PERE SIMÓN CASTELLANO

1. A CHALLENGE FOR DATA PROTECTION AND INFORMATION SECURITY CHARTING THE FUTURE OF THE ‘RIGHT TO BE FORGOTTEN’ UNDER EUROPEAN LAW PERE SIMÓN CASTELLANO Research Fellow, University of Girona Follow me on Twitter: @pere_simon My Personal Website: peresimon.com

2. OUTLINING THE PRESENTATION in the 8th Korea Communications Conference, Seoul, May 18, 2012 Conceptualizing the so-called ‘Right to be forgotten’ Meanings, scope, social issues and different answers amongst several juridic cultures Point 1 Point 1 The (in)formal recognition of the new right within European Law Spanish, Italian and French cases. The proposal of the European Commission Point 2 Point 2 Free speech versus the ‘Right to be forgotten’Balancing rights and freedoms which obviously are not absolute A potential technological revival of forgetting – Implementing expiration dates Assuring the freedom of make a fresh start (the ‘Right to be forgotten’) and offering a better product or service Conceptualizing the so-called ‘Right to be forgotten’ Meanings, scope, social issues and different answers amongst several juridic cultures The (in)formal recognition of the new right within European Law Spanish, Italian and French cases. The proposal of the European Commission Free speech versus the ‘Right to be forgotten’Balancing rights and freedoms which obviously are not absolute Point 3 Point 3 Reintroducing forgetting by Law: a possible way? Public Communication Space in 2.0 world, Digital Privacy Rights Infraestructure, The (in)efficiency of Law methods, The Laws of Identity as a solution Point 4 Point 4 A potential technological revival of forgetting – Implementing expiration dates Assuring the freedom of make a fresh start (the ‘Right to be forgotten’) and offering a better product or service Point 5 Point 5

3. LIVING IN A WORLD THAT FORGETS NOTHING 1 -- Conceptualizing the so-called ‘Right to be forgotten’ DIGITAL STORAGE Forgetting as an exception Remembering as a default

4. THE SOCIAL CONSEQUENCES OF PERFECT REMEMBERING 1 -- Conceptualizing the so-called ‘Right to be forgotten’ OUR PAST SETS UP OUR IDENTITY AN UNDESIRABLE DIGITAL RESUME SEARCH ENGINES

5. The ‘right to be forgotten’ as a reaction 1 -- Conceptualizing the so-called ‘Right to be forgotten’ ‘It deals with the deletion of data that is no longer needed, rather than anything as dramatic as the erasing of past events or preventing any kind of speech’. Paul A. Bernal, Lecturer at the School of Law, University of East Anglia A right to ‘live outside society’ which would ‘signify the emasculation of our power to act in the world’. Tessa Mayes, investigative journalist, The Guardian ‘[It] reflects the claim of an individual to have certain data deleted so that third persons can no longer trace them’. Rolf H. Weber, Chair Professor for International Business Law at the University of Zurich

6. 1 -- Conceptualizing the so-called ‘Right to be forgotten’ THEREFORE, WHAT ARE WE TALKING ABOUT? ‘The right to silence on past events in life that are no longer occurring’. Giorgio Pino, University of Parlemo ‘Any citizen who is neither the subject of a news story nor have public importance should not to be unable to react or correct inclusion to their data in Internet’. Artemi Rallo, former Director of Spanish Data Protection Agency ‘The right to be mistaken and make a fresh start’. Pere Simón Castellano, University of Girona

7. 1 -- Conceptualizing the so-called ‘Right to be forgotten’ The right to be mistaken and make a fresh start is a broad definition which could imply: 1 The right to silence on past events in life such as crimes for which the person has later been exonerated or full rehabilitated into society 2 The right to delete our personal data on Internet even when we have given our consent in the past 3 The right to receive a compensation for damage caused by releasing illegitimately the information which contains personal data 4 The right to anonymize personal data in public sentences 5 The right to object to some treatments of personal data, i.e. the right to order Search Engines to delete out-of-date and inaccurate information IT’S NOT A CLOSED LIST

8. 1 -- Conceptualizing the so-called ‘Right to be forgotten’ Do we have the right to make a fresh start?

