The Right to Be Forgotten: The General Report—Congress of the International Society of Comparative Law, Fukuoka, July 2018

The questionnaire is an annex to the present report.

Case C-131/12, Google Spain SL Google Inc. v Agencia Española de Protección de Datos (AEPD) Mario Costeja González [2014] ECR I-000, at pt. 35 ff, 80 ff, 86 [Hereinafter Google Spain].

A quick look into the bibliography of the national reports will give an idea of the wealth of the research work of their authors and of what is missing in the present report.

We did not receive a United States report, but we analyzed various contributions published in this country. For a recent analysis of the right to be forgotten in the United States’ jurisprudence, see Gajda (2018), p. 201, which interestingly and somewhat unexpectedly claims that the right to be forgotten finds some acceptance in the United States, at least to a larger extent than what has been traditionally acknowledged. See also Post (2018), pp. 1059–61.

See, e.g., Convention for the Protection of Human Rights and Fundamental Freedoms, art. 8, Nov. 4, 1950, 213 U.N.T.S. 222 [hereinafter Eur. Conv. on H.R.]; Wildemeersch, Belgium Report, p. 3; Kühling, Germany Report, p. 2; D’Antonio, Pollicino, Italy Report, p. 1–2; Șandru, Romania Report, p. 11.

Jacques, UK Report.

Heyman (2008), pp. 7–22.

McLean (2004).

Whitman (2004), p. 1180.

See for example, Brüggemeier et al. (2010), p. 31.

On the effect of fundamental rights in private relations, see Clapham (2006). See also Alston (2005), p. 2. For a recent Swiss perspective, see Müller (2018).

See Werro (2009), pp. 285, 291, 299.

E.g., Griswold v. Connecticut, 381 U.S. 479, 484–85 (1965) (discussing constitutionally-derived “zones of privacy”); Mapp v. Ohio, 367 U.S. 643, 656 (1961) (holding that the Fourth Amendment creates a “right to privacy”). Note, though, that the right to privacy is found in the Constitutions of ten states: Alaska, Arizona, California, Florida, Hawaii, Illinois, Louisiana, Montana, South Carolina, Washington. National Conf. of State Legislatures, Privacy Protections in State Constitutions (May 5, 2017), http://​www.​ncsl.​org/​research/​telecommunicatio​ns-and-information-technology/​privacy-protections-in-state-constitutions.​aspx.

See Werro (2009), pp. 296, 300.

Warren and Brandeis (1890), pp. 193–220.

For a discussion of the convergence of EU and US privacy regulations, and more specifically the recent California Consumer Protection Act (CCPA, June 2019), see Büyüksagis (2019).

For a detailed account, see Page (2010), p. 38.

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21.

In relevant part, Article 8 of the European Convention on Human Rights provides that “Everyone has the right to respect for his private and family life, his home and his correspondence.” 213 U.N.T.S 221.

Seevon Hannover v. Germany (59320/00), [2004] E.M.L.R. 21at ¶ ¶18–42.

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 at ¶ 50 (citations omitted).

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 at ¶ 50 (citations omitted).

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 at ¶ 50 (citations omitted).

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 at ¶ 58.

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 at ¶ 65 (citation omitted).

For a further discussion of these positive duties from a Swiss law perspective, see Müller (2018).

The von Hannover case was deliberately styled as a grievance against the Federal Republic of Germany. Per Articles 32, 34 of the Convention, individual applicants may only petition the European Court of Human Rights for grievances they claim to have suffered at the hands of a Party to the Convention (i.e. States). Applicants to the European Court of Human Rights may not style their claims in the form of private grievances against another individual. See Eur. Conv. on H.R., 213 U.N.T.S 221, art. 34. Thus, although the Hannover case was presented as a claim against the Federal Republic of Germany, the decision carries direct implications for private entitlements for all Parties to the European Convention of Human Rights.

Șandru, Romania Report, p. 10.

For a contrary view as to the divisibility of the right to be forgotten, see Post (2018), pp. 993–994, who argues that the traditional individual right to be forgotten protecting dignitary privacy is distinguishable from the RTBF, “the distinct bureaucratic version of the right to be forgotten created by the Directive to protect data privacy… .”

Kapanci B, Paksoy S, Turkey Report, p. 2.

443 U.S. 308 (1977).

Werro (2009), p. 295.

Werro (2009), p. 296.

