeping tests in EU law, have a look at the stiff tests laid out by the free speech organisation Article 19.

I would like EU law to recognise that privacy and free expression are matters of colliding rights which can’t be wished away by pretending that there is no conflict. Collisions of basic rights cannot be abolished; they can only be managed.

The Costeja judgement didn’t start the right to be forgotten but it did bring it to the attention of the world. It did some good by correcting thousands of small harms. But because it addressed the rights involved in such a careless way, it opened risks to freedom of speech. The judges of the future need to do better.

The Right to be Forgotten – privacy and the media in the digital age, is part of the Challenges series published by the Reuters Institute for the Study of Journalism (RISJ). The RISJ is a partner of the EJO.

Pic credit: Flickr CC SL Mears