EU Broadens Right To Be Forgotten In Dangerously Vague Ways With New 'Data Protection' Directive
from the bye-bye-free-speech dept
A few months ago, we noted that the EU was working on its new General Data Protection Regulation and Data Protective Directive -- and warned that it was putting free speech and privacy on a crash course. We also had a podcast about this with Daphne Keller, from Stanford's Center for Internet and Society. While the intentions of the data protection efforts sound good, the actual impact could be quite devastating. The idea is that all these companies are collecting lots of data, and individuals should have more control over what's collected and how it's used (and abused). Conceptually, that sounds really valuable. But, in practice it can be a disaster -- especially if the people who are focused on privacy/data protection don't think about or understand the consequences of what they're doing.And now, the EU has announced that the new data protection rules have been finalized -- and while there's plenty in there that may be useful, these new rules are almost certainly going to create some new dangerous consequences. A notable concern is that it reinforces this ridiculous "right to be forgotten" concept, and allows for the "erasure" of information. The theory here is that it's supposed to let you delete old data about you from databases, and you can see why that might make sense. People don't feel comfortable with, say, old credit information hanging around when it's no longer relevant. But, as we know, it's also been interpreted to mean that search engines can be forced to memory hole totally accurate, public information about someone, and that's now created a vast tool for suppressing free speech. But the new rules more or less double down on that right to be forgotten.
There were fairly simple ways in which the EU could have changed the rules to make them not so problematic, but it ignored those suggestions and kept things troublingly vague, which will almost certainly lead to abuse and the suppression of free speech. A big part of the problem is that it's not even clear who really is required to obey these right to be forgotten requests, and that's going to lead to a huge mess:
The GDPR doesn’t tell us whether hosting platforms like Facebook or Twitter are controllers with RTBF erasure obligations. We know that search engines are controllers and thus have RTBF obligations -- that was a key holding in the Google Spain/Costeja case. The GDPR doesn’t tell us what other Internet intermediaries will fall in that category. Realistically, I find it hard to imagine DPAs excusing major social networks from erasure obligations, in the long run. But there will be a lot of arguing first.And, this is a big deal. A key part of the new rules is that failing to abide by them can mean fines up to 4% of global revenue. Notice that it's not just EU revenue, and not profits. That gives the EU tremendous power to force companies to censor the internet globally. I understand that this is being done with good intentions and with privacy in mind, but the potential impact here on basic free speech should be a huge concern.There are some strong arguments against RTBF obligations for hosts – for example, that they cannot be controllers because they only process content at the direction of a user, who is herself the controller. There are also some widely accepted legal arguments that will, if they prevail, lead to more complicated answers. Following one of them, RTBF would apply to hosts that are too “active” in managing user content, but not to “passive” hosts. Following another argument, hosts would have to erase some content, but not nearly as much as the content that search engines must de-index. (Example: Google may have to remove search results pointing to the Facebook page where I posted about my cousin, but Facebook still won’t have to remove the post from its platform.)
And while other rules concerning liability for internet services have some protections against abuse, it's not at all clear if those kinds of protections apply here:
We still don’t know the answer to the €20 million question: Do intermediary liability laws under eCommerce Directive Articles 12-15 apply to RTBF erasure requests? Existing rules under the eCommerce Directive tell Internet companies how to handle removal requests for other legal claims, like defamation. Those rules have real flaws, but they at least build in some protections against legally groundless or abusive attempts to silence online expression. There is no reason to use a whole new process for RTBF claims, so the answer to the question should be yes: eCommerce procedural rules for notice and takedown apply to RTBF erasures. That would mean, among other things, that intermediaries don’t have to take down content until they know the removal request states a valid claim.Again, the intentions here are good, but the actual impact here may be devastating to the internet. I know it's easy to dislike big internet companies (even as people make use of their services, often for free, every day), but attacking them in a way that harms their users and their free speech rights seems like a bad bet -- and one that likely won't help develop a next generation of internet services in Europe.The GDPR’s plain language seems to support this answer, but has a loophole that will fuel argument for years. Both GDPR Recital 17 and Article 2.3 say the GDPR is “without prejudice” to “the liability rules of intermediary service providers in Articles 12 to 15” – the eCommerce rules that govern notice and takedown. The problem is, many data protection experts say that the eCommerce “liability rules” are irrelevant, because the GDPR doesn’t technically hold intermediaries liable for the speech of a third party. Following this argument, the “without prejudice” language has no practical consequence. As long as this question is unresolved, intermediaries can’t be certain whether they can use existing eCommerce removal systems, or whether they must develop new tools to implement the troubling new removal process prescribed by the GDPR. Putting faith in the simpler interpretation of Article 2.3, and assuming it excuses an intermediary from following the specific rules described in the GDPR, is an expensive gamble.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: data protection, eu, gdpr, intermediary liability, privacy, right to be forgotten
Reader Comments
Subscribe: RSS
View by: Time | Thread
*shakes fist*
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
One of the common cultural reason for "rights to be forgotten" is the use of time-limitation on mostly misdemeanors. When a person is seeking employment for a new job, the criminal record is routinely checked by the potential employer. Thus the intention of that removal of information is to help people who did some crap as a youth and that is generally a positive thing.