Von Hannover v. Germany (59320/00), [2004] E.M.L.R. 21 ¶ 76.

Gonçalves R, Brazil Report, p. 8.

Alfonsín ML, Argentina Report, p. 3.

Organization of American States, Am. Conv. on Human Rights, Nov. 22, 1969, O.A.S.T.S. No. 36, 1144 U.N.T.S. 123.

Yamaguchi, Japan Report, p. 7.

Yamaguchi, Japan Report, p. 7.

Yamaguchi, Japan Report, p. 8.

Yamaguchi, Japan Report, p. 8.

Chiou, Taiwan Report, p. 5.

Chiou, Taiwan Report, p. 4.

Chiou, Taiwan Report, p. 4.

Chiou, Taiwan Report, p. 4.

Chiou, Taiwan Report, p. 4.

See Gajda (2018), pp. 203–204. Wildemeersch, Belgium Report, pp. 2–3 (“La seconde sous-catégorie du « droit à l’oubli » est une expression du droit à la vie privée…D’abord utilisé dans le cadre de la presse traditionnelle, il connaît de nouveaux développements à l’aire des archives numériques au travers du droit à l’anonymisation.”).

D’Antonio, Pollicino, Italy Report, p. 2.

For Swiss law, see Werro (2009).

See, e.g., ML and WW v. Germany, Nos. 60798/10 and 65599/10 (Eur. Ct. HR. 2018) (upholding German constitutional court’s decision to quash application by two convicted murderers for the anonymization of stories concerning their conviction, finding, under the Axel Springer criteria, that Article 10 rights outweighed Article 8 rights in this case; Satakunnan Markinaporssi Oy and Satamedia Oy v. Finland, Application no. 931/13, (Eur. Ct. HR. Jun. 27, 2017) (upholding Finish court’s decision to enjoin the dissemination of tax information (lawfully received and published) via sms message); Furst-Pfeifer v. Austria, Application nos. 33677/10 and 52340/10 (Eur. Ct. HR May 17, 2017) (upholding 4-3 the Austrian courts’ judgment that Article 8 was not infringed by the publication of truthful medical information about a registered psychological expert for court proceedings in custody and contact-rights-related disputes on public care and child abuse); Axel Springer AG v. Germany, App. No. 39954/08 (Eur. Ct. H.R. Feb. 7, 2012) (striking down 12-5, following the application of a 6-part balancing test, as a violation of Article 10, German courts’ decision to fine and enjoin German media companies from publishing the details of a prominent television actor’s arrest for cocaine possession).

Post (2018), pp. 1058–1059.

Case C-131/12, Google Spain SL v. Agencia Espanola de Proteccion de Datos, 2014 E.C.R. 317.

For more details, see Werro (2009); for suggestions as to how to accommodate the European right to be forgotten in the US environment, see Bennett (2012), p. 161.

Post (2018), pp. 1059–1061.

Post (2018), p. 1010.

The Directive itself mentions the protection of these values. It will not grant the right to erasure that could come into conflict with a public interest. Gratuitous harmful information is not protected. Art. 94 GDPR is a repeal of 95/46/EC.

Case C-131/12, Google Spain SL v. Agencia Espanola de Proteccion de Datos, 2014 E.C.R. 317 pt. 35, 80, 86.

Case C-131/12, Google Spain SL v. Agencia Espanola de Proteccion de Datos, 2014 E.C.R. 317 pt. 17.

For a recent in-depth account on the cultural dimension of privacy, see Legrand (2017), p. 1 (involving a comparison between the work of James Gordley and that of James Whitman). For another fundamental analysis, see also, Mayer-Schönberger (2009), pp. 16–49, analyzing the importance of forgetting.

Consider, for example, that in 1985, the Italian Supreme Court established that the right to a personal identity constituted an interest in ensuring against that identity’s improper altering or prejudice. As the rapporteur explains, in a 2004 case, Italy’s data protection authority ordered the de-indexing of prejudicial search links—years before the Google Spain case. See D’Antonio, Pollicino, Italy Report, p. 2.

According to Post (2018), p. 1060.

Ibid.

See Shulman v. Grp. W. Prods., Inc., 955 P.2d 469, 485 (Cal. 1998); Bollea v. Gawker, 913 F. Supp. 2d 1325 (M.D. Fla. 2012).

