Scholarly article on topic 'Developments in the Right to be Forgotten'

Developments in the Right to be Forgotten Academic research paper on "Law"

0
0
Share paper
Academic journal
Human Rights Law Review
OECD Field of science
Keywords
{""}

Academic research paper on topic "Developments in the Right to be Forgotten"

Human Rights Law Review 13:4 © The Author [2013]. Published by Oxford University Press. All rights reserved. For Permissions, please email: journals.permissions@oup.com

doi:10.1093/hrlr/ngt035

Developments in the Right to be Forgotten

Dominic McGoldrick*

Keywords: right to be forgotten - right to privacy - the Internet - data protection - Proposal for a Regulation on General Data Protection

1. Introduction j

Human rights lawyers are familiar with the importance of the publication of 3

historical information on gross and systematic human rights violations so 0

that they will not be forgotten and will hopefully never happen again.1 In 3

terms of international human rights law this approach is also reflected in e

requirements related to effective remedies and restrictions that human rights 1

provisions impose on amnesties and on statutes of limitations for serious e

human rights violations.2 A newer phenomenon for human rights lawyers is 0'

( >3 ^

the idea of a Right to Be Forgotten as an aspect of the right to privacy. 2:

Section 2 explains the European Commissions 2012 Proposal for a Regulation 3.

on General Data Protection. Section 3 considers the Opinions of the Advocate e

General of the European Court of Justice in the Google Spain case on whether c

the operator of an Internet search engine should have the responsibilities of a r

controller of data protection. Section 4 assesses a 2013 judgment of the 0

European Court of Human Rights in Wegrzynowski and Smolczewski v Poland 10

in which that Court had to consider the protection of personal rights in a con- >

text of published material which continued to appear online. Section 5 H

* Professor of International Human Rights Law, University of Nottingham (dominic.mcgoldrick@ 4

nottingham.ac.uk).

1 See Report of Conadep (National Commission on the Disappearance of Persons, Argentina), Nunca Mas (Never Again), (1984), available at: www.desaparecidos.org/nuncamas/web/engl-ish/Iibrary/nevagain/nevagain_001.htmLit? [last accessed 16 September 2013].

2 See Human Rights Committee, General Comment No 31: The nature of the general legal obligation imposed on States Parties to the Covenant, CCPR/C/21/Rev.1/Add.13 (2004); 11 IHRR 905 (2004) at para 18.

3 Bernal prefers the idea of a 'right to delete, see Bernal, A Right to Delete?' (2011) 2 European Journal of Law and Technology; while Xanthoulis, infra n 22, prefers the idea of the 'right to oblivion'.

Human Rights Law Review 13:4(2013), 761-776

appraises the implications of the material in Sections 2-4 for the development of the right to be forgotten.

2. The Right to be Forgotten in the European Commission's Proposal for a Regulation on General Data Protection

The principal driver behind the idea of the right to be forgotten is the massive expansion in the availability and accessibility of information associated with the digital world of the internet.4 Information is a complex phenomenon. It is certainly not a neutral phenomenon. It reflects how history is remembered.5 There is a real sense in which, thanks to search engines,6 memory is now perfect and infinite.7 Information and how it is shared are crucial determinants in how culture is understood and exercised and how identity is constructed and perceived.8 Control over information means control over accountability and transparency, each of which are important values in a democratic system.9 The growth in 'big data' and databases, both public and private, has been massive10 and it has been followed by the development of technology for extracting meaningful and commercially or societally useful information by data matching, de-anonymisation and data mining.11 Control of and access to data generates §

public and private power. The decentralised nature of the Internet means that ef- s

fective and meaningful legal control and regulation is very difficult, if not C

4 See La Rue, Report of the Human Rights Council's Special Rapporteur on the promotion and ^ protection of the right to freedom of opinion and expression, A/HRC/17/27, 16 May 2011; and § The Digital Universe (2012), available at: www.emc.com/leadership/digital-universe/index. § htm [last accessed 16 September 2013]. S

5 See Ambrose, 'It's about Time: Privacy, Information Life Cycles, and the Right to be Forgotten' C (2013) 16 Stanford Technology Law Review 101. EL

6 See Halavias, Search Engine Society (Cambridge, MA: Polity 2009). £

7 See Mayer-Schonberger, Delete - The Value of Forgetting in the Digital Age (Princeton: Princeton g University Press, 2013). §

8 See Government Office for Science, Foresight Future Identities - Changing Identities in the UK: § The Next 10 Years (London, 2013), available at: www.bis.gov.uk/assets/foresight/docs/identity/ p 13-523-future-identities-changing-identities-report.pdf [last accessed 16 September 2013] l (suggesting that the Internet has not produced a new kind of identity; rather, it has been in- §§ strumental in raising awareness that identities are more multiple, culturally contingent and 0 contextual than had previously been understood). 4

9 See Ausloos, 'The ''Right to be Forgotten'' - Worth Remembering' (2012) 28 Computer Law and Security Review 7.

10 See Mayer-Schonberger and Cukier, Big Data: A Revolution That Will Transform How We Live, Work and Think (Boston: Houghton Miffin, 2013). Computers can find patterns that human beings cannot find.

