Oblivion: The Right to Be Different ? from Oneself
| Autor | Norberto Nuno Gomes de Andrade |
| Cargo | Scientific Officer at the Information Society Unit of the Institute for Prospective Technological Studies (IPTS) |
| Páginas | 122-137 |
Page 123
The right to be forgotten, also known as the right to oblivion, droit à l’oubli (French) or diritto al’oblio (Italian), is a complex and intriguing juridical instrument. Defined as “the right to silence on past events in life that are no longer occurring,”1 the debate around this right has recently been resumed in Europe. Due to outstanding ICT developments, namely the digitization and proliferation of information2, and its storage by default, the question over the need, admissibility and feasibility of a specific and wider legal instrument to delete information has been inexorably posed.
Page 124
The issue of the right to be forgotten revolves around the question of granting Internet users the possibility of deleting personal data (such as images, texts, opinions, official documents, certificates and any others describing past behaviours and actions, etc.) from the list of results delivered by search engines, or posted on websites, social networks, blogs etc. In fact, the question – heavily focused on the right to be forgotten – has been explored in policy debates,3surveys,4lawsuits,5legislative proposals,6academic writing7and technological initiatives.8There is a widespread and seemingly consensual convergence towards the adoption and enshrinement of a right to be forgotten. Nevertheless, focusing specifically on the legal side, little effort has been made to theorize the right to be forgotten. In the following section I examine the right to be forgotten in a slightly different manner than usual. I go beyond the characterization of the right to oblivion as a mere label or dimension of the right to privacy and reconstruct the “family-tree” portrait of the right to right to be forgotten, linking it to not to the right to privacy or to data protection, but to the right to identity. In order to do so, I first need to clearly distinguish and articulate these three different rights.9
In order to understand the right to oblivion, we first need to locate it in the existing legal framework. Since the recent debate about the adoption of an overarching right to be forgotten concerns the question of whether Internet users should be entitled to erase personal information stored on the Internet, the natural place to re-conceptualize the right to be forgotten seems to be the legal framework regulating the processing of personal information,
i.e. the data protection regulatory framework.10
Page 125
The next step is to analyse the broader set of rights within the framework under which the right to be forgotten operates. Here we find not only the right to data protection, but also the right to privacy and the right to identity. It is crucial to distinguish these three rights to better understand the right to oblivion and to sustain its conceptualization under the umbrella of the right to identity. Therefore, I shall first, in very synthetic terms, distinguish data protection from privacy and identity. Then, I shall discern between the right to privacy and the right to identity.
To understand the underlying differences in scope, nature and rationale between these three rights, it is important to acknowledge and qualify the right to data protection as a procedural right while the right to privacy and identity as substantive ones.
Substantive rights are created to ensure the protection and promotion of interests that the human individual and society consider important to defend and uphold. Procedural rights operate at a different level, setting the rules, methods and conditions through which substantive rights are effectively enforced and protected. Data protection, as such, does not directly represent any value or interest per se, it prescribes the procedures and methods for pursuing the respect of values embodied in other rights – such as the right to privacy, identity, freedom of information, security, freedom of religion, etc. Procedural requirements, such as those concerning transparency, accessibility and proportionality, function as indispensable conditions for the articulation and coordination between different interests and rights.11It is thus erroneous to reduce data protection to privacy12, as the former protects a much wider set of interests and rights. Within this framework, the right to be forgotten is a data protection right, as it lays out a specific procedure (the ability to request the deletion of information) in order to pursue the protection of a given substantive interest and right. The question that emerges is to define which interest the right to be forgotten addresses and protects: privacy or identity?
The right to privacy and the right to identity share the same DNA. They are both part of a larger set of rights called personality rights and, as such, derive from the fundamental rights to dignity and self-determination. Nevertheless, there are important differences between them.
The right to identity can be defined, in a very basic manner, as the right to have the indicia, attributes or the facets of personality which are characteristic of, or unique to a particular person (such as appearance, name, character, voice, life history, etc.) recognized and respected by others. The Italian jurisprudence added a more substantive dimension to the right to personal identity, describing it as “the right everybody has to appear and to be represented in social life (especially by the mass media) in a way that fits with, or at least does not falsify or distort, his or her personal identity.”13 According to this assertion, the right to personal identity concerns the correct image that one wants to project in society. At a more general level, the right to identity can be defined as the “right to be oneself”,14that is, the right to be different from others, the right to be unique. As noted by Neethling, the right to identity reflects a person’s definite and inalienable “interest in the uniqueness of his being.”15According to this conceptualization, a person’s identity is infringed if any of their indicia are used without authorization in ways which cannot be reconciled with the identity (and social image, projection) one wishes to convey.
Having argued elsewhere that the overly broad definition of the right to privacy, followed by the mainstream doctrine
Page 126
in this field, has undermined and overlooked the concept and right to identity, I understand the right to privacy in more delimited terms than the ones usually established. The right to privacy protects an interest that has been defined as “a personal condition of life characterized by seclusion from, and therefore absence of acquaintance by, the public.”16 In these terms, privacy can only be breached through the unauthorized acquaintance of true private facts and affairs by a third party.
To recapitulate, privacy – seen from a more classical and delimited perspective as a right to opacity or to seclusion – deals mostly with the concealment of certain private aspects from public knowledge and the protection of disclosed information from the public sphere. Identity, instead, deals with the transmission of information to the public sphere, namely with its correct expression and representation to the public eye. Furthermore, according to this distinction, each right is infringed and breached differently. The right to identity is infringed if person A makes use of person B’s identity indicia (attributes) in a way contrary to how that person B perceives his or her identity (when B’s identity is falsified or when an erroneous image of his or her personality is conveyed). The right to privacy, on the contrary, is only infringed if true private facts related to a person are revealed to the public.