See, e.g., ML and WW v. Germany, App. Nos. 60798/10 and 65599/10 (Eur. Ct. HR. 2018); Satakunnan Markinaporssi Oy and Satamedia Oy v. Finland, App. no. 931/13, (Eur. Ct. HR. Jun. 27, 2017); Furst-Pfeifer v. Austria, App. nos. 33677/10 and 52340/10 (Eur. Ct. HR May 17, 2017); Axel Springer AG v. Germany, App. No. 39954/08 (Eur. Ct. H.R. Feb. 7, 2012).

Post (2018), pp. 1058–1059.

See Stein (2010). See also Cohen (2017b), p. 56, who analyzes the unquestioning deference to the political power of money in free speech jurisprudence.

Whitman (2004), pp. 1151, 1171–1188, with interesting insights into the specificities of German and French capitalism.

On constitutionalization, see Brüggemeier et al. (2010), p. 31. See Art. 13 of the Swiss federal constitution, and its express reference to the “respect de la vie privée.”

See, e.g., Werro (2009), pp. 290–291.

Directive 95/46/EC Art. 12, 14.

Wildemeersch, Belgium Report, p. 2. In 1997, Belgium’s Privacy Commission formally recommended the anonymization of personal details in judicial decisions.

Wildemeersch, Belgium Report, p. 11.

Wildemeersch, Belgium Report, p. 11.

Kühling, Germany Report, p. 2.

Note that although we recognize a practical difference between the right to be forgotten and the right to privacy, we do not wish to assert that the right to be forgotten represents a self-substantiating right independent of the right to privacy. We maintain that the right to be forgotten is a derivative of the right to privacy. For a parallel discussion arguing against the recognition of data protection as its own right, see Poscher (2017), p. 129.

Kühling, Germany Report, pp. 1–2.

Directive 95/46/EC.

Kühling, Germany Report, p. 1.

O’Callaghan, Ireland Report, p. 8.

D’Antonio, Pollicino, Italy Report, p. 1.

D’Antonio, Pollicino, Italy Report, p. 1.

D’Antonio, Pollicino, Italy Report, p. 2.

Kapanci B, Paksoy S, Turkey Report, p. 2.

Kapanci B, Paksoy S, Turkey Report, p. 6.

See, e.g., Bhardwaj (Feb. 28, 2018, 12:06 PM), http://​www.​businessinsider.​com/​google-right-to-be-forgotten-law-in-america-2018-2;see generally Gajda (2018), p. 93; Post (2018), p. 67.

Jacques, United Kingdom Report, p. 1.

Jacques, United Kingdom Report, p. 1.

Eltis, Trudel, Canada Report, p. 3.

Eltis, Trudel, Canada Report, p. 4.

Eltis, Trudel, Canada Report, p 4. Note that Oullet c. Pigeon was heard in 1997 — prior to the von Hannover case. But compare with the Court’s reasoning in Axel Springer AG v. Germany, App. No. 39954/08 (Eur. Ct. H.R. Feb. 7, 2012).

De Visser, Singapore Draft Report, p. 6. (on file with the author of the general report).

De Visser, Singapore Draft Report, p. 2.

De Visser, Singapore Draft Report, p. 4.

De Visser, Singapore Draft Report, pp. 5–6.

De Visser, Singapore Draft Report, p. 9.

De Visser, Singapore Draft Report, p. 9.

Whitman (2004), p. 1161 (referencing German literature).

As EU law shows, a right to be forgotten cannot trump the public interest in receiving information that contains historic value. On this question, amongst others, see Vivian Reding, as cited in Post, in footnote 314; for a critique of the way the CJEU handled the question, see Post (2018), p. 1051.

Whitman (2004), pp. 1186, 1210.

See Cohen (2017), pp. 230–231.

See Eltis, Trudel, Canada Report, p 3; see generally Gajda (2018).

Art. 17 GDPR (“ Right to Erasure”).

Cf. Wildemeersch, Belgium Report, p. 2 (“L’article 8 de la Charte des droits fondamentaux de l’Union européenne a même fait du droit à la protection des données à caractère personnel un droit autonome, toute personne ayant, selon l’article 8, paragraphe 2 de la Charte, « le droit d’accéder aux données collectées la concernant et d’en obtenir la rectification »”); D’Antonio, Pollicino, Italy Report, p. 6 (right to contextualize); for a convincing comparison between the European and the American approaches with respect to control over oneself, see Whitman (2004), p. 1161, n. 44, 1169, n. 76, 1182, nn. 127-29.

