In the past, forgetting was the norm for humans because it was not easy to keep data. Nowadays, thanks to the rapid development of digital technology, the cost of storing data have fallen and fallen, instead of making it more expensive. Information that enters the internet cannot easily be forgotten and can also spread unnoticed through search engines or social media platforms, with unpredictable consequences for those involved. For example, on October 10, 2012, 15-year-old Amanda Todd was bullied and eventually committed suicide because of fabricated scandalous images on the internet.
The need for a right to be forgotten creates much of debate, especially as a huge chasm is drawn over whether the right to be forgotten infringes the right to freedom of expression. Proponents see it as a landmark in the development of individual privacy rights. Opponents see it as a dominant regulatory burden that will have a direct detrimental effect on general legal freedoms in the internet sphere. So is there really an irreconcilable contradiction between protecting the right to freedom of expression and the right to be forgotten?
The right to freedom of expression can be found under Article 11 of the Charter of Fundamental Rights of the European Union and under Article 10 of the European Convention on Human Rights [1]. The CJEU defines freedom of expression as including “the expression of opinions and the freedom to receive and impart information” [2]. In the debate between the right to be forgotten and the right to freedom of expression, it is the freedom to receive and impart information that is more often discussed. EU has developed detailed balancing principles based on the idea that the right to be forgotten is as important as the right to freedom of expression [3].
However, the EU frequently has a tendency to protect privacy in its judgments compared to other countries and regions, especially the US [4]. This is because the privacy and the cornerstones of freedom in Europe and the US are different. Europe sees human dignity as central to the realization of individual liberty, and privacy as an expression and safeguard of human dignity; the US considers freedom of expression as a tool to realize democratic values, and its privacy is more focused on countering government intrusion. Nonetheless, different perceptions of the ranking of rights cannot be the main reason for evaluating the merits of rights.
Furthermore, Article 17 of the GDPR (2016) [5] is intended to remove potentially damaging private information about individuals. But instead of a “right to be forgotten” a more limited “right to data erasure” is implemented. Article 17 provides that the data subject has the right to request erasure of personal data related to him/her on a number of grounds.
Major criticisms stem from the idea that the right to be forgotten would restrict the right to freedom of expression. The US with its strong domestic freedom of expression laws, state it would be challenging to reconcile with the right to be forgotten. Also, there’s concerns about the requirement to take down information that others have posted about an individual; the definition of personal data in Article 4(1) includes “any information relating to the individual” [6]. Some argue though, that this would require companies to take down any information relating to an individual, regardless of its source, which would amount to censorship, and result in big data companies eradicating important information.
Nevertheless, GDPR balanced this. It introduced an exception under Article 17(3) that sets out limits of the right to be forgotten, including for exercising the right to freedom of expression and information [7]. Ultimately, Jef Ausloos’ observed that, through the right to data erasure the goal is not to silence the media but to place more effective limitations on the commercial holding of data [8]. Freedom of expression can be threatened if we allow anyone who wants, to erase their personal history.
A landmark EU case that touches the issue of balancing these two vital rights and the extend of the protection of personal data, is the Google Spain case [2014] [9]. In this case, Mr. Costeja Gonzalez and Spain’s Data Protection Agency brought a complaint against La Vanguardia, a Spanish newspaper, Google Spain and Google Inc. Mr. Gonzalez’s request was twofold. First, the Spanish newspaper to remove or alter the record of his 1998 proceedings so that the information would no longer be available through internet search engines and second, Google Spain and Google Inc. to remove these data as well. The main argument of Mr. Gonzalez was that the proceedings had been fully resolved and they should no longer appear online.
The European Court ruled that all European citizens have a right to request commercial search firms such as Google, that gather personal information for profit, to remove links to private information when asked, provided that the information is no longer relevant. The Court did not rule that newspapers should start removing articles though. It affirmed the judgment of the Spanish Data Protection Agency which supported press freedoms and rejected any request to have the relevant article removed.
Why this case is so significant? This decision establishes a precedent that covers the right to be forgotten and the limits of this right [10]. It preserves individuals’ rights of privacy and the protection of personal data while also holding that there are limits to those rights.
In conclusion, the right to freedom of expression and the right to be forgotten are of fundamental importance for all EU citizens. What Article 17(3) of the GDPR (2016) and Google Spain case [2014] manage to do, is to strike a proper balance between the two rights. Any threat to the right to freedom of expression from the right to be forgotten might have been greatly exaggerated as these two mitigating factors defend the coexistence of the two rights and minimise as possible the interference between one another. Hence, it is appropriate to say that the Right to be Forgotten v the Right to Freedom of Expression is a draw and, as a result, a win for all EU citizens after all.
Footnotes:
[1] Charter of Fundamental Rights of the European Union (2012/C 326/02) and Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) (1950).
[2] Case C-73/07 Tietosuojavaltuutettu v. Satakunnan Markkinapörssi E.C.R. I-9831 [2008]. Singleton S, Balancing a Right to Be Forgotten with a Right to Freedom of Expression in the Wake of Google Spain v. AEPD (2016), 44 GJICL 165, p: 178.
[3] Kulk S and Borgesius FZ, “Privacy, Freedom of Expression, and the Right to Be Forgotten in Europe” in Evan Selinger, Jules Polonetsky and Omer Tene (eds), The Cambridge Handbook of Consumer Privacy(Cambridge University Press, 2018), p:11.
[4] US Courts Should Not Let Europe’s Right to Be Forgotten Force the World to Forget (2017), 89 TLR 609, p: 611.
[5] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
[6] Ibid, Article 4(1).
[7] Ibid, Article 17(3).
[8] Ausloos J, From Individual Rights to Effective Protection (OUP, 2020).
[9] Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González ECLI:EU:C:2014:317 [2014].
[10] Google Spain SL and Google Inc v Agencia Española de Protección de Datos [2014], Columbia Freedom of Expression, Columbia University. <https://globalfreedomofexpression.columbia.edu/cases/google-spain-sl-v-agencia-espanola-de-proteccion-de-datos-aepd/>