This distinction is of vital importance to the conceptualization of the right to be forgotten under the umbrella of the right to identity. In the following section I argue that the right to oblivion should be understood as a (procedural) data protection right that mainly pursues and protects a (substantive) identity interest, operating to enforce an individual’s right to personal identity.
The right to be forgotten, as the right for individuals to have information about them deleted after a certain period of time, not only concerns a fundamental identity interest, it also develops and enriches the conceptualization of the right to personal identity. The right to oblivion underlines not only the right to be different from others, but also the right to be different from oneself, namely from one's past self. This is an extremely important nuance as it draws attention to the essential role played by the right to be forgotten in enabling the de-construction of one’s identity before a new, different one can be constructed.
Departing from the fundamental claim that the right to oblivion should be anchored to the right to identity, this section describes the main advantages that such re-conceptualization offers.
Given the fact that much of the information that people would like to delete is already in the public record (that being the reason for wanting to have it erased in the first place), objections have been raised to qualifying the right to be forgotten as a right to privacy. In this sense, and as Gutwirth has observed, “(…) it is very doubtful that such a ‘right to be forgotten’ could be construed as a spin off of the right to privacy, since most of the time conflicts concern public facts (for instance, persons involved as victims or as witnesses of a crime) that are not protected by privacy rights.”17 The argument basically says that, since privacy rights only deal with private information, they cannot address public information and treat it as private. This objection involves issues of freedom of speech (namely freedom of the press), as information that is a matter of public record is generally considered open to the press to report.18The right to privacy deals with protecting disclosure of private information to the public sphere, while the right to identity concerns the transmission of information to the public sphere, namely its correct projection and representation to the public. Bearing this in mind, the right to be forgotten can only address information that is already in the public domain (public facts) if constructed as a spinoff of the right to identity, and not of the right to privacy. In other words, the introduction of a right to oblivion associated
Page 127
with the right to personal identity solves the problem identified above, allowing it to also target facts and information already disclosed to the public. The objective of the right to oblivion is, in many cases, not to conceal private information from public view, but to erase public information and so prevent its further disclosure.
Recapitulating the distinction between the right to privacy and identity presented above, one should take into account that the right to identity concerns all of those personal facts – whether truthful or not – which are capable of falsifying or transmitting a wrong image of one’s identity. The right to privacy, in contrast, comprises only those true personal facts that are part of one’s private sphere and that are not (or should not be) in the public sphere. Pino adds that it is possible to “distinguish the right to personal identity from both reputation and privacy. In the first case, indeed, it can be noted that the false statements must not be necessarily defaming: personal identity can be violated also by the attribution of (false) merits. In the case of privacy, instead, legal protection does not concern the correct exposure of the personality to the public eye, but rather the interest of the subject not to be exposed.”19Regarding the latter, I would specify that the right to privacy only protects the individual’s interest of concealing true facts or aspects from public knowledge.
Having clarified the conceptual space and the types of information protected by the rights to privacy and defamation, we are still left with a specific type of information that is not regulated by any of these rights: de-contextualized information that is eventually false (but not libel or defamatory) or not necessarily truthful. This is exactly the kind of information that should be addressed by the right to be forgotten under an identity perspective, i.e. information that with the passing of time becomes decontextualized, distorted, outdated, no longer truthful (but not necessarily false), and through which an incorrect representation of the individual’s identity is offered to the public.
In brief, when associated with the right to personal identity, the right to be forgotten can address certain information categories that its conceptualization as a privacy right would not allow. This is the case of public and decontextualized (no longer truthful) information. In other words, the right to be forgotten, shaped by the right to identity, intervenes in the spaces not covered by defamation and privacy, addressing information that either already pertains to the public record or that is no longer truthful (but not necessarily libel) given the passing of time and the succession of other events. In this way, the right to personal identity enhances the admissibility and enforceability of the right to be forgotten, widening its scope of application.
As a general rule, the Data Protection Directive (DPD) is applicable whenever there is processing of personal data (that is, data related to an identified or identifiable natural person). However, exemptions are contemplated and the Directive does not apply, for instance, to individuals who process personal data for “purely personal purposes” or “in the course of a household activity”. In other words, data protection principles and rules do not apply to individuals who make use of personal data just for their own domestic and recreational purposes.