11 See Cumbley and Church, 'Is ''Big Data'' Creepy' (2013) 29 Computer Law and Security Review 601; and Kerr, Steeves and Lucock (eds), Lessons from the Identity Trail: Anonymity, Privacy and Identity in a Networked Society (New York: Oxford University Press, 2009). On a different dimension of data mining, see Thurman 'Meeting on Data Mining, Human Rights and Ethics', available at: www.detecter.bham.ac.uk/documents.html [last accessed 8 October 2013].

impossible.12 There has been some development of the idea of the right to be forgotten by national courts in Europe and Argentina13 and by data protection agencies in Europe.14 In 2009 France published a voluntary Charter of Good Practices on the right to be forgotten on social networks and search engines. However, the major focus for discussion of the right to be forgotten has been in the context of the Proposal for a Regulation on General Data Protection from the European Commission of the European Union.16 Article 17 of the Proposal provides the individuals (the data subjects) 'right to be forgotten and to erasure'.17 Under Article 17:

The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child, where one of the following grounds applies: r

a. the data are no longer necessary in relation to the purposes for which ° they were collected or otherwise processed; o

b. the data subject withdraws consent on which the processing is 3

based..., or when the storage period consented to has expired, and 0

where there is no other legal ground for the processing of the data; ^

c. the data subject objects to the processing of personal data pursuant to e Article 19 [the right to object]; l

d. the processing of the data does not comply with this Regulation for e other reasons. 0

12 See Cate, 'The Growing Importance and Irrelevance of International Data Protection Law' ^ (LCIL Snyder Lecture, Cambridge, 2012), video available at: www.sms.cam.ac.uk/media/ 3 ' 1189077?format=mpeg4&quality=360p [last accessed 16 September 2013]. Cumbley and e Church, supra n 11 at 608, argue that '[b]ig data is creating a credibility gap between the C formal expectations of data protection laws and the implementation of those laws in practice.' 3

13 See also Sreeharsha, 'Google and Yahoo Win Appeal in Argentine Case', New York Times, 20 £ August 2010, at B4. g

14 On developments in France, Italy and Spain, see Castellano, A Test for Data Protection Rights 3 Effectiveness: Charting the Future of the ''Right to Be Forgotten'' under European Law, The 3 Colombia Journal of European Law Online, available at: www.cjeI.net/onIine/19.2-casteIIano/ p [last accessed 16 September 2013]. l

15 See Kuschewsky, 'The Right to be Forgotten - The Fog Finally Lifts' (2012) 12 Privacy and Data 3 Protection 10. 0

16 Proposal for a Regulation of the European Parliament and of the Council on the protection of 4 individuals with regard to the processing of personal data and on the free movement of such

data, General Data Protection Regulation, COM (2012) final. In EU terms, it is of major legal significance that it would be in the form of a Regulation rather than a Directive.

17 For commentary, see Ciuickowska-Leszczewicz, 'The Right to be Forgotten, European Approach to Protection of Personal Data' (2012) 4 University ofWarmia and Mazury Law Review 27; and Ambrose and Ausloos, 'The Right to Be Forgotten Across the Pond' (2013) 3 Journal of Information Policy 1. For analyses of the technical problems in achieving the right, see European Network and Information Security Agency, The Right to Be Forgotten - Between Expectations and Practice (2011), available at: www.enisa.europa.eu/activities/identity-and-trust/ library/deliverables/the-right-to-be-forgotten [last accessed 16 September 2013]; and O'Hara, 'Can Semantic Technology Help Implement a Right to be Forgotten?' (2012) 22 Computers and Law 12.

Personal data is defined broadly as 'any information relating to a data subject' whether it 'relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer's IP address.'18 It is not just information voluntarily provided by that subject. The Proposal further elaborates and specifies the right of erasure provided for in Article 12(b) of Directive 95/46/EC19 and provides the conditions of the right to be forgotten, including the obligation of the 'controller',20 which has made the personal data public, to inform third parties on the data subject's request to erase any links to, or copy or replication of, that personal data. Article 17 also integrates the right to have the processing restricted in certain cases.21

In human rights terms the idea of the right to be forgotten is commonly located within the ambit of the right to privacy.22 One aspect of a proposed right to be forgotten concerns the degree of control that an individual has on the public availability of, and use of, personal data information about themselves.23 Issues of consent, control and the possibilities to secure deletion are central issues covered by the Proposal. The critical economic and financial interests of those who gather, use and sell the information was also acknowledged, particularly in the context of the European Union (EU).24 A second aspect concerns the use of information obtained about individual persons in g

particular decision-making contexts such as employment.25 §

S t o"

18 European Commission's press release announcing the proposed comprehensive reform of data ^ protection rules, 25 January 2012, available at: europa.eu/rapid/press-reIease.IP-12-46.en. § ' htm?locale=en [last accessed 16 September 2013]. S

19 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the C protection of individuals with regard to the processing of personal data and on the free move- § ment of such data, OJ [1995] L281/31. b

20 See Section 3 below. a

21 See Explanatory Memorandum to the Proposal at 9, available at: ec.europa.eu/just § ice/data-protection/document/review2012/com_2012_11_en.pdf [last accessed 16 September § 2013]. p

22 See Xanthoulis, 'The Right to Oblivion in the Information Age: A Human Rights Based l Approach' (2013) 10 US-China Law Review 84. §§

23 These aspects are drawn from Koops, 'Forgetting Footprints, Shunning Shadows. A Critical 0 Analysis of the 'Right to Be Forgotten' in Big Data Practice' (2011) 8 SCRIPTed; Tilburg Law 4 School Legal Studies. Article 8 of the European Charter of Fundamental Rights 2000 provides

for the 'protection of personal data'.