Wildemeersch, Belgium Report, p. 1.

See Post (2018), p. 985.

Post (2018), p. 985.

Kapanci B, Paksoy S, Turkey Report, p. 1 (“Personal data which are processed in accordance with this law or relevant other laws shall be deleted, destroyed or anonymized either ex officio or upon request” with the right to be forgotten receiving constitutional backing recognized by the Constitutional Court in 2016).

Gonçalves R, Brazil Report, p. 3 (Law No. 12965 of April 23, 2014).

Chiou, Taiwan Report, p 1 (conventional right to request deletion of personal data stated in Personal Information Protection Act at article 11).

See Court of Justice of the European Union, Judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317; Eltis, Trudel, Canada Report, p. 5 (“Par contre, lorsqu’il est démontré que le propos contrevient à une loi ou viole un droit fondamental, les tribunaux canadiens n’ont aucune hésitation à ordonner le déréférencement.”); Motzfeldt, Naesborg-Andersen, Denmark Report, p. 2 (Processing of Personal Data Act of 2000 allowing right to demand in a reduction in searchability); Yamaguchi, Japan Report at 12 (Nov. 6, 2009 Tokyo Dist. Ct. case requiring Google to delist 122 URLs because they infringed on the right to personality of the petitioner).

Alén-Savikko, Finland Report, p. 5.

GDPR, art. 16.

GDPR, art. 17(1).

GDPR, art. 16.

See Wildemeersch, Belgium Report, p. 1, stating that the right to be forgotten “regroupe en réalité plusieurs droits qui reposent sur des fondements législatifs différents.”

G.A. Res. 68/167 at 2 (Dec. 18, 2013).

International Covenant on Civil and Political Rights, art. 17(1), Dec. 16, 1966, 999 U.N.T.S. 171.

See Peters (2017), pp. 145, 149.

See generally Peters (2017), pp. 145, 149.

For a recent critique of consent in the digital environment, see Richards and Hartzog (2019), p. 96.

See also OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data ¶ 10 (“Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 except: a) with the consent of the data subject… .”).

A deeper analysis on the extent to which the ICCPR and similar international instruments have affected conceptions of the right to be forgotten falls beyond the scope of this report, which is styled as a survey of the current status of the right to be forgotten.

Whitman (2004), pp. 1193–1194 makes an interesting point when he remarks that “consumers need more than cheap goods and services, just as they need more than easy credit. They need dignity. If your consumer profile is floating around somewhere in cyberspace, you are not in control of your image… . This sort of thinking has far less resonance in America than it does in Germany and France.” But, of course, this is because we have so much less of the continental sense that “a just world [] is a world in which everybody’s respectability is carefully protected.”

See Hurdík, Czech Republic Report, p 4; the Alén-Savikko, Finland Report, p. 5, explains that individuals may prohibit processing of their personal data “for purposes of direct advertising, distance selling, other direct marketing, market research, opinion polls, public registers or genealogical research,” See also Kühling, Germany Report at 13; Jacques, United Kingdom Report, pp. 7–8.

Kühling, Germany Report, p. 13.

Alfonsín ML, Argentina Report, pp. 1, 4.

See Hern (Apr. 19, 2018, 7:03 AM), https://​www.​theguardian.​com/​technology/​2018/​apr/​19/​facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law?​CMP=​share_​btn_​link.

Bertram et al. (2018), p. 17, available at: https://​www.​elie.​net/​static/​files/​three-years-of-the-right-to-be-forgotten/​three-years-of-the-right-to-be-forgotten-paper.​pdf.

For example: google.​fr, google.es, google.it, etc.

In other words, to include websites such as google.es, google.it, or even the U.S. google.​com.

See Judgment of the Court (Grand Chamber) of 24 September 2019 Google LLC, successor in law to Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) Case C-507/17. At this late stage, the author regrettably cannot address the outcome of this case. The decision was rendered after the manuscript was submitted to the publisher, and the author regrets the outcome of the case, but has no space to fully comment on it further. For a similar view, see Marc Rotenberg, Google’s Position Makes no Sense: Opposing view, at https://​www.​usatoday.​com/​story/​opinion/​2015/​01/​22/​. http://​curia.​europa.​eu/​juris/​document/​document.​jsf;jsessionid=​D3B6FA325F40E190​00A709ED4DF087BB​?​text=​&​docid=​218105&​pageIndex=​0&​doclang=​EN&​mode=​lst&​dir=​&​occ=​first&​part=​1&​cid=​3535949.