Given the increasing blurring between public and private places, activities or even purposes brought by the development of ICT, the understanding that the DPD had of “purely personal” back in 1995 is today highly questionable. With the establishment of the “household exemption”, in the mid-nineties, the DPD departed from the assumption that personal data processed for domestic purposes did not raise privacy risks or issues of responsibility on the side of the data controller, as he or she would only be processing the data for their own private purposes. The directive also assumed that the processing of data for personal purposes would only involve a restricted circle of intimate people and, as such, would not entail the expectation or the need to protect the privacy of the individuals identified. Nevertheless, these assumptions are being questioned with the emergence
Page 128
and consolidation of social networking sites (SNS). In fact, these assumptions are at odds with today’s reality. The publishing of personal information on SNS, even if for purely personal or recreational reasons, often involves the disclosure of information to large audiences.20And this invalidates the assumption that the data will only circulate among a restricted circle of people and that its disclosure does not present any privacy risks.21There is an urgent need to clarify the rules applying to data processing by individuals for private purposes and, moreover, their articulation with other data protection rules concerning derogation, that is, those for the processing of data carried out solely for journalistic purposes and protected by the right to freedom of expression (Article 9 DPD). What is to be understood by “purely personal purposes”? Does the posting of information on an SNS equate to the disclosure of information for private purposes, that is, to our private (although admittedly large) group of selected contacts? Or does it equate to disclosure of information to the public22If so, then there is another ‘twist’ one should take into account. Private individuals who disclose information, opinions or ideas to the public – e.g. through SNS, blogs, YouTube or Twitter – would then be protected by the right to freedom of expression, receiving the same treatment as media professionals processing data “solely for journalistic purposes or the purpose of artistic or literary expression.” As a result, they would be exempt from certain provisions of data protection requirements if it was deemed necessary to reconcile the right to data protection with the rules governing freedom of expression. This means that most information on the Internet which could be deleted (photos on SNS, comments on blogs, videos on YouTube) would not be covered by the rules of data protection (either as data processed for personal purposes or protected by the right to freedom of expression) and, as such, could not be addressed by the right to be forgotten.23The right to be forgotten should be associated to the right to identity to avoid the application of the “household exemption”24or the freedom of expression safeguard. This would enable the possibility to request deletion of personal information posted on the Internet, either processed for purely personal purposes (not going beyond the number of self-selected contacts), or information posted to the public and accessible to an indefinite number of people. Regarding information disclosed to the public, the right to oblivion framed along the lines of the right to identity would be a stronger justification for balancing it with the right to freedom of expression, so avoiding the infallible prevalence of the latter. The criteria for applying the right to be forgotten would concern the occurrence of an incorrect representation of one’s identity, that is, the verification of a mismatch between the identity conveyed by outdated information and the one the individual now wishes to convey. To sum up, the right to oblivion could then be applied regardless if the information in question had been uploaded for domestic purposes or not, or if the information was accessible to an indefinite number of people or not. This paradigmatic shift from a privacy to an identity rationale would render the household exemption (and all the current complexities surrounding it)25inapplicable to the right to be forgotten. It would also endow the right to oblivion with a stronger justification for balancing and articulation with the right to freedom of expression, questioning its infallible prevalence.
Page 129
Through this new (identity-oriented) conceptualization, the right to be forgotten would have a considerably wider scope.
The proposed conceptualization of the right to be forgotten not only makes sense from an identity point of view, it also contributes to the further development of the modern conception of identity, reinforcing its “anti-essential-istic”26understanding.
Following Pino on this matter, personal identity should not be characterized as immutable and contingent, something that one has per natura. Identity is instead a cultural and social construct, something we choose, construct and adhere to.27 Personal identity should be perceived as a matter of choices, a process of continuous negotiation (with ourselves and others), never predetermined and univocal, but one that can be constantly revised and changed. The right to be forgotten is an important instrument to be used in this process of negotiation, enabling further choices, opening future identities by removing previous ones.
Similar ideas can be found in the conceptualization of personal identity as a narrative,28according to which personal identities are conceived and better understood as stories (that we tell ourselves and share with others): identities are not only nomadic, changing according to the story’s development, but they also remain open to revision. Taking into account the idea of personal identity as a narrative, and stretching it a little further, the question that lies beneath the right to oblivion is the possibility of having parts of our identity narrative erased, preventing them from being accessed and acknowledged by the larger public. This way, the right to be forgotten broadens the scope of the right to personal identity, covering not only the entitlement to construct one’s future identity story, but also to erase one’s past. The right to be forgotten plays an essential role, not in the process of identity construction, but in the process of identity de-construction, allowing for new and different identities to be built afterwards.
The conceptualization of the right to oblivion from an identity perspective, moreover, follows the anti-essential-istic line through which law has been regulating personal identity. In fact, law has been endowing individuals with more and more legal instruments through which they may influence and change aspects of their identity. At present, individuals are entitled to break the chains of filiations, modify names, drop nationalities and change sex.29 The right to delete part of one’s identity seems to fit well into the understanding and treatment of personal identity that law has been endorsing.
In this conceptualization proposal, one should take into consideration that, contrary to other rights of personality, personal identity changes with the development of the individual and over time.30Adding to this particularity one of the main rationales of the right to personal identity, the right not to have one’s identity misrepresented or falsified, it seems that the changeable and variable characters of personal identity demand the right to have our most recent and actual identity recognized and ascertained by others.31 This implies, conversely, the right to have past traces of one’s identity (that may go against the actual and current identity) erased, that is, being able to have older facts and actions representative of past identities deleted. As it is only by forgetting past identities that the actual one can prevail, the right to be forgotten may develop an extremely important role in allowing an individual to reconstruct an identity narrative, with the certainty that past ones will not undermine the process.
Page 130
The right to oblivion seems to find an appropriate normative root in the right to personal identity. In fact, the right to be forgotten is at the core of the main interest and value pursued by the right to personal identity: the interest in one's uniqueness, the interest in being different from others and from oneself, that is, from one’s previous identity. As a result, the right to oblivion – as part of the right to personal identity – is intimately connected to the ability to reinvent oneself, to have a second chance, to start over and present a renewed identity to the world.
Perfect and complete control over one's identity projection and construction is not only undesirable, but also impossible. As a social construct, personal identity encompasses one’s self-perception (ipse, how a person perceives herself) and the way one is perceived by others (idem, how a person is perceived and represented by others).32In other words, our personal identity is also (and inexorably) constructed by third persons, shaped by the perceptions that others have of us. There is thus an inevitable dialogue between the individual and ‘others’ in building a personal identity. This means that requests for deleting information regarding one’s personal identity must also take into account the interests that others (as a collective) may have in keeping the information available and the corresponding identity traces ‘alive.’