That is one of the reasons why "right to be forgotten" in at least a very narrow sense has merrit.
Thus the intention is good. The implementation is unbelievably convoluted and frighteningly poor.
I would argue that this is a negative right, associated with a more humanist ideal of people changing for the better. Free speech is one thing. If the speech is problematic for other reasons, it should be possible to give it consequences. That these consequences shouldn't be on the hands of a government is obvious, but who else should administer it and how?
There is an ongoing philosofical debate among journalistic organisations about how to deal with speech. Right now, most are leaning towards some form of moderation, whether by users or admins. The debate easily escalate to become an ongoing Godwin-discussion or threatening without some moderation. Right now the compromise between keeping a discussion on topic and a sewer from the most emotional and extreme users is dealing with it is several packages:
- Obviously illegal speech (personal threats and several other obvious illegal speech is usually deleted and handed over to the local authorities if possible to comply with the local jurisdiction)
- Very trollish and emotional extreme speech (This is the controversial bit. Most use some kind of "user-moderation and admin"-hybrid
- Normal speech (protected, but with some user-moderation.)
While free speech is a very controversial topic, you will have to treat the least problematic and most problematic speech differently. Free speech has to be moderated somewhere, by some standard or in some way. So drop that "free speech is sacred"-puritanism and be specific enough about what you would be comfortable with.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Google, facebook, Sue them for billions
[ link to this | view in chronology ]
Re:
Personally, I'd rather see Google (and Facebook, and the like) just pull all of the European versions of their sites off the Net, and see how well Europe likes that. I doubt we'll see that, but it would be nice.
[ link to this | view in chronology ]
Re: ISDS
[ link to this | view in chronology ]
Should free speech be immortal? If so, why?
If we think back to the days when most of us lived in all towns, villages or settlements, where the neighbors might learn many of our secrets, naughty doings, and private foibles, and might spread the information around (maybe to our detriment) at least the lifetime of the information was finite (as the neighbors died, as memories diminished, as our grandchildren produced our great-grandchildren and so on) eventually our secrets decayed into the silence of the grave. But we are now creating repositories of private information which will never die and which can be used to discriminate against, to persecute, to harass, to be used as gossip, against the previously innocent who entered the world mostly unsullied by whatever was recorded for use against our ancestors. Is this what we want for everyone? Should not our private life die when the persons who know us also enter into history?
[ link to this | view in chronology ]
Re:
So a politician who commits a crime or who goes off on a racist rant, should be able to erase that information from the internet so that when potential voters search for his name, they will find only positive results?
Maybe we should go into the libraries and start tearing pages out of the history books as well? After all, I'm sure some of those people would rather be forgotten...
[ link to this | view in chronology ]
Re: Re:
Suppose you are Hitler's or Stalin's or great-great-great grandchild, born innocent and unformed, do you deserve the opprobium, hilarity or worse wreaked upon you as a decendent of that ancestor? Tarred with the sins of your ancestors? You probably have a horse-thief or pig-thief among your great-great^n ancestors. You're not safe to work in a supermarket as a teen, because obviously your family are sh1ts. Do your penance.
