About the right to be forgotten
How an insignificant incident with UpWork made me wonder about a basic human right
Some backstory
In 2014 I opened a profile on oDesk because I was curious to learn more about online freelancing. I never actively used the platform, and I immediately forgot about it. In 2017 I got an email from UpWork informing me that they suspended my account because my profile violated their TOS.
My reaction was: “who? what?”. UpWork came out of the merge of oDesk and another website, Elance, so my oDesk profile became an UpWork profile. I tried to understand the incident but UpWork refused to explain:
I’m sorry for your unusual and negative experience on the platform. Unfortunately, I cannot share more specifics detail about the account for privacy and security purposes
In all honesty, I think that an automatic tool flagged it because the profile was largely incomplete.
Oh well, who cares?
Fast forward to 2021, I recover an old password manager, and I find those credentials for UpWork. I log in because I had no memory of it (7 years passed!), and I find myself “permanently suspended”. I contact support because I want to clean it up and close it. In my infinite ingenuity, I suggested that they could delete the data and close the account. Their reply was… how can I put it… disappointing. They told me that my account was irreversibly suspended for a “serious violation” with no way to recover it. They couldn’t give more information, and they added something like “please don’t contact us ever again”.
Wow! I regret that I didn’t save the message because it was the best “non-rude” rude reply I ever got.
I move on, but then I had one of those shower thoughts:
What if one day they merge with a potential employer and I end being banned from there too?
When I created that profile, I was living 1.000 km from where I am now and I may have another 20 years of career in front of me. Who knows!
I decide to use GDPR as a last resort hoping to find someone less robotic. A short later I get an automatic email confirming that they deleted everything, except for what can be used to identify me (so, basically, they didn’t delete anything):
We are required to retain certain data to comply with applicable laws. […] In particular, our records show that you have previously violated our Terms of Service, and Upwork has suspended your account and access to our services. […], we are retaining personal data relating to the suspected violations to prevent you from attempting to create an account or access our services again.
That’s it: I’m permanently banned by UpWork that I never used in my life because seven years ago I created an empty profile on the website of another company that doesn’t exist anymore (oDesk). Probably this will have precisely 0 impacts on my life, but it got me thinking about how insignificant things have repercussions beyond imagination and remain forever written in stone by a never-forgetting IT.
The Right to be Forgotten
Being forgotten is something natural in the “analogical” world. People simply move on, reputation fades, and even the most heroic or shameful facts tend to become lost in time. Even bankruptcies and crimes can be forgiven giving a second chance to people. In the “digital” world instead, there is a 100% perfect eternal memory forever preserving facts regardless of how irrelevant they may be. The concerning part is that unpredictable consequences stem from that.
It is a modern issue. We started talking about a Right to be Forgotten only in 2010 when a Spanish citizen sued Google “guilty” of making it easy for anyone to find out that that man had his home confiscated. It is easy to see the problem considering that googling someone’s name is the most basic screening process.
In the EU we have the GDPR, but it’s a law with so many exceptions that effectively it allows for a lot of discretion. It is enough for a company to say that some data can’t be erased because they need to comply with some vague regulation. The problem will inevitably grow with time because we live in times of permanent records and we disseminate more or less consciously personal information everywhere. Information that may be used against us years later. James Gunn fired by Disney is just one of the recent famous cases. The matter is also not easily solved because there is a clear conflict between the Freedom of Speech and the right for a company to fire (or not hire) an employee based on a post on Facebook.
Technically hard
Erasing someone’s data is complex because some information cannot be deleted. For example, a company can’t delete the request to delete someone’s data. It is a Catch-22 thing.
It is also really difficult to completely erase someone’s data from a system because the information is never in just one place. In an organization, customer’s data can end in one or more databases, ECM systems, emails, even calendars for appointments.
A technology like Blockchain is even designed to preserve against alteration. All the transactions ever made in Bitcoins are still out there forever visible and impossible to delete or hide. Good luck if they can trace that purchase you did! Applications based on Blockchain are growing beyond cryptocurrencies and it’s required (by law!) to find solutions to properly manage data.
Nowadays we have more or less mastered machine learning and solutions based on artificial intelligence are behind the corner, but little is known about how to make an AI forget something. Probably we will need to teach AI to ignore things, but in the age of “data is the new oil” this won’t be a priority I guess.
In conclusion
Our records can jump from company to company propagating incorrect information that may affect our lives. It’s hard to forget (or amend) our data and some future technology may not even allow it even if (inadequate) laws say the opposite. In a society where a product with 4 stars is “garbage”, we should really pay attention to maintain an immaculate online reputation or we may end in an episode of Black Mirror.
References
Aurelie Bayle, Mirko Koscina, David Manset, Octavio Perez-Kempner (2018) When Blockchain Meets the Right to be Forgotten: Technology Versus Law in the Healthcare Industry
Careerbuilder (2018) More Than Half of Employers Have Found Content on Social Media That Caused Them NOT to Hire a Candidate, According to Recent CareerBuilder Survey
Eduard Fosch Villaronga, Peter Kieseberg, Tiffany Li (2018) Humans forget, machines remember: Artificial intelligence and the Right to Be Forgotten
Kimberly W. O’Connor and Gordon B. Schmidt (2015) “Facebook Fired”: Legal Standards for Social Media–Based Terminations of K-12 Public School Teachers