Despite the arguments presented in favour of developing the right to be forgotten, it is crucially important to note that the right to oblivion is not an absolute right. In fact, the right to be forgotten lives in permanent tension and conflict with other rights, interest, values and objectives. One obvious example can be found in data protection laws that prescribe obligations to retain data for certain periods of time: driven by public security purposes (among others), those laws clash with the right to be forgotten. Amidst many other examples that could be cited, this section summarizes two of the main conflicts that the right to be forgotten needs to address.
The (private) interest and right to be forgotten needs to be balanced and articulated with other competing rights and interests. This is the case of the public and social interest to access information (the right to information) and the right to freedom of expression33and freedom of speech (the right of the press to inform, which also includes the right of individuals to be informed).
The European Commission’s proposal to introduce a right to oblivion in the forthcoming revision of the data protection legal framework has generated negative reactions in the United States, where freedom of speech is strongly supported and promoted.34These objections are a revival of the classic conflict between privacy and freedom of information. Those that sustain the right to information and free speech to the detriment of the right to oblivion argue that the right to delete information about an individual amounts to a right to prevent people from speaking about that individual. Mayes, arguing against the right to be forgotten, commented: “Being forgotten might sound appealing for some, but making a right out of it degrades the concept of rights. Instead of being something that embodies the relationship between the individual and society, it pretends that relationship doesn’t exist. The right to be forgotten … is a figment of our imaginations.”35
Page 131
Contrary to this opinion, I believe it is important to acknowledge that the right to oblivion encompasses much more than the mere intent to hide the individual from society (privacy perspective). The right to be forgotten is an instrument through which individuals correct and re-project their images to society (identity perspective). It is in these terms, as the right to convey the public image and identity that one wishes, that the right to oblivion should be balanced and articulated with the right to freedom of information and free speech. The right to be forgotten does not ignore the relationship between the individual and society. On the contrary, the right to be forgotten assumes and departs from its existence, rebalancing the way in which the individual (and his ipse identity) is represented in society (idem identity).
Another recurrent conflict that the right to oblivion will be confronted with concerns the need to preserve a collective and historical memory.36Here, the right to be forgotten clashes with the historical interest of keeping and archiving present information. Differently from any other period in history, today everybody is creating a vast online record of their lives, compiling their own personal digital legacies. As Paul-Choudhury notes, “this data will prove fascinating to sociologists, archaeologists and anthropologists studying the dawn of the digital age. For them, everyday life can be just as interesting as epoch-defining moments.”37This preservationist argument, nevertheless, seems to go from one extreme to the other, announcing and welcoming the shift from a period when historical research tried to describe the past based on very scarce sources, to historical research that does not let go of the past, keeping it alive and updating it by preserving every piece of information. The ability to delete part of one’s identity should not be sacrificed, in most cases, for the sake of this kind of historical inquiry. In fact, research about a particular group (during a particular period in time) does not always need the scrutiny of personal information, as anonymous data can serve such purposes.
Another argument used by preservationists is the one of objectivity. In the judicial dispute between the Spanish Data Protection Authority and Google, as described previously, the search engine refused to remove the links claiming that, if done systematically, this would compromise the objectivity of the Internet and the transparency of the search engine. Internet users would be able to remove factual information from the Internet, thereby altering the list of results provided by search engines, rendering them imprecise and incomplete.
The right to be forgotten as an attempt to manipulate some kind of Internet objectivity or collective society memory is a somewhat unconvincing argument, if not unfounded. First, the notion of objectivity is rather controversial coming from a search engine that organizes its search listings through enigmatic and non-transparent algorithms. Second, it seems unbalanced to deny the individual the right to erase personal information that is, among other criteria discussed below, not newsworthy or of historical relevance, only for the sake of sustaining a supposedly collective memory.38In view of this, I believe there is an overstretched emphasis on an unsounded collective interest to the detriment of a needed individual interest, such as the right to be different from who one was before.
Page 132
As mentioned above, the exercise of the right to oblivion may clash with other rights, generating conflicts with other protected interests that demand a delicate balancing of rights. It is important to see that, in the same way that the right to be forgotten is not novel, neither is balancing its application with other rights and interests. In fact, a number of important criteria have already been developed in jurisprudence or enshrined in legislation to resolve some of these conflicts. This is the case of criminal law, where the right was first developed. In cases of conflict between the right to oblivion of the judicial past (deletion of information regarding references to one's past criminal actions and convictions) and the right to information (accessing it), the time factor has been used as a decisive criterion. If the information is considered newsworthy (given its recent occurrence), then the right to information prevails, if not the latter is overwritten by the right to oblivion (the legal sentence can still be accessed but the party's names are no longer included).39In addition, two further exceptions are foreseen in which the right to information overwrites that of oblivion. They concern facts pertaining to history or considered of historical relevance, and facts linked to the activities of public figures (whose behaviour, due to their role and public responsibilities, need to be transparent for society).
Data protection laws have formulated a number of principles for legal processing of personal data, as well as exemptions, and may also be used to solve eventual conflicts involving the right to be forgotten. Respect for the purpose principle (according to which only data relevant to the defined purpose may be lawfully processed), and the proportionality principle (which prohibits processing of excessive data for the previously established purpose), are important criteria that may indeed contribute to the resolution of cases of conflict involving the right to oblivion. Moreover, data protection law also establishes repeal procedures or safeguards for processing of personal data. This is the case of the appropriate safeguards that member states will have to lay down for personal data stored for longer periods for historical, statistical or scientific use (Article 6 (e), DPD). This is also the case, as already mentioned, of data saved solely for journalistic purposes or artistic or literary expression (article 9, DPD). These exemptions should also be taken into account in balancing the right to oblivion with the right to freedom of expression.40This balancing process should, moreover, take into consideration the newsworthiness of the information (as in criminal law jurisprudence) and the conceptualization of the right to be forgotten from an identity perspective. This conceptual twist is important, as it may enhance the applicability of the right to be forgotten to the detriment of other rights (as in the case of the household exemption, in which the right to oblivion is applied from an identity not a privacy perspective).
