My Right to be Forgotten = Your Obligation to Forget?
The balance between different rights (e.g. privacy Vs freedom of expression) is a well-known tension. But the creation of new rights that are so-called derivatives from privacy and seem to ignore both that tension and the fact that if you set up a right, it’s always better if it’s enforceable in practice, is a worrying trend. You will have guessed (if only due to the title of this post), that I am referring to the so-called “Right to be forgotten”, or “Droit à l’oubli numérique” in France (where it seems you get rights that apply only to the online world and not the offline one?), defined in the European Commission’s 4 November Communication on Personal Data Protection as:
“the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person’s consent and when he or she withdraws consent or when the storage period has expired”
This rather succinct provision has raised quite a few reaction, the Wall Street Journal stating “Forget any ‘Right to be Forgotten'”, whilst the Center for Democracy & Technology tries to make the point that “Europe Revisiting Privacy Laws is Opportunity, not Catastrophe” . The CDT links this right to be forgotten to the principle of data minimisation, seeming to imply they are synonymous…but then why would they be quoted in two separate bullet points of the Commission’s Communication? Techdirt also raises some interesting points in terms of unforeseen aspects that can arise with such a right.
But quite frankly, my problem with it is simpler than that: it’s bad branding. You can’t make people or machines for that matter forget something that has a chance of being disseminated across the world. Social media have exponentially changed the concepts of Dissemination and Duration of information and unless you kill the Internet (which seems to be one of the pursued options by some), there is no such thing as a right to be forgotten. And please don’t promise or even tell my kids that such a right was promised to them, as it would basically amount to a “Licence to act stupid” online, destroying my painstaking efforts at getting them to behave in a responsible manner both online and offline. There is such a concept as “legitimate expectations” in public law, that basically implies that if a public authority promises something to a citizen, they have the legitimate expection for that authority to deliver…and you can’t deliver on something called “right to be forgotten”…you might on something that’s called “right to have your data deleted” but I guess that doesn’t sound as sexy!
So to make a long story short, I made the “Infographic” (or actually “Storygraphic”) below to set out the type of expectations bad branding of rights can create (click on the image for a full view).