ICTlogy

Introduction by Esther Mitjans, Director of the Catalan Data Protection Authority and Professor of Constitutional Law at the University of Barcelona.

Three reasons why the right to forget is not already in the Law:

• We could not know.
• We did not know we were to lose all control on our own data,.
• We could not have known that segmented marketing would highly value personal data.

We face a trade-off between economic profits from data exploitation and privacy and security.

Cécile de Terwangne, Professor, Centre de recherche informatique et droit
Internet Privacy and the Right to Be Forgotten

Privacy does not mean intimacy or secrecy, but individual autonomy. In the context of the internet, it is informational self-determination, the control over one’s personal information. This personal information is made up by confidential data, but also by professional data, commercial data, published data, photos, films, sound…

In Europe, this “informational self-determination” has been recognized and protected by several norms, and the right to oblivion of the judicial/criminal past has been recognized by case law in several countries, based on the right to privacy or on personality rights.

The justification for the right to oblivion is justified by faith in human beings’ capacity of improving, the conviction that man should not be reduced to their past, the idea that once you have paid what was due, society must offer the possibility to rehabilitate.

But the right to oblivion conflicts with the right to information.

The criterion to resolve the conflict should be time:

• If there is newsworthiness, the right to information should prevail.
• If the information is no more newsworthy, then the right to oblivion should prevail.

What do we do, though, with digital newspapers archives and case law databases, which are clearly breaking the balance that we had reached?

Related to case law databases, the solution that has been proposed is anonymization, with respect of the purpose principle — by which only relevant data in relation with the purpose may be processed — and the proportionality principle — by which no excessive data may be processed.

Related to newspapers, one thing is to restrict the dissemination of old personal data, a different one is a right to delete those data. Deleting data out of “chronicles” is tempering on one’s own history.

On the other hand, there is of course a conflict with freedom of the press, a conflict that becomes a dilemma as there is not an a priori hierarchy amongst personal rights freedom of the press or the right to information.

In general, though, legislation shows that too many definitions/thresholds are subjectively defined, like “data won’t be kept longer than necessary” or some conditions under which it is possible to anonymize or delete data.

With the pervasiveness of the Web 2.0 and cloud services, there is a claim for a new right to oblivion, due to the problem of long lasting records kept by certain Internet actors of traces unconsciously left when surfing the web. But, again, as some economic models heavily rely on those data basis, there is a trade-off between personal and corporate rights.

A first solution is having the possibility to stablish a right to have information deleted and not only rendered inaccessible.

Another solution could be based on basing the right to be forgotten on a right based on the no-collection of personal data and established by default, that is, privacy by design.

More information

• Privacidad en Internet y el derecho a ser olvidado/derecho al olvido, by Cécile de Terwangne.
• ¿Tenemos derecho a ser olvidados en Internet? (IDP 2011), by Cristina Aced

Previous post: 7th Internet, Law and Politics Congress (VII). Javier de la Cueva: Conclusions for day 1

Next post: 7th Internet, Law and Politics Congress (IX). Internet Privacy and the Right to Be Forgotten