Transatlantic Data Transfers: US-EU Privacy Shield under review

When personal data travels between Europe and America, it must cross international borders lawfully. If certain conditions are met, companies can rely on the US-EU Privacy Shield, which functions as a sort of “tourist visa” for data. 

Earlier this week (19 November) the United States Federal Trade Commission finalised settlements with four companies that the agency accused of falsely claiming to be certified under the US-EU Privacy Shield framework. This news closely follows the highly anticipated second annual joint review of the controversial data transfer mechanism. 

IDmission LLC, mResource LLC, SmartStart Employment Screening Inc., and VenPath Inc. were slapped on the wrist by the FTC over allegations that they misrepresented their certification. But this is just the latest saga in an on-going debate regarding the Privacy Shield’s fitness for purpose. Only this summer, the European Parliament urged the European Commission to suspend the Privacy Shield programme over security and privacy concerns.

flying airplane

Background and purpose

Designed by the United States Department of Commerce and the European Commission, the Privacy Shield is one of several mechanisms in which personal data can be sent and shared between entities in the EU and the United States. The Privacy Shield framework thereby protects the fundamental digital rights of individuals who are in European Union, whilst encouraging transatlantic commerce.

This is particularly important given that the United States has no single, comprehensive law regulating the collection, use and security of personal data. Rather, the US uses a patchwork system of federal and state laws, together with industry best practice. At present, the United States as a collective jurisdiction fails to meet the data protection requirements established by EU lawmakers.

As such, should a corporate entity or organisations wish to receive European personal data, it must bring itself in line with EU regulatory standards, known as being “protected under” the Privacy Shield. To qualify, companies must self-certify annually that they meet the requirements set out by EU law. This includes taking measures such as displaying privacy policy on their website, replying promptly to any complaints, providing transparency about how personal data is used, and ensuring stronger protection of personal data.

Today, more than 3,000 American organisations are authorised to receive European data, including Facebook, Google, Microsoft, Twitter, Amazon, Boeing, and Starbucks. A full list of Privacy Shield participants can be found on the website.

Complaints and non-compliance?

There is no non-compliance. We are fully compliant. As we’ve told the Europeans, we really don’t want to discuss this any further.

—Gordon Sondland, American ambassador to the EU

Although the Privacy Shield imposes stronger obligations than its ancestor, the now-obsolete “Safe Harbor,” European lawmakers have argued that “the arrangement does not provide the adequate level of protection required by Union data protection law and the EU Charter as interpreted by the European Court of Justice.”

In its motion to reconsider the adequacy of the Privacy Shield, the EU Parliament stated that “unless the US is fully compliant by 1 September 2018” the EU Commission would be called upon to “suspend the Privacy Shield until the US authorities comply with its terms.” The American ambassador to the EU, Gordon Sondland, responded to the criticisms, explaining: “There is no non-compliance. We are fully compliant. As we’ve told the Europeans, we really don’t want to discuss this any further.”

Věra Jourová, a Czech politician and lawyer who serves as the European Commissioner for Justice, Consumers and Gender Equality, expressed a different view: “We have a list of things which needs to be done on the American side” regarding the upcoming review of the international data transfer deal. “And when we see them done, we can say we can continue.”

Photo: Ambassador Sondland with Commissioner Jourova in the Berlaymont.
Jourová and Sondland, via a tweet from Sondland saying he was “looking forward to our close cooperation on privacy and consumer rights issues that are important to citizens on both sides of the Atlantic.” 