Furthermore, in particular cases, it is important to acknowledge that the right to be forgotten should not always prevail. As Werro explains, when “information about the past is needed to protect the public today, there will be no right to be forgotten. This could be the case, for example, when a person who has abused his managerial position to gain financial advantages in the past seeks employment in a comparable position.”41 The right to oblivion will also face difficulties regarding cer-
Page 133
tain members of society (politicians, public figures) whose transparency is important from a point of view of political credibility42and democratic accountability.
From this brief analysis I derive two recommendations. First, there is no need to 'reinvent the wheel' regarding the balancing of interests involving the right to oblivion. As we have seen, a series of legal criteria has already been devised to achieve this balance. What we now need is to transpose and adapt these criteria to other cases and circumstances where the right to be forgotten may be invoked. Given the increasing digitization of information and storage of our most mundane actions and behaviours, the application of the right to oblivion (and the criteria for balancing it with other rights) should not be restricted to the criminal sphere. The need to be forgotten is today a reality that goes beyond the reference to one's possible criminal convictions. These are, in fact, only the most extreme situations. Today, an indiscrete photo at a drinking party or a misfortunate 'tweet' may also de-contextualize one's projected identity, compromising, for instance, future job possibilities. The principle of forgetting, which has “already been affirmed in national court cases or applied in specific sectors, for instance for police files, criminal records or disciplinary files,”43needs to be expanded to other cases, that may not be as extreme but may still imply major damages and infliction to one’s personal identity. Other criteria for the admissibility and use of the right to be forgotten can be found in the periods of prescription established in civil code or criminal code in civil law systems (or statute of limitations in the common law legal systems). During the period of time in which legal proceedings of a particular event may be initiated, the right to oblivion targeting information related to that event can not be exercised. In other words, the time established for the legal prosecution of a debt or crime also serves as the time during which the right to oblivion is not applicable. This means, for example, that, for serious crimes for which there is no prescription, the right to be forgotten can never be used. There are two reasons for establishing periods of prescription. First, alleged illegal behaviour should be dealt with by the competent courts as close as possible to the time of its occurrence, while the evidence is still ‘fresh’ and not corrupted. Second, people should have the right to carry on with their lives without the weight of having past actions generating unexpected lawsuits. This last reason can, once again, be linked to the need to have previous identity traces removed so that new ones can be built.
It is obvious that new situations may arise that will constrain law to attain a new balance between the right to oblivion and competing rights. The emergence of search engines and the development of Internet newspapers’ electronic archives – that provide easy, permanent and free access to past information – are just two examples of how the new technological world of digital storage will keep challenging the right to be forgotten, demanding its continuous adaptation and updating as a result of new factors and conditions. Nevertheless, it is important to bear in mind that a number of principles and criteria to balance these conflicting rights are already in place. It is from these principles and criteria that one should depart from and elaborate upon.
Second, I believe that further attention and research should be devoted not only to the dichotomy of deletion – preservation but also to the rather neglected binomial deletion – anonymization. Much of the information we produce today, may be used for important and legitimate purposes if it is not deleted. This is the case, for example, of public health monitoring systems44and foresight exercises in modelling systems and simulation platforms based on advanced data mining processes.45Since most of these can be carried out using anonymous data, fur-
Page 134
ther research is needed regarding the enactment of data protection laws that regulate and define the purposes for which personal data can be deleted or anonymized. An unconditional admissibility of an automatic right to be forgotten (embedded in technological design and activated by default) should be further considered, as well as the possibility of introducing a more granular system (detailing the purposes, conditions and requirements for the anonymization of personal data).
Today, what we post on the Internet becomes a kind of tattoo attached to ourselves, hard and cumbersome to remove. The past is no longer the past, but an everlasting present. Mayer-Schönberger argues that “as more and more information is added to digital memory, digital remembering confuses human decision-making by overloading us with information that we are better off to have forgotten.”46 I would add that constant digital remembering also confuses identities, overlapping traces and actions that belong to an identity that we no longer want to see represented and remembered.
Given this state of affairs, I have presented a deeper and richer conceptualization of the right to be forgotten under the umbrella of the right to personal identity. The association between the right to be forgotten and the right to personal identity47 that I propose provides a stronger case for the emergence and consolidation of the right to oblivion. This should not only be seen from a privacy point of view, but also from an identity standpoint. It is important to acknowledge not only the immediate consequences of the application of the right to be forgotten, that is, the possibility to conceal past facts and actions from public knowledge (privacy perspective), but also to bear in mind the more profound implications of the application of the right, that is, what it allows us to do afterwards.
Following this perspective, I have stated that the right to be forgotten does not only share an undeniable interest in an individual’s uniqueness, but also develops that interest in an unprecedented way. The right to oblivion constitutes the right to be different, not only from others, but from oneself, from whom we once were. The right to oblivion, as such, underlines the deconstruction of identity, as a result of which old identities can be removed and new identities formed. Along these lines, the right to be forgotten also equates to the right to new beginnings, the right to start over, with a clean slate, and the right to self-definition, preventing the past from excessively conditioning our present and future life. The right to be forgotten can therefore be considered an important legal instrument to both de- and reconstruct one’s identity, to provide the opportunity to re-create oneself, exerting better control over one’s identity.