24 See Advocate General's Opinion in Google Spain case, infra n 35 at para 124: 'Commercial internet search engine service providers offer their information location services in the context of business activity aiming at revenue from keyword advertising. This makes it a business, the freedom of which is recognised under Article 16 of the Charter in accordance with EU law and national law'

25 See Sprague, 'Rethinking Information Privacy in an Age of Online Transparency' (2009) 25 Hofstra Labour and Employment Journal 395; and Sanders, 'Privacy is Dead: The Birth of Social Media Background Checks' (2012) 39 Southern University Law Review 243, available at: ssrn. com/abstract=2020790 [last accessed 16 September 2013].

A third and much more complicated aspect concerns the idea that an individual's (including a child's) autonomous ability to develop their personality, identity and reputation should not be overly restricted by information about their past,26 even if the information is true.27 The classic example is that of information on a persons criminal convictions after they have served their sentence. In some jurisdictions some convictions become spent after a certain period of time.28 There are other privacy dimensions of the right to be forgotten that could be formulated.29 The range of dimensions makes legal formulation of the right and its attendant remedies difficult to formulate.30 Moreover, inasmuch as the right is conceived of as an aspect of privacy, there is no doubt that modern communication technologies are forcing a rethink of conceptions of privacy.31

The Commissions aim was to have the Regulation adopted in 2014 with its taking effect in 2016 after a transition period of two years. The European Parliament has proposed a number of amendments to Article 17 and related Articles.32 The Regulation is of major international significance because the EU rules must apply even where personal data is handled abroad by companies beyond the borders of the EU but that are active in the EU market and offer their services to EU citizens.33 The Regulation includes a compliance regime with severe penalties of up to two per cent of worldwide turnover.34

26 See Graux, Ausloos and Valcke, 'The Right to be Forgotten in an Internet Era' (2012) ICRI Working Paper, available at SSRN: ssrn.com/abstract=2174896 [last accessed 16 September 2013]. Cf. The Proposed Amendments to the US's Children's Online Privacy Protection Act entitled 'Do Not Track Kids', House of Representatives 1895,112th Congress, 1st session, 2011, N available at: www.govtrack.us/congress/biIIs/112/hr1895 [last accessed 16 September 2013].

27 On the right to privacy being used to prohibit the publication of true information about an affair between two consenting adults, see CC vAB [2006] EWHC 3083 (QB).

28 This is part of the French idea of le droit a I'oubli or the right of oblivion. Other examples occur in reIation to bankruptcy and credit reporting.

29 Some of these aspects could also be conceived of as informational property rights.

30 See Ambrose and Ausloos, supra n 17; and Koops, supra n 23.

31 For example, the idea of 'reasonable expectation' is fundamental to the evolving scope of the right to privacy under ECHR and under US constitutional law: See Von Hannover v Germany 2004-VI; 43 EHRR 7, at para 69; United States v Meregildo 883 F.Supp. 2d 523, 2012 WL p 3264501 (SDNY 10 August 2012) (privacy settings and friend-count may play a crucial role l in the legal analysis of privacy expectations); and Newell, 'Rethinking Reasonable Expectations of Privacy in online social networks' (2011) 17 Richmond Journal of Law and 0 Technology 12. 4

32 See the Draft Report on the proposed ReguIation by AIbrecht, Rapporteur for the CiviI Liberties, Justice and Home Affairs Committee of the European Parliament, 17 December 2012, ((C0M(2012)0011 - C7-0025/2012 - 2012/0011(C0D) clarifying Article 17 and highlighting the need to respect the right to freedom of expression), available at: www.europarl. europa.eu/sides/getDoc.do?type=C0MPARL&mode=XML&Ianguage=EN&reference=PE501.927 [last accessed 16 September 2013].

33 Hence the concerns from commentators from the US, see Ambrose and AusIoos, supra n 17; and Walker, 'The Right to Be Forgotten' (2012) 64 Hastings Law Journal 257; see also Svantesson, 'Fundamental Policy Considerations for the Regulation of Internet Cross-Border Privacy Issues' (2011) 3 Internet and Policy 115.

34 US-based Google's turnover for 2012 was $50.175 billion (£31.7bn).

3. Google Spain, SL, Google Inc v Agencia Espanola de Proteccion de Datos

A critically important question is whether for the purposes of Directive 95/46/ EC, an Internet search engine provider is a 'controller' of personal data on third-party source web pages. In Google Spain, SL, Google Inc v Agencia Espanola de Proteccion de Datos the issue before the Court of Justice of the EU (CJEU) concerned an order from Spain's highest court Audiencia Nacional 0

to Google to delete information from its search engine results concerning a g

Spanish citizens financial problems. These had been detailed in two old news g

reports both of which were republished at a later date in its electronic version S

made available on the Internet. The individual concerned considered that this o

information should no longer be displayed in the search results presented by tj

the Internet search engine, operated by Google, when a search was made of /

his name and surname. Advocate General jaaskinens Opinion was that .

