More Control Over Your Identity: the Right to be Forgotten
When I first sat down to write this second blog post, I fully intended to follow-up on my first post about social media and professional identity. I had great articles about LinkedIn and FOMO and the necessity of actively engaging online to build professional networks. But, during all that ruminating, my former law students kept coming to mind, throwing me off track. Law students who, frantically worried about what a Google search would reveal in their Moral Character application to the State Bar, would come to me for help.
One of my students was at the top of her law school class, editor of law review, and never worried for work in determining her future. However, when anyone googled her name, one of the first results was her mug shot and misdemeanor citation for being drunk and disorderly while on spring break in Miami as an undergrad. Talk about embarrassing. Not the image she wanted to project. To make a very long story short, she ended up paying a company a boat load of money to push those negative search results far down the list and prioritize her more recent, more laudable accomplishments.
These memories turned my mind toward an information and privacy principle known as the Right to be Forgotten. Generally, it’s about controlling and protecting one’s personal data online. I knew the basics, but the more I searched, the more nuances and depth I uncovered. While LinkedIn is important in the short-term, an individual’s control over their personal data is a much bigger, long-term concern. And it wasn’t just about privacy and people’s opinions about what search results should show. It affected social media companies and their business models. Amazingly, it swayed governments and foreign policy. It confronted freedom of speech tensions. It connected to the concept of memory, and even forced conversations on journalistic ethics. And to my surprise, I also began making connections to what we’ve talked about in class — the rise and metamorphosis of Twitter, how people use social media, and our most current topic of fake news, misinformation, and disinformation. Additionally, I began to connect it in other classes I’m taking about identity (Rutgers Professor Zerubavel) and autonomy over the creation of our own story (Krystal Tsosie). Lots of connections that I knew I couldn’t ignore.
The idea of the right to be forgotten began in about 2012 when a Spanish man sued Google Spain to remove information about his social security issues and related past bankruptcy. Google Spain refused to remove the information claiming it was part of the public record and it was in the public interest for the information to remain in search results. Due to its novelty, the Spanish court asked for the European Court of Justice (CJEU) to intervene. Ultimately, in May 2014, the CJEU ruled against Google / Google Spain declaring that European Union (EU) citizens had the right to ask search engines to remove personally identifiable content that is no longer considered relevant. [i]
Gaining even more traction and permanence, in May 2018, the EU passed the General Data Protection Regulation (GDPR). This sweeping legislation coordinated personal data and information protection throughout most of Europe. This new law applied to all EU citizens and businesses that offer services to EU citizens (e.g. Google, Facebook). Generally, it identified context areas for data processing and outlined common rules for data retention, storage and record keeping.[ii] Article 17 of the GPDR addressed the right to be forgotten, or the ability to ask for the companies to erase personal data, halt the further dissemination of data, and stop businesses from further processing personal data. It’s not a total erasure of information, but more of a right to ask to remove information that may be inaccurate, inadequate, irrelevant, or excessive. If companies do not comply with GDPR regulations, they face a fine of 4% of worldwide turnover or 20M euro, whichever is larger. That’s no chump change. As of 2021, over 800,000 people have asked to have data removed from search results. I expect the number to keep growing. [iii]
The passage of formal Right to be Forgotten legislation really set up a clash between European and American ideals. In America, we place a high value on the freedom of speech. Not only is it a legal principle, but really a moral one as well. Individuals and businesses have the freedom to express views and, if it’s not illegal, conduct business in any allowable manner. The GDPR gives unprecedented power to individuals and the ability to control how their personal data is used. If the same protection was implemented in the US, many experts, including Jeffrey Rosen of the National Constitution Center, warn that it could have a chilling effect on free speech. [iv]
While the US federal government may not be ready to pass sweeping data privacy changes, many states have not hesitated to implement changes. Virginia, Colorado, and, most significantly California, have all passed legislation giving individuals more power to control their personal online data and how it is used by companies from social media to groceries stores to online shopping.[v] In 2018, California passed the California Consumer Privacy Act. While some have questioned its effectiveness, the bill is the broadest in the nation, granting individuals the right to ask businesses what information they have about you, to delete that information, and to not sell that information to third parties. As with most legislation of its kind, companies must grant your request and make the request changes within a reasonable amount of time, usually around 30 days or so.[vi] The Pew Research Center recently reported that a whopping 74% of Americans say it is important for people to have the ability to keep potentially damaging items about themselves from being searchable. And 85% want the ability to remove embarrassing photos and videos of themselves.[vii] The number of states making personal data may change as public opinion grows.