Nonetheless, the right to oblivion is not – by any means – absolute. The theorization of the right to oblivion that I have developed does not intend to render the right to be forgotten always prevalent. The idea is simply to argue that the right to oblivion, conceptualized and supported by the right to identity, will present a stronger rationale and justification to attain a better, fairer balance with other competing rights and interests.
This particular conceptualization of the right to be forgotten, moreover, has important and pragmatic implications. The paradigm shift from privacy to identity also reinforces and widens the applicability of the right to oblivion, encompassing areas and situations that it otherwise could not cover.
Page 135
ANDRADE, N. N. G. d. (2011). “Data protection, privacy and identity: distinguishing concepts and articulating rights”. In: S. Fischer-Hübner; P. Duquenoy, M. Hansen, R. Leenes; G. Zhang (eds.). Privacy and identity management for life: 6th IFIP WG 9.2, 9.6/11.7, 11.4, 11.6/PrimeLife International Summer School. Helsingborg, Sweden, August 2-6, 2010. Revised selected papers (pp. 90-107). Berlin and Heidelberg: Springer.
ART. 29 DATA PROTECTION WP (2009). Opinion 5/2009 on online social networking.
BEAN, C. (2010). “#Posterity. How future historians will use the Twitter archives.” Posted Tuesday, April 20, 2010. [Retrieved October 2, 1010]. http://www.slate.com/id/2251429/
DE HERT, P. (2008). “A right to identity to face the Internet of Things?” Also on the CD of Commission Nationale française pour l'Unesco, Ethique et droits de l'homme dans la societé d'information. Actes, synthèse et recommandations, 13-14 septembre 2007, Strasbourg.
EUROPEAN COMMISSION (EC) (2010). A comprehensive approach on personal data protection in the European Union.
EUROPEAN COMMISSION (EC) (2011). Special Eurobarometer 359: Attitudes on data protection and electronic identity in the European Union.
EUROPEAN COMMISSION (EC) (2012). Proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data protection Regulation). COM (2012) 11 final. Brussels,
25.1.2012.
EUROPEAN DATA PROTECTION SUPERVISOR (EDPS) (2011). EDPS Opinion of 14 January 2011 on the Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions – “A comprehensive approach on personal data protection in the European Union”.
GUTWIRTH, S. (2009). “Beyond identity?” IDIS - Identity in the Information Society. Vol. 1, no. 1, pp. 122-133.
HILDEBRANDT, M. (2006). “Privacy and identity”. In: E. CLAES; A. DUFF; S. GUTWIRTh (eds.). Privacy and the criminal law (pp. 43-57). Antwerpen: Intersentia; Oxford: Hart Pub. [distributor].
HILDEBRANDT, M. (2009). “Profiling and AmI”. In: K. RANNENBERG; D. ROYER; A. DEUKER (eds.). The future of identity in the information society: challenges and opportunities (pp. 273-313). Berlin/ London: Springer.
MAYER-SCHÖNBERGER, V. (2009). Delete: the virtue of forgetting in the digital age. Princeton: Princeton University Press.
MAYES, T. (2011). “We have no right to be forgotten online”. The Guardian, 18 March.
NEETHLING, J. (2005). “Personality rights: a comparative overview”. Comparative and International Law Journal of Southern Africa. Vol. 38, no. 2, pp. 210-245.
NEETHLING, J.; POTGIETER, J. M.; VISSER, P. J. (1996). Neethling’s law of personality. Durban: Butter-worths.
NIGER, S. (2008a). “Il diritto all’oblio”. In: G. FINOCCHIARO (ed.). Diritto all’anonimato: anonimato, nome e identitá personale (pp. 59-73). Padova: Cedam.
Page 136
NIGER, S. (2008b). “Il diritto all’identità personale”. In: G. FINOCCHIARO (ed.). Diritto all’anonimato: anonimato, nome e identitá personale (pp. 113-129). Padova: Cedam.
PAUL-CHOUDHURY, S. (2011). “Your digital legacy”. NewScientist, 23 April.
PINO, G. (2000). “The right to personal identity in Italian private law: Constitutional interpretation and judge-made rights”. In: M. VAN HOECKE; F. OST (eds.). The harmonization of private law in Europe (pp. 225-237). Oxford: Hart Publishing.
PINO, G. (2003). Il diritto all’identità personale: interpretazione costituzionale e creatività giurisprudenziale. Bologna: Il mulino.
PINO, G. (2010). “L’identità personale”. In: S. RODOTÁ: P. ZATTI (eds.). Trattato di biodiritto. Vol. 1, pp. 297-321. Milano: Giuffrè.
POUSSON, A. (2002). “Domicile et identité. «Je t’aime, moi non plus»”. In: J. Pousson-Petit (ed.).
L’ identité de la personne humaine. Étude de droit français et le droit comparé (pp. 529-564). Brussels: Bruylant.
RICOEUR, P. (1992). Oneself as another. Chicago: University of Chicago Press.
ROSEN, J. (2010). The web means the end of forgetting. The New York Times, 21 July.
TRUCCO, L. (2004). Introduzione allo studio dell’identità individuale nell’ordinamento costituzionale italiano. Torino: Giappichelli.
WERRO, F. (2009). “The right to inform v. the right to be forgotten: A transatlantic clash”. In: A.
COLOMBI CIACCHI; C. GODT; P. ROTT; L. JANE SMITH (eds.). “Liability in the third millenium”. Georgetown Public Law Research Paper. No. 2, pp. 285-300. Baden-Baden: F.R.G.