Google was not generally to be considered as a 'controller' of the personal data f

appearing on web pages it processed, who, according to the Directive 95/46/ j

EC, would be responsible for compliance with data protection rules.36 g

Although it deals with complex technical issues related to the Internet, the .

Opinion is dominated by human rights concerns. Central to his conclusion /

was that the general scheme of the Directive, most language versions of it and S

the individual obligations it imposed on the controller were based on the idea a

of responsibility of the controller over the personal data processed, in the sense S

that the controller was aware of the existence of a certain defined category of a

information amounting to personal data and the controller processes this ^

data with some intention which related to their processing as personal §

data.37However, provision of an information location tool, such as a search ^

engine, did not imply any control over the content included on third party a

web pages. It did not even enable the Internet search engine provider to distin- S

guish between personal data in the sense of the Directive, which related to an r

identifiable living natural person, and other data. The Internet search engine S

provider could not in law or in fact fulfil the obligations of the controller pro- A

vided in the Directive in relation to personal data on source web pages hosted l

on third-party servers.38 Therefore, a national data protection authority could S

not require an Internet search engine service provider to withdraw informa- 4

tion from its index except in cases where this service provider had not

35 Case C-131/12.

36 The Advocate General's Opinion is available at: eur-Iex.europa.eu/LexUriServ/LexUriServ.do? uri=CELEX:62012CC0131:EN:HTML [last accessed 16 September 2013]. According to Article 2(d) of the Directive, a controller is 'the natural or legal person... which alone or jointly with others determines the purposes and means of the processing of personal data'.

37 See ibid. at para 82 (emphasis in original).

38 See ibid. at paras 76-100.

complied with exclusion codes39 or where a request emanating from a website regarding an update of cache memory had not been complied with.40 A possible 'notice and take down procedure'41 concerning links to source web pages with illegal or inappropriate content was a matter for national civil liability law based on grounds other than data protection. The Advocate Generals Opinion was also clear that the Directive did not establish a general 'right to be forgotten'.42 Such a right could not therefore be invoked against search engine service providers on the basis of the Directive, even when it was interpreted in accordance with the Charter of Fundamental Rights of the EU.43 The Directive granted any person the right to object at any time, on compelling legitimate grounds relating to his particular situation, to the data controller's processing of data relating to him, save as otherwise provided by national legislation. However, a subjective preference alone did not amount to a compelling legitimate ground and thus the Directive did not entitle a person to restrict or r

terminate dissemination of personal data that he considered to be harmful or X

contrary to his interests. or

The Opinion noted that the reference in the case before it concerned per- u

sonal data published in the historical archives of a newspaper. It cited the ob- l

servations of the European Court of Human Rights (ECtHR) in Times r

Newspapers Ltd v United Kingdom (Nos 1 and 2)44 that Internet archives made a t

substantial contribution to preserving and making available news and r

information: s

Such archives constitute an important source for education and historical research, particularly as they are readily accessible to the public and are generally free.... However, the margin of appreciation afforded to States in striking the balance between the competing rights is likely to be greater where news archives of past events, rather than news reporting of current affairs, are concerned. In particular, the duty of the press to act in accordance with the principles of responsible journalism by ensuring accuracy [my emphasis] of historical, rather than perishable,

39 The publisher of a source web page can include 'exclusion codes', which advise search engines not to index or store a source web page or to display it within the search results. Their use indicates that the publisher does not want certain information on the source web page to be retrieved for dissemination through search engines.

40 See Advocate General's Opinion, supra n 36 at paras. 91-93. For the purposes of indexing and displaying search results, a copy of a visited page is registered in the cache memory of the search engine.

41 As referred to in Article 14 of the ecommerce Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, available at: eur-lex.europa.eu/Lex UriServ/LexUriServ.do?uri=CELEX:32000L0031:En:HTML [last accessed 16 September 2013].

42 See Advocate General's Opinion, supra n 36 at paras 104-111.

43 Ibid. at paras 126-136.

44 ECHR Reports 2009.

information pubIished is IikeIy to be more stringent in the absence of any urgency in publishing the material.45

In the Advocate Generals Opinion, a newspaper publisher's freedom of information protected its right to digitaIIy repubIish its printed newspapers on the Internet. The authorities, including data protection authorities, could not censure such republishing. In the Times Newspapers case the ECtHR had demonstrated that the IiabiIity of the pubIisher regarding accuracy of historicaI pubIications may be more stringent than that which appIies to current news, and may require the use of appropriate caveats supplementing the contested content. However, there could be no justification for requiring digital repub-Iishing of an issue of a newspaper with content different from the originaIIy published printed version. That would amount to falsification of history.46 Requesting search engine service providers to suppress Iegitimate and IegaI information that had entered the pubIic domain wouId entaiI an interference with the freedom of expression of the publisher of the web page. This would amount to censorship of his published content by a private party.47 However, it was possibIe that the secondary IiabiIity of the search engine service providers under nationaI Iaw may Iead to duties amounting to bIocking access to third-party websites with iIIegaI content such as web pages infringing inteIIec-tual property rights or displaying libellous or criminal information.48

It is submitted that the Advocate Generals Opinion with respect to the liability of search engine service providers is sensible, balanced and pragmatic. It focusses on the genuine possibilities of the controller exercising responsibility. If foIIowed by the CJEU, the approach in the Spanish Google case wiII undoubt-edIy have a very significant impact on the drafting of the ReguIation on Data Protection.