9. 1 -- Conceptualizing the so-called ‘Right to be forgotten’ Both legal traditions have different scopes All countries that belong to civil law legal system can find the root of the right to be forgotten in the right that allows a convicted criminal who has served his time and has been rehabilitated to object to the publication of the facts of his conviction and incarceration (i.e. the vast majority of European Union States Members, with the exception of United Kingdom) By contrast, the publication of someone’s criminal history is protected by freedom of speech in the states that belong to the common law legal system (i.e. protected under the First Admendment in United States)

10. 1 -- Conceptualizing the so-called ‘Right to be forgotten’ But it seems to be an agreement point between both But it seems to be an agreement point between both But it seems to be an agreement point between both

11. 2 -- The (in)formal recognition of the new right within European Law Mapping out inharmonious cases of perfect remembering an their juridic outgrowth at European level

12. 2 -- The (in)formal recognition of the new right within European Law The enforcement of the right to be forgotten against who is in charge of the website The Italian Guarantor Authority for Competition and Market published online two decisions taken in 1996 and 2002 in which they fined a company for ‘deceptive advertising‘

13. 2 -- The (in)formal recognition of the new right within European Law The Enforcement of the Right to be Forgotten against Search Engines — The Pandora’s Box A teacher in Monpellier (France) took part in a porn amateur video when she was 18 years old The ISSUE: when someone placed in a search engine her name and surname, or her name and "school of Laetitia", the first result sent Internet users to pornographic sites which offered this amateur porn video What says 'Le Tribunal de grande instance de Montpellier'?

14. 2 -- The (in)formal recognition of the new right within European Law The Enforcement of the Right to be Forgotten against Search Engines — The Pandora’s Box A deputy headmaster of a school found it difficult to remember that some years ago he was fined for urinating in the street, but an official sanction is the first search result when their students place his name into Google What says 'La Audiencia Nacional'?

15. 2 -- The (in)formal recognition of the new right within European Law The enforcement against SOCIAL NETWORKS – The Drunken Pirate Sharing our private lifes in social networks Sharing our private lifes in social networks Sharing our private lifes in social networks Risk of descontextualization A friends network? Risk of descontextualization A friends network? Risk of descontextualization A friends network?

16. 2 -- The (in)formal recognition of the new right within European Law The challenge of reintroducing forgetting into Digital Spaces The european proposal, closer to a formal recognition, recognizes a right to be forgotten which covers four separate categories 1 The right to delete what I posted online (SN and personal websites) 2 The right to delete our personal data when it was posted online without our consent (SN and personal websites) 3 The right to delete our data when someone re-posts or copies our entry on their own site without our consent (SN and personal websites) In this case, Internet Service Provider shall carry out the erasure without delay, unless the retention of the data is necessary for other legitimate juridic purpose. 4 The right to object, not to delete, the treatment that search engines gives to personal data when they index information shared globally (SE)

17. 2 -- The (in)formal recognition of the new right within European Law Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on the free movement of such data Brussels, January 25, 2012 Article 17 provides the data subject's right to be forgotten and to erasure 1 It further includes the obligation of the controller which has made the personal data public to inform third parties on the data subject's request to erase any links to, or copy or replication of that personal data 2 It also integrates the right to have the processing restricted in certain cases

18. 2 -- The (in)formal recognition of the new right within European Law Article 17 Right to be forgotten and to erasure 1. The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child, where one of the following grounds applies: (a) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent [...] or when the storage period consented to has expired [...], (c) the data subject objects to the processing of personal data [...], (d) the processing of the data does not comply with this Regulation [...]

19. 3 -- Free speech versus the ‘Right to be forgotten’ DIGNITY PRIVACY FREE SPEECH REPUTATION DATA PROTECTION

20. 3 -- Free speech versus the ‘Right to be forgotten’ The freedom of speech and the press plays an essential role in a democratic society. For this reason it prevails by default. In the cases in which the Courts have to balance the protection of private life against freedom of expression, they have to apply weighting criterias 1. The dissemination of ideas on matters of public interest or when it is justified by considerations of public concern 2. Veracity of information 3. Suitability, necessity and proportionality

21. 3 -- Free speech versus the ‘Right to be forgotten’ Public interest criteria ‘Although freedom of expression also extends to the publication of photos, this is an area in which the protection of the rights and reputation of others takes on particular importance [...] Furthermore, photos appearing in the tabloid press are often taken in a climate of continual harassment which induces in the person concerned a very strong sense of intrusion into their private life or even of persecution’. ‘Similarly, although the public has a right to be informed, which is an essential right in a democratic society that, in certain special circumstances, can even extend to aspects of the private life of public figures, particularly where politicians are concerned’ European Court of Human Rights, Case of Von Hannover v. Germany, Strasbourg, June 24, 2004, § 59 and 64.