ZITTRAIN, J. (2008). The future of the Internet and how to stop it. New Haven: Yale University Press.
----------------------
[1] Pino, 2000, p. 237.
[2] Never has humanity produced, stored and exchanged such an impressive amount of information. With more than 1.97 billion Internet users worldwide, today, an average of 30 billion pieces of content (web links, news stories, blog posts, notes, photo albums, etc) are shared each month on Facebook, 235 new websites are created every 90 seconds, more than 119 million messages are tweeted every day, 35 hours of video are uploaded to YouTube every minute, and 1.2 million editors are editing 11 million articles per month
[3] The right to oblivion has recently been proposed as an explicit right to be enshrined in specific legislation. Both France and Italy have presented legislative proposals in this matter. France has also adopted a Code of Good Practice on the Right to be Forgotten on Social Networks and Search Engines (Charte du Droit à l'oubli numérique dans les sites collaboratifs et moteurs de recherché) to be subscribed on a voluntary basis. At the EU level, the European Commission has proposed the enactment of a specific right to be forgotten within its planned revision of the data protection legal framework. As stated in its communication, A comprehensive approach on personal data protection in the European union, the EC will “examine ways of clarifying the so-called ‘right to be forgotten’, i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes.” (EC, 2010, p. 8) The European Data Protection Supervisor (EDPS), has gone further, proposing the codification of the right to oblivion (EDPS, 2011, p. 19).
[4] According to the results of a recent survey on the EU citizen’s attitudes and behaviours concerning identity management, data protection and privacy, a clear majority of Europeans (75%) support the right to be forgotten. As stated in the report, they want to be able to delete personal information on a website whenever they decide to do so (EC, 2011).
[5] The right to be forgotten has also been invoked in judicial disputes and court cases. Recently, the Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD) ordered Google to remove from its search results almost 100 links to websites containing out-of-date or inaccurate information about individuals, claiming breach of the subjects’ right to privacy and, especially, of their right to be forgotten.
[6] See the recent proposal for a General data protection regulation (EC, 2012), namely article 17 "Right to be forgotten and to erasure".
[7] Academics have also presented original suggestions that form interesting variants of a right to oblivion. This is the case of “reputation bankruptcy” proposed by Zittrain. According to the Harvard professor, people should be allowed to declare “reputation bankruptcy” every ten years or so, wiping their reputation slates clean (through the deletion of certain categories of ratings or sensitive information) and start over (Zittrain, 2008, p. 229). Innovative proposals to enforce a true right to be forgotten have also been put forward. This is the case of Mayer-Schönberger, who in Delete: the virtue of forgetting in the digital age (2009), argues that digital technology and global networks are eroding our natural capability to forget, proposing the establishment of expiration dates on information.
[8] Researchers at the University of Washington have developed a technology called Vanish that makes electronic data self-destruct after a specified period of time (Rosen, 2010). Within the proliferation of tools that allow users to extract their data from social sites, one can also mention the German start-up X-Pire, which launched software that enables users to attach digital expiry dates to images uploaded to sites like Facebook (http://www.x-pire.de/index.php?id=6&L=2).
[9] For a more detailed explanation of the difference and articulation between the rights to data protection, privacy and identity, see Andrade, 2011.
[10] As we have seen with the recent EC proposal, the regulatory framework contemplates the specific possibility to delete one’s personal information.
[11] The application of the Data Protection Directive is an excellent example of the procedural exercise. In order to conciliate the right to privacy with the free flow of information in the internal market, the Directive provides a number of procedural guidelines and principles to attain this balance (basic principles which are summarized in art. 6 of DPD).
[12] In effect, the EU Charter of Fundamental Rights of the European Union (which, when the Lisbon Treaty came into force, was given legally binding status equal to the Treaties) now establishes data protection as a separate and autonomous right (art. 8), distinct from the right to privacy (enshrined in article 7).
[13] Pino, 2000, p. 225.
[14] This expression corresponds to the definition given by the Italian Constitutional Court to the right to identity, diritto ad essere sé stesso (3.2.1994, n.13). For a more profound analysis, see Pino, 2003 and Trucco, 2004.
[15] J. Neethling, Potgieter, & Visser, 1996, p. 39.
[16] Johann Neethling, 2005, p. 233.
[17] Gutwirth, 2009.
[18] See the US Supreme Court decisions in Cox Broacasting Corp. v. Cohn (1975) and in Florida Star v. B.J.F. (1989), stating that that reporters have the right to publish public information.
[19] Pino, 2000.
[20] The average Facebook user has 130 friends and is connected to 80 community pages, groups and events
[21] Art. 29 WP has clarified a number of instances where the activity of an SNS may not be covered by the household exemption, namely “when the SNS is used as collaboration platform for an association or company” or “when access to profile information extends beyond self-selected contacts, such as when access to a profile is provided to all members within the SNS or the data is indexable by search engines.” As noted in its Opinion, a “high number of contacts could be an indication that the household exception does not apply and therefore that the user would be considered a data controller” (Art. 29 Data Protection WP, 2009, p. 6).
[22] An additional question then emerges: How many people with access to that information would render its diffusion as processing of personal data for private purposes or, instead, as disclosure to the public?
[23] However, it is important to note that these possible exemptions from data protection laws do not preclude the possibility for data subjects to use civil and criminal law remedies developed under national law to enforce their right to private life (against private bloggers, twitterers, etc).
[24] Nonetheless, and as the Art. 29 WP observed, “it must be noted that even if the household exemption applies, a user might be liable according to general provisions of national civil or criminal laws in question (e.g. defamation, liability in tort for violation of personality, penal liability) (Art. 29 Data Protection WP, 2009, pp. 6-7).