[ link to this | view in chronology ]
Re: Re: Re:
So you are advocating that we erase all historical records older than, say, 100 years?
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re:
Well, if he has decided to no longer be racist why should his past be held against him? Just because he was a racist yesterday doesn't mean that he is today!
Maybe we should go into the libraries and start tearing pages out of the history books as well? After all, I'm sure some of those people would rather be forgotten...
Only the pages that could cause embarrassment or have negative effects. The good things can be left in, of course. Otherwise, people might be concerned about future repercussions when deciding what to do today. We can't have that.
/s
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Enough with the apologizing
Enough with that rubbish. 'Intentions' don't mean squat, what matters is what you do, and in this case the actions are a huge mess, and likely to cause even more problems going forward.
If someone really means well when they do something that causes you significant problems that doesn't mean their actions should be excused, because they still caused problems with their action.
[ link to this | view in chronology ]
This has become so annoying and problematic that I've started avoiding Google.ie and now default to Google.ca
[ link to this | view in chronology ]
Zeal
[ link to this | view in chronology ]
I like it =)
[ link to this | view in chronology ]
No, profits override "the public good" under ISDS.
[ link to this | view in chronology ]
simple, really
There needs to be an explicit opt-in agreement that gives the user the option for the service provider to maintain that data and apply it to purposes outside of the transaction. There need to be criminal repercussions to abuse of that data, and the service provider should not be able to refuse service to anyone unwilling to provide data for purposes other than the immediate transaction.
[ link to this | view in chronology ]
Oh, spare us all...
So, humanity has entered this weird, new paradigm where sensitive information is digitized and agglomerated from everywhere and exists forever as public infotainment. If you happen to fall on the wrong side of that situation, it can have profound implications for your personal or professional life. You can be unemployable. You can be socially ostracized, even though you've done nothing wrong. This is not even withstanding the broader, moral question of whether or not 'society' enjoys some bizarre "Right For Nothing To Ever Blow Over" whereby everything you've ever said or done is etched in digital stone for public infotainment. To the contrary, almost every country enshrines various mechanisms for things to 'eventually go away'. From credit reports to criminal records, even a full blown bankruptcy in federal court drops off your credit record after 7 years. Certain low felonies can be sealed in 2 or 3. Society has no problem dealing with this sort of thing but now that 'the issue' is defined by Google rather than society, we now have another problem.
"BUT MUH FREEDOM OF SPEECH! WHAT ABOUT MUH FREEDOM OF SPEECH!", goes the rally cry. Well, my medical records are not your 'freedom of speech'. My home ownership information is not your 'freedom of speech'. Something you did dumb at the age of 18 that made the newspaper, that is not my "freedom of speech" and while its arguably the newspapers freedom of speech, it doesn't take a great genius to acknowledge what that 'freedom' means in the context of the information age and to question whether or not it should exist as a mark against your name, forever.
Once upon a time, society had no problem demarcating this issue by applying a different defamation standard for public and private figures but again, in the Google era, we're all just infotainment for Google's profit.
"BUT WHAT ABOUT PEDOPHILES! WHAT IF PEDOPHILES WANT TO ERASE WHAT THEY'VE DONE? WON'T YOU THINK OF THE CHILDREN???" ... goes the appeal to emotion but again, has there *ever* in the history of civilization been an issue that was otherwise rational when it had to be defined with hysterics about child molesters? If we acknowledge that particularly heinous crimes with a lot of notoriety may warrant some degree of permanence, does that then trickle down to someone who gets a DUI 9 years ago and serves probation, should be be unemployable because he can't afford to pay a mugshot extortion website that cloaks itself with the same MUH FREEDOM OF SPEECH! rally cry as every shallow ideologue who is too blinded or dumb to take a nuanced look at this issue?
Sorry, Europe absolutely nailed this one, probably needs to go further. Once again, the US will remain the global laughingstock chanting a matra about something-something-FREEDOM!!!, as usual. Imbeciles.
[ link to this | view in chronology ]