The “right to be forgotten”

The proposed UE Data Protection Regulation includes in their art. 17 the “Right to be forgotten and to erasure”. Its purpose is to provide the data subject with the right to obtain from the controller, the erasure of personal data relating to them and the abstention from further dissemination of such data. The regulation states that any subject may require the deletion of their information, through their right of objection or withdrawing the consent initially given.

The article 29 Working Party and ENISA in its report of 20th November have already noticed several weaknesses in that Regulation suggesting that, as configured, it can not be effective in practice.
Indeed, when reading the article and trying to figure out in which situations we could exercise this right, many doubts arise, such as the fact that the scope of this right is not clear, against whom we could exercise it or how it could really be effective.

But the main question is whether the effective removal of data items once they have been published is really possible?

ENISA’s report clearly concludes that it is not possible. The right to be forgotten is not possible once the personal information has been published in an open global system, such as Internet.

In my opinion the conclusion is right. Once a picture or personal information has been published through Internet, it is not possible to guarantee their absolute removal.

We can try to prevent the further dissemination, but we have no control on downloads or copies that have been made when published by third parties.

But actually what is the goal of the right to be forgotten? I think that the purpose is to prevent certain personal information and pictures from remaining forever on Internet, as during the last years there have been multiple claims of that kind, related to search engines or social networks. If this is the case, it seems to me that another approach would be desirable.

To start with, it is necessary to distinguish between:

  • Channels or operators through which information is disseminated (websites, social networks, search engines, press, magazines, radio or TV channels, etc..).
  • The person responsible for the publication (the legal or natural person, with or without gainful interest who has the information and has made it public.).

The right to be forgotten is not possible once the personal information has been published in an open global system, as Internet.

And when could we publish personal data or pictures about another person? In my opinion, reviewing the standards established in the traditional media could be a good start point. For example: when the freedom of expression or information prevails, when we have the data subject’s consent, always protect minors data, etc.

And who would be responsible for the publications? I think the person responsible would be the natural or legal person who has the information and has made it public, not the channel or operators through which it has been spread.

However, these channels and operators should have a proactive role on these issues, ensuring clearer policies and guaranteeing more effective intern conflict resolution procedures.

The last word could be on the operator; according to their terms and conditions, and in cases when the conflict persists, the data subject could appeal to the supervisory authority of his habitual residence and beyond that with the courts. On top of that, joint liability could be established with the channel or operator if it did not act diligently.

Moreover, the right to object should be guaranteed if there is a reasonable cause, but not in all the cases. For example, if there is a previous consent, the right to object should not be unlimited.

There are many outstanding points to think about, and we should not lose sight that the right to be forgotten, in its strict sense, has never existed in the traditional communication media, which are more limited. Thus, if we try to move the problem on the network, it seems even more difficult to achieve.

Maybe, for now one of the clues might be to guarantee more control on dissemination, rather than strict erasure.