4. Wegrzynowski and Smolczewski v Poland

In some contexts the wish to pubIish aspects of information about individuaIs necessariIy means that the right to freedom of expression, incIuding access to information, aIso comes into pIay.49 This was the situation that faced the

45 See supra n 36 at para 123. In Times Newspaper, ibid. at para 48, the ECtHR also observed that IibeI proceedings brought against a newspaper after a significant Iapse of time may weII, in the absence of exceptionaI circumstances, give rise to a disproportionate interference with press freedom under Article 10.

46 Ibid. at para 129.

47 Ibid. at para 134.

48 Ibid. at para 135.

49 Article 17(3) of the proposed Regulation acknowledges freedom of expression, Article 80 the processing of information for journalistic purposes or for 'artistic and literary expression' and ArticIe 83 for 'historicaI, statisticaI and scientific research' purposes as Iimitations on the right to be forgotten. Article 80 obliges Member States to adopt exemptions and derogations from specific provisions of the ReguIation where necessary to reconciIe the right to the protection of personal data with the right of freedom of expression. It is based on Article 9

ECtHR in Wegrzynowski and Smolczewski v Poland.50 The decision of the ECtHR is important in its own right but is particularly significant because of the impending accession of the EU to the ECHR.51 This means that any EU Regulation on Data Protection could be challenged before the ECtHR.

In 2002 two journalists working for the national daily newspaper Rzeczpospolita had published an article alleging that W and S, who were lawyers, had made a fortune over the years by assisting in shady business deals in which politicians were involved. The journalists had alleged that W and S had taken advantage of their positions at the expense of the public purse by obtaining unjustified benefits from the manner in which they had carried out their professional roles as liquidators of State-owned companies in bankruptcy. W and S had succeeded in claims under Articles 23 and 24 of the Civil Code for the protection of their personal rights. The national court found that the journalists had failed to contact the applicants and that their allegations were, to a large extent, based on gossip and hearsay. The journalists had failed to take the minimum steps necessary in order to verify the information contained in the article by at least getting in touch W and S and trying to obtain their comments. The allegations had not been shown to have had a plausible factual basis. The journalists had smeared W and S's good name and reputation. The Court allowed W and S's claim in its entirety, by ordering the journalists and the editor-in-chief to pay, jointly, PLN 30,000 to a charity and to publish an apology in the newspaper. In 2003 the Warsaw Court of Appeal (CA) dismissed an appeal from the newspaper, endorsing the findings of fact and the reasoning of the first-instance court. It indicated that it was desirable for a comment on the outcome of the civil proceedings to be added to the arti- ?

cle on the website. The obligations imposed by the courts were subsequently s ■

complied with by the defendant newspaper. d

In July 2004 W and S again sued the newspaper under the same provisions gg

of the Civil Code. They alleged that they had recently found out that the article b

of Directive 95/46/EC, as interpreted by the Court of Justice of the EU in C-73/07, Satakunnan g

Markkinaporssi and Satamedia 2008 ECR at I-9831. These limitations would present consider- p

able practical problems for search engines which generally operate as neutral platforms. l

There is also a 'household exception' in Article 2(1)(d) which would normally cover, for ex- g

ample, an individual's social networking contributions: see Fazlioglu, 'Forget Me Not: the 0

clash of the right to be forgotten and freedom of expression on the Internet' (2013) 4

International Data Privacy Law 149. On the approach in the US, see Rosen, 'The Right to Be Forgotten' (2012) Stanford Law Review Online 88, available at: www.stanfordlawreview.org/ online/privacy-paradox/right-to-be-forgotten [last accessed 16 September 2013].

50 Application No 33846/07, Merits and Just Satisfaction, 16 July 2013; see also Smet, 'Freedom of Expression and the Right to Reputation: Human Rights in Conflict' (2010) 26 American University Law Review 183.

51 See 'Fifth Negotiation Meeting Between The CDDH Ad Hoc Negotiation Group And The European Commission On The Accession Of The European Union To ECHR', available at: www.coe. int/t/dghI/standardsetting/hrpoIicy/Accession/Meeting_reports/47.1(2013)008rev2EN.pdf [last accessed 16 September 2013]; and ECtHR, Factsheet - Case-law concerning the EU, available at: echr.coe.int/Documents/FS.European.Union.ENG.pdf [last accessed 16 September 2013].

remained accessible on the newspaper's Internet website. They submitted that the article was positioned prominently in the Google search engine and that anyone seeking information about them had very easy access to it. The articles availability of the article on the newspapers website, in defiance of the earlier judicial decisions, created a continuing situation which enabled a large number of people to read it. The applicants' rights were thereby breached in the same way as had occurred through the publication of the original article. It rendered the protection granted by the judgments in their favour ineffective and illusory. The applicants sought an order requiring the defendants to take down the article from the newspapers website and publish a written apology for their rights having been breached by way of the article's continued presence on the Internet. They sought compensation in the amount of PLN 11,000 for non-pecuniary damage. The 2004 claims were not successful. For the CA it p

was of of cardinal importance for the assessment of the case that the article r

had been published on the newspapers website in December 2000. The Court o

noted that Wand S had submitted that they had only learned of its online pub- r

lication a year after the judgment given in April 2003 had become final. o'

