Out of a flurry of fights in recent years over online privacy and personal data in the European Union has emerged an interesting – and extremely popular – concept: the right to be forgotten online. Essentially, the right to be forgotten online is the right to force a website to cease hosting, linking to or storing personal information about yourself. According to a recent poll commissioned by the European Union, 90% of Europeans support the right to be forgotten online.
So what exactly does the right to be forgotten online mean for Europeans? According to the latest draft of upcoming changes to the EU data privacy regulations, it is:
the right that their personal data will be erased and no longer processed, where they have withdrawn their consent for processing or where they object to the processing of personal data concerning them.
More concretely, it is also defined in the draft as:
the right to obtain erasure of any public Internet link to, copy of, or replication of the personal data relating to the data subject contained in any publicly available communication service
On its face, this sounds like a good thing! People should have the right to remove their personal data from public circulation, right? Google’s Global Privacy Counsel Peter Fleisher suggests that the right to be forgotten is not the answer, pointing out:
- This right raises difficult-to-resolve issues of personal privacy vs. freedom of expression in cases where others retweet or repost something you have put online and later regretted – for example, it could be a photo of you and a friend, which the friend then reposts. When you ask Facebook to remove the photo from your friend’s album where he reuploaded it, citing it as your personal data, how does Facebook decide whether to support to your right to be forgotten or your friend’s right to free speech?
- What about journalism and the historical record? Where does one draw a balance between public interest in knowing the news and the personal “right” to anonymity – and should it really be up to the content provider to decide?
- To whom should these regulations apply? To websites hosted in the EU? To companies with headquarters in the EU? To websites with users in the EU? The regulations may be so difficult to enforce as to be worthless.
Although the right to be forgotten online sounds noble and is extremely popular, it is fraught with difficult moral questions, the burden of which current draft regulations place squarely on the shoulders of content providers. It is encouraging that EU citizens are enthusiastic about their privacy online, but it is clear that more work is needed before the right regulatory solution is found.
Yale Law Tech 