The Right to be Forgotten

A Canadian and Comparative Perspective

Ignacio Cofone, Ignacio Cofone, Ignacio N Cofone

• Publisher: Routledge
• Year: 2020
• ISBN:
  9781000049367
• Edition: 1
• Topic: Law
• Subtopic: Law Theory & Practice
• Index: Law

Exploring the evolution of the right to be forgotten, its challenges, and its impact on privacy, reputation, and online expression, this book lays out the current state of the law on the right to be forgotten in Canada and in the international context while addressing the broader theoretical tensions at its core.

The essays contemplate questions such as: How does the right to be forgotten fit into existing legal frameworks? How can Canadian courts and policy-makers reconcile rights to privacy and rights to access publicly available information? Should search engines be regulated purely as commercial actors? What is the right's impact on free speech and freedom of the press? Together, these essays address the questions that legal actors and policy-makers must consider as they move forward in shaping this new right through legislation, regulations, and jurisprudence. They address both the difficulties in introducing the right and the long-term effects it could have on the protection of online (and offline) reputation and speech. As the question of implementing the right to be forgotten in Canada has been put forward by the Privacy Commissioner and considered by courts, Canada is in need of academic literature on the matter; a need that, with this book, we intend to fulfill.

The questions put forward in this book will thus advance the legal debate in Canada and provide a rich case study for the international legal community.

1 Online harms and the right to be forgotten

Ignacio N. Cofone

1 Introduction

The idea of a right to delete one’s personal information was popularized by Mayer-Schönberger’s book Delete and its story about Stacy Snyder.¹ Snyder was studying to become a high-school teacher when one of her professors found a picture she had posted on a social network website in which she was drinking from a plastic cup while wearing a pirate hat, captioned “drunken pirate.” After the professor contacted the university authorities, she was said to be expelled.² She sued to reverse that decision but failed.³ Through Snyder’s story – one that is certainly not unique – Mayer-Schönberger proposed the wide implementation of a new privacy right: the right to delete information about ourselves.⁴

Mayer-Schönberger argued that one of the main problems of electronic data processing and storage is that it lacks the human characteristic of forgetting,⁵ which he highlighted as a human characteristic with an important social function. Before the existence of large-scale information technologies that facilitate quick and easy access to publicly available information, true information about individuals held by others faded with time. Consequently, the weight that negative or embarrassing information about people had on their reputation generally lessened with time, allowing them to restore their reputation. He thus proposed “the right to forget,” meaning that personal information should have expiry dates after which it would be deleted automatically.⁶

1 Viktor Mayer-Schönberger, Delete: The Virtue of Forgetting in the Digital Age (Woodstock: Princeton University Press, 2009) at 1–15.

2 This frequent reconstruction is actually inaccurate. See Jack Herlocker, “Sidney Snyder and the Untruth that Won’t Die” Medium (21 September 2015). See also Stacey Snyder v Millersville University et al., U.S. Dist. LEXIS 97943 (ED Pa 2008).

3 Ibid.

4 Mayer-Schönberger, supra note 1 at 1–15.

5 Ibid at 92–127.

6 Ibid at 169–195.

Another story that motivated debate and turned into a landmark decision that created law is that of Mario Costeja. Costeja requested Google and a Spanish newspaper to eliminate an article which reported a government auction on his house. The opinion of the European Court of Justice (ECJ) advocate general stated that the current European legal framework does not provide a right to eliminate truthful but embarrassing information.⁷ But the ECJ disagreed,⁸ ordering Google Spain to delist the content from search results and stating that search engines must delist content that is “inadequate, irrelevant or no longer relevant, or excessive.”⁹

Since the 2014 Google Spain decision, the right to be forgotten (RTBF) has been the locus of extensive academic debate across the globe and is one of the most contested legal innovations in the realm of privacy. Since its formal recognition, the right has raised important questions about how, in the face of networked technology, legal systems balance privacy, reputation, and free speech.