However, the fact that in the first set of proceedings in 2002 W and S had 3

failed to make a specific request for remedial measures in respect of the r

online publication made it impossible for the Court to examine facts which 3

had already existed prior to that judgment. W and S could not lodge a new e

claim based on factual circumstances which had already existed during the s

previous set of proceedings. The Court noted that the existing online publica- C

tion was not a fact which would have been impossible to establish at that time. g

W's claim before the ECtHR was inadmissible for failure to comply with o

the six-month time limit and for failure to exhaust domestic remedies as he | ■

had not filed a cassation appeal before the Supreme Court. Poland also argued e

that S had not exhausted domestic remedies as he could have applied to the 3

domestic courts seeking an interim injunction. However, the ECtHR observed, i

inter alia, that 'the Government failed to adduce any case-law of the domestic §

courts or examples of the medias practice to show that a rectification g

request under Article 31 of the Press Act has ever been successfully used P

to have a defamatory article present on a newspapers website removed from 9

it or rectified by the addition of a reference to a judgment finding it 0

defamatory'.52 4

As for the merits of S's case, the ECtHR recited its standard jurisprudence on Article 8 of the ECHR covering its object, the requirement for interferences, the positive obligations inherent in respect for private life and the wide margin of appreciation enjoyed by Contracting Parties in determining the steps to be taken to ensure compliance with the Convention, account being

52 Wggrzynowski and Smolczewski, supra n 50 at para 45.

taken of the needs and resources of the community and of individuals,53 that as a matter of principle, the rights guaranteed by Articles 8 and 10 (freedom of expression) deserved equal respect54 and that, in the context of freedom of expression constituting one of the essential foundations of a democratic society the safeguards guaranteed to the press were particularly important.55 The most careful of scrutiny under Article 10 was required where measures or sanctions imposed on the press were capable of discouraging the participation of the press in debates on matters of legitimate public concern. Furthermore, o

particularly strong reasons must be provided for any measure limiting access l

to information which the public had the right to receive. At the same time, e

the press must not overstep certain bounds, particularly as regards the reputa- §

tion and the rights of others. The ECtHR devoted a specific paragraph to the 3

Internet: p

The Court has held that the Internet is an information and communica- r

tion tool particularly distinct from the printed media, especially as re- f

gards the capacity to store and transmit information. The electronic j

network, serving billions of users worldwide, is not and potentially will |

never be subject to the same regulations and control. The risk of harm .

posed by content and communications on the Internet to the exercise /

and enjoyment of human rights and freedoms, particularly the right to 3

respect for private life, is certainly higher than that posed by the press. i

Therefore, the policies governing reproduction of material from the S

printed media and the Internet may differ. The latter undeniably have to i

be adjusted according to technology's specific features in order to secure 3

the protection and promotion of the rights and freedoms concerned ...56 §

The ECtHR recalled its earlier jurisprudence that Internet archives fall e

within the ambit of the protection afforded by Article 10 of the ECHR.57 It a

stressed the substantial contribution made by Internet archives to preserving i

and making available news and information. Such archives constituted an im- §

portant source for education and historical research, particularly as they

53 Ibid. at paras 53-56.

54 Ibid. at para 56. Freedom of expression and privacy are more balanced in Europe than in the US where First Amendment concerns dominate: see Rosen, 'The Deciders: The Future of Privacy and Free Speech in the Age of Facebook and Google' (2012) 80 Fordham Law Review 152; and United States v Jones 132 SCt 945 (2012). On the scope of the US tort of public disclosure of private facts, even if those facts are true, see Barbas, 'Death of the Public Disclosure Tort: A Historical Perspective' (2010) 22 Yale Journal of Law and Humanities 171. Disclosure of private facts includes publishing or widespread dissemination of private facts that are non-newsworthy, not part of public records, public proceedings, not of public interest, and would be offensive to a reasonable person if made public.

55 Ibid. at para 57.

56 Ibid. at para 57, citing Case of Editorial Board of Pravoye Delo and Shtekel v Ukraine ECHR Reports 2011 (extracts).

57 Ibid. at para 59, citing Times Newspapers Ltd v United Kingdom (Nos 1 and 2), supra n 44 at para 27.

were readily accessible to the public and are generally free. While the primary function of the press in a democracy was to act as a 'public watchdog', it had a valuable secondary role in maintaining and making available to the public archives containing news which has previously been reported. The maintenance of Internet archives was a critical aspect of this role.58 The ECtHR recalled its judgment in the Times Newspapers case59 that, in the context of an Article 10 complaint brought by a newspaper, a requirement to publish an appropriate qualification to an article contained in an Internet archive, where it had been brought to the notice of a newspaper that a libel action had been initiated in respect of that same article published in the written press, did not constitute a disproportionate interference with the right to freedom of expres-sion.60 Such an obligation in respect of an Internet archive managed by a publisher of a newspaper itself was not excessive. The ECtHR had also noted with approval that the domestic courts in the Times Newspaper case had not suggested that potentially defamatory articles should be removed from archives altogether.61

The ECtHR noted that the presence of the offending article on the newspaper's website and the States positive obligations under Article 8 arising in this context were examined by the Polish domestic courts. During the first set of civil proceedings the applicants had failed to make claims regarding the article's continued presence on the Internet. Therefore, the courts could not adju- r dicate on this matter. The judgments given in the first case did not create for l the applicants a legitimate expectation to have the article removed from the C newspaper's website.62 It was further noted that the domestic courts found g' that the article had been published on the newspaper's website simultaneously °

with the print edition in December 2000. The applicant did not challenge this 1 ■

finding in his appeals. Therefore, the second case against Rzeczpospolita d brought by the applicant in 2004 concerned the same factual circumstances.