Eltis, Trudel, Canada Report, p. 18.

Eltis, Trudel, Canada Report, pp. 18–19.

Eltis, Trudel, Canada Report, p. 19.

Notice and take down is defined as a process operated by online hosts in response to court orders or allegations that content is illegal. Content is removed by the host following notice. Notice and take down is widely operated in relation to copyright infringement, as well as for libel and other illegal content. Under U.S. and European law, this process finds its rules in the Digital Millennium Copyright Act 1998 and the Electronic Commerce Directive 2000.

Marcelo Lopez Alfonsín, Argentina Report, pp. 3–4.

Post (2018), p. 1067. The Canadian rapporteur also expresses some doubt as to allowing private third parties this role, see Eltis, Trudel, Canada Report, p. 11.

Case C-131/12, Google Spain SL v. Agencia Española de Protección de Datos, 2014 EUR-Lex Celex No. 62012CJ0131 (May 13, 2014), Opinion of Advocate General Jääskinen, Celex No. 612CC0131 at ¶ ¶ 133–34 (June 25, 2013).

Case C-398/15 Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni ¶ 24 (March 9, 2017).

For a comparison of the two cases, see Büyüksagis (2019), pp. 28–33.

D’Antonio, Pollicino, Italy Report, p. 11.

[2018] EWHC 799 (QB).

Browning and Sebag (Apr. 13, 2018, 9:49 AM), https://​www.​bloomberg.​com/​news/​articles/​2018-04-13/​google-told-to-remove-links-to-businessman-s-criminal-conviction-jfy0dqv4.

Warren (May 16, 2018), https://​www.​theatlantic.​com/​technology/​archive/​2018/​05/​tiziana-cantone-suicide-right-to-be-forgotten/​559289/​.

See, e.g., Alfonsín ML, Argentina Report, p. 2 (“Internet intermediaries become liable only upon obtaining ‘effective knowledge’ of the illegal content involving the notification by a court or other competent authority… .”); Gonçalves R, Brazil Report, p 8 (discussing Google’s liability in the Xuxa case); Eltis, Trudel, Canada Report, p. 7 (“Selon les six juges majoritaires de la Cour, une personne ne peut en diffamer une autre simplement en publiant un hyperlien menant au site Web ou à un document d’un tiers qui contient des propos diffamatoires… .”); D’Antonio, Pollicino, Italy Report, p 3 (noting differing approaches to intermediaries’ liability prior to the Google Spain decision); Chiou, Taiwan Report, p 4 (“Court decisions that uphold ISP’s obligation to remove contents…are limited situations where the ISP knows that the contents or search results may infringe upon reputations of others or fails to know that as a result of gross negligence.”).

D’Antonio, Pollicino, Italy Report, p. 3.

D’Antonio, Pollicino, Italy Report, p. 3.

Yamaguchi, Japan Report, p. 3.

Yamaguchi, Japan Report, p. 20.

In that respect, liability for damages should be limited.

Rosenberg et al. (March 17, 2018), https://​www.​nytimes.​com/​2018/​03/​17/​us/​politics/​cambridge-analytica-trump-campaign.​html.

McMillan (Mar. 26, 2018, 7:31 PM), https://​www.​wsj.​com/​articles/​facebook-logs-text-call-histories-for-some-android-users-1522072657.

Salinas (Mar. 26, 2018), https://​www.​cnbc.​com/​2018/​03/​26/​ftc-confirms-facebook-data-breach-investigation.​html.

Watson (Apr. 11, 2018 12:00 AM), https://​www.​theguardian.​com/​technology/​2018/​apr/​11/​mark-zuckerbergs-testimony-to-congress-the-key-moments.

Facebook retains a great amount of data about its users that a standard consumer would not expect. That data includes users’ phonebook contacts, a list of users’ removed friends, and even the number of advertisers with users’ personal information. See Chen (Apr. 11, 2018), https://​www.​nytimes.​com/​2018/​04/​11/​technology/​personaltech/​i-downloaded-the-information-that-facebook-has-on-me-yikes.​html?​mtrref=​undefined.