One of the most unexpected things to come out of my search was coming across journal articles that took a different view of the Right to be Forgotten and its impact. Searching the web, a majority of what I found centered on different views of free speech, the large penalties and fines paid by Google and Facebook thus far, even why we’ll never have such a concept in the US. But I did find some gems. Dr. Noam Tirosh wrote a fascinating article about the right to be forgotten within a framework of memory studies and in relation to rights. He discusses how one has a right to construct their own narrative. He talks about social media and its ability to create a cultural memory. He also chastises critics of the law for emphasizing the forgetting of information, rather than focusing on the individuals.[viii] Dr. Kaliya Young continues the connection between the right to be forgotten and identity. Her paper discusses the domains of identity, and their association with and ability to control collected personally identifiable information (PII) that is stored in online databases.[ix] Lastly, one of the most interesting articles I read on the tension the right to be forgotten has caused was written by Ivor Shapiro and Brian Rogers. These journalists detailed several excellent arguments, both pro and con, about the ethical dilemmas journalists face when tackling this issue. One of the most interesting conclusions was that journalists and other news reporters, now more than ever, must work with news sources over how to detail and represent people’s stories. It’s a shared sort of autonomy.[x]
After all this, you’re probably asking yourself why should I even pay attention to this blog post? I’m happy with my social media presence. I’m not a Fortune 500 business owner seeking to make millions buying and selling data. I’m not even a government official. While I might have had a lot of fun on spring break, some of which I may not be proud of, I’m okay with future employers seeing me partying on the beach. But I’ll tell you, the amount of personal data each person leaves on the web every day is staggering. You never know where life is going. As future professionals, you never want someone else to tell your story. With the worldwide advances in data privacy and users having more control over how companies use people’s data, there is hope that if you ever do something that you’d like to remove when either applying for a job or another big decision, you’ve got a decent chance to at deleting those Facebook and Instagram posts along with Twitter tweets.[xi]
[i] EPIC, The Right to be Forgotten: https://archive.epic.org/privacy/right-to-be-forgotten/
[ii] CRS Reports, EU Data Protection Rules and US Implications: https://crsreports.congress.gov/product/pdf/IF/IF10896
[iii] General Data Protection Regulation, Article 17: https://gdpr-info.eu/art-17-gdpr/
[iv] Rosen, Jeffrey. Stanford Law Review, The Right to be Forgotten: https://www.stanfordlawreview.org/online/privacy-paradox-the-right-to-be-forgotten/
[v] IAPP, Legislation Tracker: https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
[vi] California Legislative Information: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
[vii] Pew Research Center Report (2020): https://www.pewresearch.org/fact-tank/2020/01/27/most-americans-support-right-to-have-some-personal-info-removed-from-online-searches/
[viii] Tirosh, N. (2017). Reconsidering the ‘Right to be Forgotten’ — memory rights and the right to memory in the new media era. Media, Culture & Society, 39(5), 644–660. https://doi.org/10.1177/0163443716674361
[ix] Young, K. (2018). The Right to Be Forgotten and the Domains of Identity. Journal of Information Ethics, 27(2), 98.
[x] Shapiro, I. & Rogers, B. M. (2017). How the “Right to be Forgotten” Challenges Journalistic Principles. Digital Journalism, 5(9), 1101–1115. https://doi.org/10.1080/21670811.2016.1239545
[xi] Wall Street Journal, How do Delete Your Old Posts on Instagram, Facebook, and Twitter: https://www.wsj.com/articles/how-to-delete-your-old-posts-on-instagram-facebook-and-twitter-11645283997
