Origins and Evolution

In Europe, the right to be forgotten is rooted in the belief that every person has the capacity for rehabilitation, and the understanding that individuals who were convicted of criminal offenses should be able to remove information related to past convictions in order to ensure freedom from stigma that such information may perpetuate. The right to erase records of past action can be traced back to the United Kingdom’s Rehabilitation of Offenders Act of 1974,¹ which is based on the idea that after a certain period of time many criminal convictions are “spent” and should be erased from search engines to avoid influencing potential employers, insurance companies, and landlords. French law similarly recognized the right to be forgotten by enacting the droit à l’oubli — the right to be forgotten - in 2010.² The droit à l’oubli gives a resident of France who was formerly convicted of a criminal offense and has served their time the right to object to publication of the facts of their conviction and incarceration. Thus, the right to be forgotten is premised on the potential for rehabilitation and the idea that individuals should be allowed to fully evolve without others digging up the electronic record of past transgressions.

The right to be forgotten or right to erasure is a “digital-native” right, engendered by the internet, seeking to remedy internet-specific harms. Proponents of the right to be forgotten have argued that the right is needed to protect individuals harmed by revenge porn or by search engine returns of embarrassing content that was uploaded to the web in a moment of poor judgment.³

A person’s right to have unwanted sexually explicit photographs or videos of themselves removed from internet searches is much-needed, and its urgency increases with the proliferation of algorithms that scrape from and multiply data on the web. In response to an increase in complaints, in 2015 Google announced that it would remove links to nonconsensual pornography on request. Commentators noted that this was not the same thing as implementing a “right to be forgotten” as the company already has policies in place dealing with sensitive personal data such as social security numbers and credit card numbers.^{4 5}

The right to be forgotten allows individuals to have embarrassing content taken down from the web in certain circumstances. For example, individuals whose reputations were damaged or could be damaged by photographs and videos uploaded by themselves in moments of not good judgment should sometimes be able to erase information that no longer defines them but could be construed as defining who they are. Generally, the right to be forgotten does not and should not extend protection to public figures lest they mislead us by concealing past politics or by replacing existing records with “alternative facts.”^{6 7}

Compelling arguments have been made for recognizing the right to be forgotten as a fundamental right that should protect individuals in a variety of circumstances. The right can be broad enough to protect all individuals with a legitimate claim. Because formerly incarcerated individuals are too frequently forgotten, we must keep their interests at the forefront, and not allow newer arguments to eclipse the original purpose of the right’s underlying concept, to give individuals who were convicted of criminal offenses the right to have information about their convictions deleted from the internet.⁸

Distinction between the right to be forgotten and the right to privacy

There is a lot of overlap between the right to be forgotten and the right to privacy because they both involve personal information published on the internet. At their core, however, these rights are distinct. The right to privacy concerns information that is not (or should not be) publicly known, while the right to be forgotten involves information that was publicly known. Thus, the right to be forgotten is not about privacy per se; instead, it is about the ownership of information pertaining to oneself, and the right to have that information deleted or erased.

The right to be forgotten is important in a privacy context if we think about surveillance. The right to be free from persecution or discrimination based on past actions is unprotected when information about past convictions is swept into databases used by law enforcement and other government agencies. Information used to identify a person as belonging to a specific group or class of persons should be subject to erasure where excessive and invasive data collection creates what Virginia Eubanks calls the “digital poorhouse” - “a new regime of surveillance, profiling, punishment, containment and exclusion,” which serves “to profile, police and punish the poor.”⁹ The right to be forgotten is an important tool to help people protect themselves from intrusive surveillance by erasing information which could be used by algorithms and humans to stigmatize, profile and exclude them from equal opportunities to live fulfilling lives.

Collision with other human rights

A claim by an individual that a search engine should delete personal information raises issues of freedom of speech and freedom from censorship, both of which are fundamental human rights. Freedom of speech is recognized as a basic human right under Article 19 of the Universal Declaration of Human Rights (UDHR), which states that “everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers.” Similarly, freedom from censorship is a fundamental human right that is recognized by international law. Article 13 of the UDHR states that “everyone has the right to freedom of thought, conscience and religion,” including the right to “freedom to manifest [one’s] religion or belief in teaching, practice, worship and observance.” Because censorship can interfere with an individual’s right to freedom of thought and expression, and can limit the ability of individuals to seek, receive, and impart information and ideas, freedom from censorship is implied in the right to freedom of opinion and expression, as well as in the right to freedom of thought, conscience and religion. Court-mandated deletion of an individual’s public information can be construed as censorship (there is a good argument that only governments or state actors and not individuals can censor); law or court orders requiring data controllers to delete an individual’s public information can be construed as an infringement upon the data controller’s freedom of speech. In an attempt to resolve conflict between competing rights, European courts have established a series of standards or tests.

Standards

In order to address the conflicts between an individual’s claim for the deletion of public personal information and the rights of freedom of speech and freedom from censorship, European courts look at a series of factors to determine whether the information in question satisfies certain criteria. These factors include whether the information in question is inaccurate, outdated, irrelevant, or excessive in relation to the purposes for which it was originally collected or processed. If one or more of these (and possibly other) factors are satisfied, the information in question may be erased if there is no public interest in publishing the information that outweighs the private interest in its erasure. The courts thus aim to strike a balance between the right to privacy and the right to access and share information, considering factors such as the public interest, the individual’s role in public life, the nature of the information, and the potential impact on the individual’s fundamental rights. While time is not always explicitly listed as a factor, the amount of time that has passed since information was published on the internet speaks to the factors of outdatedness, irrelevancy and excess. Time is, therefore, an important factor, and the longer the origin of the information goes back, the more likely personal interests prevail over public interests. The information does not have to be inaccurate for it to be erased. Courts apply these standards to ensure that the right to be forgotten is applied in a balanced and proportionate manner.

Scope

Courts cannot require removal of information held by companies outside their jurisdiction. For now, there is no global legal framework to allow individuals control over information posted by data controllers based in locations outside where the individual resides. In 2019, the Court of Justice of the European Union ruled that a search engine is not required to de-list search results on all of its domains.¹⁰ More and more countries, however, are enacting or proposing laws to protect the right to be forgotten or to erase information posted on the internet. Notably, Argentina and the Philippines have passed laws that protect the right to be forgotten in certain circumstances. Argentina’s Law No. 26,388 (2014) establishes the right of individuals to request the deletion, blocking, or de-identification of their personal data when they are no longer necessary, relevant, or accurate for the purposes for which they were collected, and requires data controllers to obtain the consent of data subjects for the collection, use, and disclosure of their personal data. The Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173) gives individuals the right to request the correction or deletion of their personal data held by data controllers in certain circumstances. While Argentinian case law is mostly concerning claims from celebrities,¹¹ Philippines proposed law references the GDPR’s “irrelevant, not publicly useful” test.¹² Another country that protects the right to be forgotten is the United Kingdom, which, upon leaving the European Union, passed the “right to erasure” into law.¹³

Footnotes