The Internet archive of Rzeczpospolita was a widely known legal resource for b

Polish lawyers and for the general public, often used and accessed by members y

of legal professions. No arguments had been submitted to the ECtHR to justify 1

the applicant's failure to ensure that the scope of the first defamation claim en- r

compassed the article's presence on the newspaper's website.63 S had been ,

58 Ibid. at para 59.

59 Supra n 57.

60 See also Judgment No 5525/2012 (4 May 2012) of the Italian Court of Cassation on the right to update and 'contextualise' digital archives of newspaper reports, discussed in Monoriti, 'Digital archives and data protection. The right to update and contextualise newspaper news', available at: www.IexoIogy.com/Iibrary/detaiI.aspx?g=0ee718c4-fb52-4690-bd5f-80d48fce071b [last accessed 16 September 2013].

61 Citing Times Newspapers, supra n 57 at para 47.

62 Wegrzynowski and Smolczewski, supra n 50 at para 61.

63 Ibid. at para 62.

given an opportunity to bring his claims concerning the Internet version of the article before the courts and to have them examined in judicial proceedings incorporating a full array of procedural guarantees. It had not been demonstrated that no appropriate legal framework was in place at the relevant time. Nor that the absence of such a framework made it impossible for the applicant to defend his rights.64 The ECtHR noted the finding made by the Warsaw Regional Court that the article in question had been published in the print edition of the newspaper. That Court expressed the view that it was not for the courts to order that the article be expunged as if it had never existed. The ECtHR accepted that it was not the role of judicial authorities to engage in rewriting history by ordering the removal from the public domain of all traces of publications which had in the past been found, by final judicial decisions, to amount to unjustified attacks on individual reputations. Furthermore, it was relevant for the assessment of the case that the legitimate interest of the r

public in access to the public Internet archives of the press was protected X

under Article 10.65 r

The ECtHRs view was that the alleged violations of rights protected under u

Article 8 should be redressed by adequate remedies available under domestic l

law. In this respect, it was considered noteworthy that the Court of Appeal §

observed that it would be desirable to add a comment to the article on the web- t

site informing the public of the outcome of the civil proceedings in which the r

courts had allowed the applicants' claim for the protection of their personal §

rights claim. The ECtHR was therefore satisfied that the domestic courts were C

aware of the significance which publications available to the general public |

on the Internet had for the effective protection of individual rights. In addition, °

the courts showed that they appreciated the value of the availability on the 3 ■

newspapers website of full information about the judicial decisions concerning d

the article for the effective protection of the applicants rights and reputation.66 l

However, the ECtHR emphasised that S did not submit a specific request for b

the information to be rectified by means of the addition of a reference to the y

earlier judgments in his favour. It was neither shown nor even argued before §

the ECtHR that under the applicable legal framework S could not have re- IT

quested the court to specify the steps that they wished to be taken in respect ,

of the Internet publication with a view to securing the effective protection of 1

their reputation.67

64 The ECtHR pointed to the comparison situation in K.U. v Finland ECHR Reports 2008; 48 EHRR 52 at para 49, in which the ECtHR held that Finland was in breach of its positive obligation under Article 8 ECHR because a person who had placed a sexually defamatory announcement on a website could not be identified, and thus could not be prosecuted, and the child victim had only the possibility of suing the service provider.

65 Wegrzynowski and Smolczewski, supra n 50 at para 65.

66 Ibid. at para 66.

67 Ibid. at para 67. Again the contrast was made with K.U. v Finland, supra n 64, where no such possibility was available to the applicant.

Taking into account all the circumstances of the present case, the ECtHR accepted that the State had complied with its obligation to strike a balance between the rights guaranteed by Article 10 and Article 8. A limitation on freedom of expression for the sake of S's reputation in the circumstances of the present case would have been disproportionate under Article 10.68 Therefore, the ECtHR unanimously held that there was no violation of Article 8.

5. Appraisal I

As noted, the right to be forgotten is complex to formulate in legal terms be- f

cause its ambit encompasses a wide range of different matters.69 Some are |

closely related to traditional aspects of privacy but some go much wider. p

The right as proposed by the European Commission faces significant political h

and commercial opposition and, as noted in 2013 the European Parliament O

proposed a number of amendments relating to the right to be forgotten.70 I

Even if these can be overcome the developments considered above clearly U

have important implications for the legal ambit of the right to be forgotten. |

First, freedom of expression clearly applies to the Internet and Article 10 of I

the ECHR protects the legitimate interest of the public in access to the public |