[25] For a detailed explanation of the circumstances whereby the activities of a user of an SNS are covered by the household exemption, see Art. 29 Data Protection WP, 2009.
[26] Pino, 2010, p. 297.
[27] Pino, 2010, p. 297.
[28] Ricoeur, 1992.
[29] Pousson, 2002, p. 529, De Hert, 2008, p. 12.
[30] Niger, 2008b, p. 125.
[31] Following this point of view, Niger observes that the need to protect one’s projection in the reality of society, taking into account what one is and expresses through her present social presence, assumes enormous importance. The past of a person, as long as not necessary to define someone’s actual and current social presence, should remain in oblivion, namely when its remembrance may alter her present position. (Niger, 2008a, author's translation)
[32] This distinction equates to the difference between ipse and idem identity: “[i]dem (sameness) stands for the third person, objectified observer’s perspective of identity as a set of attributes that allows comparison between people, as well as a unique identification, whereas ipse (self) stands for the first person perspective constituting a ‘sense of self’. Their intersection provides for the construction of a person’s identity”, (M. Hildebrandt, 2009, p. 274). See also Mireille Hildebrandt, 2006. This distinction was first advanced in philosophy by Paul Ricoeur (1992).
[33] See article 10 of the European Convention of Human Rights: “Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.”
[34] It is interesting to note that the right to be forgotten is not protected in the United States, being clearly overshadowed by the right to inform and the right to free speech. This results from the ever-broadening view of the First Amendment’s protection of a free press and a clear preference for the press over the privacy interests of individuals. For more details on the clash between Europe and the US concerning the tension between the right to inform and the right to be forgotten, see Werro, 2009.
[35] Mayes, 2011.
[36] A paradigmatic example of the preservation of a collective memory associated with new technologies (in this case within the so-called web 2.0) is reflected in the announcement made by the US Library of Congress. The world’s largest library has announced that it will digitally archive every public tweet since Twitter’s inception, in March 2006 (Bean, 2010, accessed October 2, 2010). Twitter is a website which offers social networking and microblogging services, enabling its users to send and read other user’s messages called tweets (Wikipedia, http://en.wikipedia.org/wiki/Twitter accessed July 24, 2011).
[37] As the author adds, “memories we are leaving behind now, in all of their riotous glory – drunken tweets, ranting blog posts, bad-hair day pictures and much more – may become a unique trive to be studied by historians for centuries to come. In fact, today’s web may offer the most truthful and comprehensive snapshot of the human race that will ever exist” (Paul-Choudhury, 2011). For more about Internet archaeology and how online forgetting might work, see www.newscientist.com/special/digital-legacy
[38] Moreover, there are already services being offered that act directly upon the listing of search results provided by search engines, manipulating or erasing them in order to ‘polish’ and ‘reshape’ one’s image in the Internet. This online reputation management is the “practice of monitoring the internet reputation of a person, brand or business with the goal of suppressing negative mentions entirely, or pushing them lower on search engines results page to decrease their visibility” (Wikipedia, http://en.wikipedia.org/wiki/Online_reputation_management) (accessed July 23, 2011).
[39] In this case, it is important to note that respect for the principle of transparency of justice does not require the disclosure of names and other personal information regarding the people involved in the judicial disputes. The purpose of this principle is to allow for the transmission of the knowledge of law, allowing legal argumentation to be developed based upon existing decisions and opinions.
[40] The balance is, in fact, achieved under Italian data protection law. Journalists can collect, record and disseminate an individual’s personal data without their consent only if the processing is carried out (1) in the exercise of the journalistic activity, (2) for the sole purposes related thereto, and (3) within the limitations imposed on freedom of the press to protect the individuals’ fundamental rights and dignity, with particular reference to materiality of the information with regard to facts of public interest (see article 137 of the Italian Data Protection Code – Legislative Decree 196/2003 – and the Code of Conduct concerning the processing of personal data in the exercise of journalistic activities, annex A to the Data Protection Code). In addition, the Italian Supreme Court further clarified the compliance requirements that the press should follow in order to lawfully publicize personal information: a) the objective truth of the information to be publicized; b) the public interest for knowledge of such information; c) the formal fairness of the exposition; d) the relevance of the news publicizing personal information (decision of 9 April1998, no. 3679).
[41] Werro, 2009, p. 291.
[42] A right to be forgotten, in this respect, should not be used as an instrument for politicians and other figures exercising public roles of responsibility to rewrite their own history, seeking – for instance - to delete from records statements of political views that were later abandoned. The application of what could be called the public figure clause as an exemption to the right to oblivion is, nevertheless, a delicate issue as anyone can (at least theoretically or potentially) become a public figure.
[43] EDPS, 2011, p. 19.
[44] This is the case of Epicenter, which automatically collects, manages, and analyzes health-related data to help public health professionals detect and respond more effectively to changing health conditions. See http://www.hmsinc.com/service
[45] Internet data is, in fact, increasingly being used to model the future. One example is the Google-supported health Map, which monitors infectious diseases around the globe by synthesizing public data. Another example is the FuturICT (www.futurict.eu) project which proposes to use real time data (financial transactions, health records, logistics data, carbon dioxide emissions, or knowledge databases such as Wikipedia) in order to construct a model of society capable of simulating future conditions and trends.
[46] Mayer-Schönberger, 2009, pp. 163-164.
[47] In this context, Niger (2008a) affirms that the right to identity represents the foundational reference of the right to oblivion (“Il diritto all’identità personale rappresenta, quindi, la matrice prima del diritto all’oblio”).
