The curious case of the right to be forgotten

Abstract

This paper considers the so-called 'right to be forgotten', in the context of the 2014 decision of the European Court of Justice (ECJ) in the case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González. It also considers the 'right of erasure' contained in the current EU Data Protection Directive, as well as the proposal for a new right of erasure to be included in the new EU data protection framework. The paper proposes a particular way of understanding the right to be forgotten and suggests a broad definition of it. It examines claims that the ECJ's decision in Google 'invented' a right to be forgotten. It also considers whether individuals have a right to be forgotten under the current EU Directive, and whether they will have such a right when the new data protection regulation becomes law. More generally, the paper considers whether a right to be forgotten has been recognised as an aspect of a broader right to privacy, and whether the Google decision moves us closer to an understanding of privacy as the right to an appropriate flow of information, in line with Nissenbaum's framework of contextual integrity.

Children and the ‘Right to be Forgotten’: what the right to erasure means for European children, and why Australian children should be afforded a similar right

“…Underpinning that legal right, and necessarily informing how it will be interpreted, is the fundamental right to the protection of personal data, as embodied in the in Article 8(1) of the Charter and Article 16(1) of the Treaty on the Functioning of the European Union (GDPR, Recital 1). In the context of a data protection framework, however, the right to erasure also ‘finds its rationale in the notion that individuals should have control over their personal information’ (Bunn, 2015: 339). The ability to control personal information is, in turn, often regarded as an aspect of privacy (Westin, 1967: 25), and risks associated with a lack of control over personal data are often conceptualised as privacy risks (see, for example, Macenaite, 2017: 765).…”

“…Despite the uncertainties and scope of the right to erasure it does, in combination with other the rights enshrined within the Regulation, provide children in the EU with more control than they currently enjoy. Although the right to erasure in the GDPR is not an entirely new invention, having existed in European data protection law for over 20 years (Bunn, 2015: 348; Directive, 1995, Article 12(b); Mayer-Schönberger, 2014) the GDPR is ‘more explicit as to the grounds upon which a data subject can call for the erasure of data, and extends the grounds by allowing a data subject to call for erasure upon the withdrawal of consent’ (Bunn, 2015: 349). The publicity that has been given to the right to erasure since the Google ruling has meant that what was previously a little utilised right (Mayer-Schönberger, 2014) has since given rise to requests to remove 2.4 million URLs, just over 5% of which have been advanced by (or on behalf of) children (Bertram et al, 2018: 2).…”

“…The so-called ‘right to be forgotten’ has been the subject of much recent debate and comment, largely prompted by the 2014 decision of the European Court of Justice in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González (Case C-131/12, 13 May 2014) [2014] QB 1022 (‘ Google ’). The Google decision has been analysed in detail elsewhere (Bunn, 2015; Frantziou, 2014), but essentially the court found that in certain cases individuals have the right to ask search engines to remove links with personal information in them. That right applies where the information is ‘inaccurate, inadequate, irrelevant or excessive for the purposes of the processing at issue’ ( Google [94]).…”

“…That right applies where the information is ‘inaccurate, inadequate, irrelevant or excessive for the purposes of the processing at issue’ ( Google [94]). Although labelled a ‘right to be forgotten’, the moniker is misleading – the right is more properly conceptualised as a right of erasure (Bunn, 2015: 346) or ‘a conditional right to be taken out of Internet searches’ (Brock, 2016) or to be ‘delisted’ from search results (Douglas, 2016). Debate about the ‘right to be forgotten’ has since continued unabated (see, for example, Douglas, 2015; Post, 2017–2018), not least due to the fact that as of May 2018 the so-called General Data Protection Regulation (GDPR) 1 came into force across the European Union (EU).…”

Workshop videos for requirements communication

“…The goals of this dialogue are to define shared values and rules of how the videos are to be created, processed, and used. Tools to implement responsible use of videos include informed consent for documenting agreed rules [10], video processing for anonymization [49], and erasure of video recordings to allow participants to be forgotten [50].…”