Last Week in Tech Policy #68A: Who Needs the Right to be Forgotten?

(by Kristine Roach, Colorado Law 2L)

The right to erasure, colloquially known as the right be forgotten, has been adopted by the EU General Data Protection Regulation (GDPR). It gives individuals the right to have their personal data erased:

  • Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
  • When the individual withdraws consent.
  • When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
  • The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
  • The personal data has to be erased in order to comply with a legal obligation.
  • The personal data is processed in relation to the offer of information society services to a child.

However, the right is not absolute and the requestee can refuse to erase data of the requestor for the following reasons:

  • to exercise the right of freedom of expression and information;
  • to comply with a legal obligation for the performance of a public interest task or exercise of official authority.
  • for public health purposes in the public interest;
  • archiving purposes in the public interest, scientific research historical research or statistical purposes; or
  • the exercise or defense of legal claims.

The big target for delisting requests is Google. Since 2014, 400,000 requesters have sought the delisting of about 2.4 million URLs from Google’s results. Some of the requests Google has fielded show that when an individual is trying to remove articles about a crime he or she committed, Google generally doesn’t remove them. However, more personal information might yield a different result.

In one incident in Germany, Google noted:

“We received a request to delist four news articles about an academic’s research that contained the individual’s photo because the academic changed gender and identifies under a new name. We did not delist the articles as they continue to be relevant to the academic’s professional life and research.”

In another incident in Italy, Google took the opposite course:

A woman requested that we remove a decades-old article about her husband’s murder, which included her name. We have removed the page from search results for her name.

Who needs the right to be forgotten?

Although it makes sense that criminals shouldn’t be able to remove articles about their prosecution when they are found guilty of a crime, basic ethical or moral evaluations lead many commenters to believe that there are some things that are private and shouldn’t be on the internet.

Revenge porn is a frequently-cited example of why we need the right to be forgotten. (See a previous TLPC blog about it within the context of cyberbullying by Angel Antkers.) But it’s more than just nude pictures that people want taken down.

For example, a recent petition on change.org garnered 79,000 signatures requesting YouTube to take down the video recorded by the helmet cam of a U.S. Special Forces soldier when the he and his team were ambushed and executed by extremists in Niger. Despite the outcry, it has not been removed.

In another example, would you want an airplane of strangers recording you  grieving on your spouse’s casket as his remains were taken off the plane that transported him home. That’s what happened to Green Beret Shawn Thomas’s widow in 2017.

In the last two years a large number of police shootings have also been recorded and posted online. The Black Lives Matter movement has used those videos to show the shootings as insurance against the inaccurate police accounts which might be given later. As evidence that this use of cell phone video has been successful for that purpose, police recently released the footage on their own in the shooting death of Stephon Clark. But Stephon Clark has two very young kids who may someday object to video of the murder of their unarmed father posted on the internet.

In the meantime, some internet platforms are beginning to moderate their content more aggressively. For example, in late March as a result of the national debate about gun control, YouTube announced that it “will ban videos that promote or link to websites selling firearms and accessories, including bump stocks.” The new ban will take effect in April, although some vloggers have reported their pages being suspended.

However, relying on the benevolence of corporations to remove content may not be enough. Will U.S. law need to adjust to protect law abiding citizens who don’t want intimate or painful moments immortalized on the internet? Without a right to be forgotten, what other solutions are available for these types of privacy issues?