Internet archives of the press. In particular, Internet archives constitute an im- e

portant source for education and historical research, particularly as they are s

readily accessible to the public and are generally free. Policies governing repro- C

duction of material from the printed media and the Internet may differ. The 0

latter have to be adjusted according to technology's specific features in order O

to secure the protection and promotion of the rights and freedoms concerned. I ■

Many cases will concern a balance between rights to privacy and expression. e

However, the margin of appreciation afforded to States in striking the balance g

between those competing rights is likely to be greater where news archives of b

past events, rather than news reporting of current affairs, are concerned. J

While an aggrieved applicant must be afforded a real opportunity to vindicate |

his right to reputation, libel proceedings brought against a newspaper after a -IT*

significant lapse of time may well, in the absence of exceptional circumstances, ,

give rise to a disproportionate interference with press freedom under Article 10. 1

Secondly, it is crucial that in the domestic courts proceedings the claimant seeks a remedy specifically in relation to publication on the Internet and specifies the steps that they wished to be taken in respect of the Internet

68 Ibid. at para 68 citing Karako v Hungary 52 EHRR 36 at para 28.

69 See supra Section 2; and Fleischer (Global Privacy Counsel at Google), 'Foggy Thinking About Right to Oblivion, 9 March 2011, (more and more, privacy is being used to justify censorship), available at: peterfleischer.blogspot.com/2011/03/foggythinking-about-right-to-oblivion.html [last accessed 16 September 2013].

70 See supra n 32.

publication with a view to securing the effective protection of their reputation. This is so irrespective of whether the claim is for defamation or violation of privacy or personal rights. Thirdly, it may be that the limits of an individuals remedy for defamation or violation of personal rights lies in the addition of a degree of contextualisation71 - a comment, caveat or reference on the Internet version of the relevant article to the outcome of the civil proceedings concerning the applicants' claim. This is consistent with the argument that the liability of the publisher regarding the accuracy of historical publications may be more stringent than those of current news. However, there is no justification for requiring digital republishing of an issue of a newspaper with content different from the originally published printed version. The latter would be regarded as censorship and the rewriting of history. Fourthly, search engine service providers will not normally be regarded as data controllers' and so will not be liable under European data protection regulations. It is possible that the secondary liability of the search engine service providers under national law may lead to duties amounting to blocking access to third-party websites with illegal content such as web pages infringing intellectual property rights or displaying libellous or criminal information. The reference to 'displaying libellous... information' must be taken to refer to the repeated publishing of the original information on the Internet rather than to the existence of the originally libellous article in an Internet archive. It is increasingly argued that the accessibility of the Internet, the massive expansion of data, the phenomenon of social media and the speed of technological innovation have combined to change conceptions of public space and rendered the concept of privacy as a social norm as passe'.72 The developments in the legal o ambit of a right to be forgotten considered in this article are interesting in §' part because they mark a not insignificant reassertion that privacy is seen as d having a continual societal and instrumental value that must be given some §§ degree of protection. If the legal status of the right to be forgotten continues b to develop, both in national jurisdictions and within a future EU regulation,73 § the situation will be reached where the historical aspects of one's private life §

71 On 'contextualisation' see the important 2012 decision of the Italian Court of Cassation, supra §§ n 60. g

72 See Scaife, 'The Regulation of Social Media' (2012) 14 E-Commerce Law and Policy 6; Marsoof, 4 'Online Social Networking over the Right to Privacy: The Conflicting Rights of Privacy and Expression' (2011) 19 International Journal of Law and Information Technology 110; Mindell, 'Rewriting Privacy: The Impact of Online Social Networks' (2012) 23 Entertainment Law

Review 52; McGoldrick, 'The Limits of Expression on Facebook and Social Network Sites: The UK Experience' (2012) 12 Human Rights Law Review 125; and Raynes-Goldie, Aliases, Creeping and Wall Cleaning: Understanding Privacy in the Age of Facebook' (2010) 15 First Monday, available at: www.vic.edu/htbin/cgiwrap/ojs/index.php/fm/articIe/view2775/2432 [last accessed 10 October 2013]

73 See Delfi v Estonia Application No 64569/09, Merits, 10 October 2013, no violation of Article 10 ECHR where an Internet news portal that published up to three hundred and thirty news articles in a day had been held liable for offensive comments that were posted by readers

have greater privacy protection than contemporary aspects. Achieving a balance between privacy and censorship that is credible, sensible and practicable requires sophisticated and creative lawyering.74,75

below one of its online articles. The ECtHR held that the finding of liability by the Estonian §

courts was a justified and proportionate restriction on the portal's right to freedom of expres- p

sion, in particular because the comments were highly offensive; the portal failed to prevent l

them from becoming public and profited from their existence, but allow their authors to §§

remain anonymous; and the fine imposed by the Estonian courts was not excessive. On the 0

issue of lawfulness of the interference, the portal had argued that an EU Directive on 4

Electronic Commerce, as transposed into Estonian law, had made it exempt from liability. However, the ECtHR found that it was for national courts to resolve issues of interpretation of domestic law and, therefore, did not address the issue under EU law. This is a very significant ruling on the assumption that the same approach would be followed to the interpretation by national courts of a future EU Regulation on General Data Protection and encompassing the right to forget.

74 For the ECtHR's creative contribution, see 'New Technologies, Factsheet, October 2013, available at: www.echr.coe.int/Documents/FS.New.technologies.ENG.pdf [last accessed 14 October 2013].

75 On rethinking the international legal regulation of data, see Fleurs, 'The Deluge' (2013) 1 London Review of International Law 9.