Portal de Periódicos da CAPES

Reconceptualizing the Right to Be Forgotten to Enable Transatlantic Data Flow

2015; The MIT Press; Volume: 28; Issue: 2 Linguagem: Inglês

0897-3393

Michael L. Rustad, Sanna Kulevska,

European Criminal Justice and Data Protection

V. A PROPOSAL TO RECONCEPTUALIZE THE RIGHT TO BE FORGOTTEN TO ACCOMMODATE EXPRESSION We propose that the European Union narrow its right to be forgotten in order to walk the tightrope between the Scylla of inadequately protecting expression and the Charybdis of diminishing an individual's right to reputation. In this part of the Article, we propose a way to accommodate the right to be forgotten to an increasingly globalized online world. A. Background 1. The Need to Harmonize the Right To Be Forgotten Data packets containing personally identifiable information do not report to customs when they cross national borders on the virtual highway; routers do not pause to consider whether privacy norms are being breached. The right to be forgotten will be the law in Europe by 2017. (222) If the United States does not adopt some version of the right to be forgotten, it will need to renegotiate the U.S.-EU Safe Harbor Agreement. The Safe Harbor Agreement between the United States and Europe enables the exporting of personal data from the Eurozone, (223) but Vice-President of the European Commission and EU Justice Commissioner Viviane Reding has contended that the agreement in its current form may not actually be safe at all, since U.S. privacy standards are too low: [W]e kicked the tyres and saw that repairs are needed. For the Safe Harbour to be fully roadworthy the U.S. will have to service it.... [The] Safe Harbour has to be strengthened or it will be suspended. (224) It is therefore imperative for the United States to harmonize its law so that the European Commission classifies U.S. based privacy policies as reasonably secure. A suspension or revocation of the agreement would have a devastating impact on Facebook and other social networking sites that are currently a part of the agreement. (225) The advantage of our proposal over non-legislative alternatives such as the expiration date or market-based approach (226) is that it will harmonize the law of the United States and Europe, while also reconciling erasure rights with free expression. (227) It is also exportable to the United States where courts have fifty years of experience balancing the First Amendment against state defamation rights. (228) 2. The Three Degrees of Deletion The goal of a right to be forgotten under the GDPR is to give all data subjects a right to control their history on the Internet. To enable a better understanding of what type of data might be included in a right to be forgotten and identify the scope of such an erasure right, this part of the Article breaks down the concept. Peter Fleischer, Google's Global Privacy Counsel, describes three common scenarios for a right to be forgotten on the Internet: 1) If I post something online, should I have the right to delete it again? I think most of us agree with this, as the simplest, least controversial case. If I post a photo to my album, I should then later be able to delete it, if I have second thoughts about it. Virtually all online services already offer this, so it's unproblematic, and this is the crux of what the French government sponsored in its recent Charter on the Droit a l'Oubli. But there's a big disconnect between a user's deleting content from his/her own site, and whether the user can in fact delete it from the Internet (which is what users usually want to do), more below. 2) If I post something, and someone else copies it and re-posts it on their own site, do I have the right to delete it? This is the classic real-world case. For example, let's say I regret having posted that picture of myself covered in mud, and after posting it on my own site, and then later deleting it, I discover someone else has copied it and re-posted it on their own site. Clearly, I should be able to ask the person who re-posted my picture to take it down. But if they refuse, or just don't respond, or are not find-able, what can do [sic] I do? …