2 What is the right to be forgotten?

The idea of a right to forget one’s information originally comes from the French droit à l’oubli and the Italian diritto al’ oblio for criminal records – sometimes called right to oblivion, and literally translatable as right to forget.¹⁰ These types of rights focused on erasing court or government records after a certain amount of time. They were affirmed by courts based on constitutional dispositions about the social reinsertion aims of prison punishments, stating that it is in the interest of both social reinsertion and the privacy of people who were convicted for the records to be erased after some time.¹¹ The RTBF takes a similar logic for a much wider set of information.¹²

7 This opinion was based on the interpretation of article 2(b) of the Data Protection Directive given by the ECJ in Lindqvist. See Bodil Lindqvist v. Åklagarkammaren i Jönköping, C-101/01, [2003] ECR I-12971. Attorney Generals are appointed members to the ECJ that do not render judicial decisions and are not privy to the deliberations of judges. Their principal function is to draft legal opinions in relation to specific cases. See Philippe Léger, “Law in the European Union: The Role of the Advocate General” (2004) 10:1 J of Legislative Studies 1.

8 See Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, CJEU C-131/12, [2014] ECR I-317, EUR-Lex CELEX No 62012CJ0131.

9 Ibid at para 93.

10 See W. Gregory Voss & Celine Castets-Renard, “Proposal for an International Taxonomy on the Various Forms of the ‘Right to Be Forgotten’: A Study on the Convergence of Norms” (2016) 14 Colorado Technology L J 281 at 299–302.

11 See Martine Herzog-Evans, “Judicial Rehabilitation in France: Helping with the Desisting Process and Acknowledging Achieved Desistance” (2011) European J of Probation 3.1 at 4–19; Steven Bennett, “The ‘Right to Be Forgotten’: Reconciling EU and US Perspectives” (2012) 30 Berkeley J Intl L 161; Alessandro Mantelero, “The EU Proposal for a General Data Protection Regulation and the Roots of the ‘Right to be Forgotten’” (2013) 29 Computer L Security Rev 229.

12 See Jennifer Stoddart, “Lost in Translation: Transposing the Right to be Forgotten from Different Legal Systems” (Chapter 2) for more details.

The European Union (EU) was sympathetic to this idea.¹³ Instead of the right to forget, which would focus on the expiration of information after some time, the European Commission led by then EU Commissioner Viviane Reding proposed in the General Data Protection Regulation (GDPR) to include the RTBF,¹⁴ which normatively focuses on the control over one’s personal information.¹⁵

As a result, the right is now in article 17 of the GDPR. As stipulated in article 17, the right establishes that people can demand information about themselves to be deleted by entities that collect or process their personal data.¹⁶ This extends the right of data subjects beyond those granted in Google Spain.¹⁷ It allows them, subject to balancing with other rights such as free speech, to request any data controller, at any time, to eliminate from their databases any piece of information regarding that data subject, regardless of the source of the information, and regardless of whether that information produces harm.¹⁸

13 See Jeffrey Rosen, “The Right to be Forgotten” (2012) 64 Stan L Rev 88 at 89.

14 In EU law, regulations are pieces of legislation that are directly applicable internally, as opposed to directives, which must be implemented by each member state. While directives are used to harmonize EU law, regulations are used to unify it.

15 See Rolf Weber, “The Right to Be Forgotten More Than a Pandora’s Box?” (2011) 2 J of Intellectual Property, Information Technology and Electronic Commerce L 120.

16 See Viviane Reding, “The Upcoming Data Protection Reform for the European Union” (2011) 1 Intl Data Privacy L 3.

17 This is the term used by European data protection law for people whose data are being collected or processed. See e.g. EC, Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), [2016] OJ, L 119 at 33 (“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)”) [GDPR].

18 See Ignacio N. Cofone, “Google v. Spain: A Right to be Forgotten?” (2015) 15 ­Chicago-Kent JICL 1.

The RTBF, therefore, has been deemed to mean any of two thin...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• Acknowledgments
• List of contributors
• 1 Online harms and the right to be forgotten
• 2 Lost in translation: transposing the right to be forgotten from different legal systems
• 3 A little knowledge is a dangerous thing?: information asymmetries and the right to be forgotten
• 4 Reconciling privacy and expression rights by regulating profile compilation services
• 5 Let’s not dwell on the past: the right to be forgotten as more than a romantic revolution
• 6 The right to be forgotten in peace processes
• Bibliography
• Index