22. 3 -- Free speech versus the ‘Right to be forgotten’ Legal regulation of the amnesty in France and the limits of freedom of speech When there is an amnesty in France the crime goes away, it is forgotten, although it is possible to disseminate information about the individuals amnestied. However, if disclosure of information provoke damages on the reputation or privacy of individuals granted amnesty, they can sue against the person who evoked amnesty, without that he or she can oppose the exceptio veritatis. Loi sur la liberté de la presse, article 35.

23. 3 -- Free speech versus the ‘Right to be forgotten’ The hate speech are not covered by the freedom of speech The term “hate speech” is to be “understood as covering all forms of expression which spread, incite, promote or justify racial hatred, xenophobia, anti-Semitism or other forms of hatred based on intolerance”. See the Recommendation No. R (97) 20 of the Committe of Ministers of the Council of Europe, October 30, 1997. Indeed, hate speech does not benefit from the protection of Article 10 of the Convention [it refers to freedom of speech], and, under Article 17, speech that is incompatible with the values proclaimed and guaranteed by the Convention do not benefit from the protection of Article 10 See for instance ECHR, case of Gündüz v. Turkey, no. 35071/97, Strasbourg, november, 2003, § 41.

24. 3 -- Free speech versus the ‘Right to be forgotten’ THUS They are not absolute rights Protection of private life, data protection, reputation and dignity have to be balanced with the freedom of speech We must observe the circumstances of the case and apply the weighting criteria

25. 4 -- Reintroducing forgetting by Law: a possible way?

26. 4 -- Reintroducing forgetting by Law: a possible way? 3.0 web characteristics

27. 4 -- Reintroducing forgetting by Law: a possible way? The (in)efficiency of States Law in this global environment Public authorities can not have prior control Judicial control must be a posteriori Anonymity eases irresponsibility on the web The hard struggle against cybercrime

29. 4 -- Reintroducing forgetting by Law: a possible way? Proposals of Viktor Mayer-Schönberger (2009) Delete. The Virtue of Forgetting in the Digital Age. Princeton and Oxford: Princeton University Press. Information Rrivacy Rights Information ecology

30. 4 -- Reintroducing forgetting by Law: a possible way? My proposal: Defining a model of Pseudo-Anonymity on Internet as a Solution Communications are inherently traceable, but the identity of the Internet user (message sender, customer, online shopper, blogger, and so on) may seem truly anonymous. Cons Pros and

31. 4 -- Reintroducing forgetting by Law: a possible way? There are three reasonable proposals to reintroduce forgetting by Law, but no one seems to be easy at all The key role of public authorities

32. 5 -- A potential technological revival of forgetting – Implementing expiration dates The technological alternative Outside the Law Are not real solutions Digital abstinence Cognitive adjustment

33. 5 -- A potential technological revival of forgetting – Implementing expiration dates Digital Privacy Rights Infraestructure Full contextualitzation Expiration dates

34. 5 -- A potential technological revival of forgetting – Implementing expiration dates

35. 5 -- A potential technological revival of forgetting – Implementing expiration dates Smart Technology usefulness

36. 5 -- A potential technological revival of forgetting – Implementing expiration dates Cloud computing, e-mail and Web-based documents and calendars: The Vanish software Search engines: Robots.txt Mobile phone technology

37. Concluding remarks Living in a world that forgets nothing As a reaction the European Data Protection Agencies started recognizing the right to be forgotten in accordance with data protection principles It is not an absolute right, and it needs balacing with other legal or objective public interest

38. Concluding remarks Reintroducing forgetting by Law Information Privacy Rights: The European Proposal of General Data Protection Regulation is a bright example Information ecology A model of Pseudo-Anonymity on Internet

39. Concluding remarks Reintroducing forgetting by Technology Expiration Dates Digital Privacy Rights Infraestructure Full contextualization

40. PERE SIMÓN CASTELLANO Research Fellow, University of Girona Follow me on Twitter: @pere_simon My Personal Website: peresimon.com A CHALLENGE FOR DATA PROTECTION AND INFORMATION SECURITY CHARTING THE FUTURE OF THE ‘RIGHT TO BE FORGOTTEN’ UNDER EUROPEAN LAW