The list from the Parliament and the First Annual Joint Review [WP29/255] (.pdf) concerns institutional, commercial, and national security aspects of data privacy, including:

  • American surveillance powers and use of personal data for national security purposes and mass surveillance. In particular, the EU is unhappy with America’s re-authorisation of section 702 of the Foreign Intelligence Surveillance Act (FISA), which authorises government collection of foreign intelligence from non-Americans located outside the United States (Remember Edward Snowden and PRISM? See the Electronic Fronteir Foundation’s explanation here)
  • Lack of auditing or other forms of effective regulatory oversight to ensure whether certified companies actually comply with the Privacy Shield provisions
  • Lack of guidance and information made available for companies
  • Facebook and the Cambridge Analytica scandal, given that 2.7 million EU citizens were among those whose data was improperly used. The EU Parliament stated it is “seriously concerned about the change in the terms of service” for Facebook
  • Persisting weaknesses regarding the respect of fundamental rights of European data subjects, including lack of effective remedies in US law for EU citizens whose personal data is transferred to the United States
  • The Clarifying Overseas Use of Data (“CLOUD”) Act signed into law in March 2018 allows US law enforcement authorities to compel production of communications data, even if they are stored outside the United States
  • Uncertain outcomes regarding pending litigation currently before European courts, including Schrems II and La Quadrature du Net and Others v Commission.


Image result for max schrems
Max Schrems is an Austrian lawyer and privacy activist. In 2011 (at the age of 25) while studying abroad at Santa Clara University in Silicon Valley, Schrems decided to write his term paper on Facebook’s lack of awareness of European privacy law. His activism led to the replacement of the Safe Harbor system by the Privacy Shield.

What happens if the Privacy Shield is suspended?

In a joint press release last month, the representatives from the EU and USA together reaffirmed “the need for strong privacy enforcement to protect our citizens and ensure trust in the digital economy.” But that may be easier said than done.

In the event that the Privacy Shield is suspended, entities transferring European personal data to the United States will need to consider implementing alternative compliant transfer mechanisms, which could include the use of Binding Corporate Rules, Model Clauses, or establishing European subsidiaries. To ensure that the American data importer implements an efficient and compliant arrangement, such alternatives would need to be assessed on a case-by-case basis involving careful review of data flows, and the controller and processors involved.

Regardless of the method used to transfer data, American companies must ensure that they receive, store, or otherwise use European personal data only where lawfully permitted to do so. The joint statement noted above concluded by saying that the “U.S. and EU officials will continue to work closely together to ensure the framework functions as intended, including on commercial and national-security related matters.”

The European Commission is currently analysing information gathered from its American counterparts, and will publish its conclusions in a report before the end of the year.

Brexit: Questions and Concerns

Part Two

I’ve attempted to set out the very basics of Brexit in a (currently) three-part guide designed for those who may not be aware of some of the history and context.  In Part One of my series, I set out the basics of what the EU is, and why the United Kingdom is set to leave. This Part Two explores some (but not all!) of the main issues and concerns that have complicated or otherwise stalled the negotiations. Part Three will explain why I think Americans should care about Brexit.

There are many issues that have complicated or otherwise stalled the negotiations. Just some of the big concerns and questions are set out below.


The border between Northern Ireland
and the Republic of Ireland.

Despite sharing the island of Ireland, Northern Ireland is part of the United Kingdom, whereas the Republic of Ireland has been an independent country since 1937.

As a relative newcomer to the UK, I didn’t grow up learning about – of being impacted by – the Northern Ireland conflict. Also known as “The Troubles,” the violence over the constitutional status of Northern Ireland spanned thirty years (1968 – 1998). But despite not knowing all of the details myself, I know enough to appreciate that the open border that was negotiated as part of the Good Friday Agreement (GFA) is really important.

As I explained in Part One of my Brexit series, the are no physical borders between EU countries. But the reason there is an open (soft) border between Northern Ireland and the Republic of Ireland isn’t just because of EU rules: it’s been open since 1998 because that’s what was agreed in ending decades of violence in Ireland.

Image result for irish border brexit
The Republic of Ireland is shown in yellow, as is mainland Europe. These countries are in the European Union. The United Kingdom, which comprises Northern Ireland, Scotland, Wales and England, is shown in light blue.

Brexit will effectively make the border between the Republic and Northern Ireland an “external EU border.” What complicates things is that the Irish government, the UK government, and EU representatives have all stated that they do not wish for a hard border, due to its sensitive nature. To avoid major chaos ahead of the March withdrawal, The EU proposed a “backstop agreement” that would put Northern Ireland under a bespoke range of EU rules in order to avoid the need for border checks.

But this backstop has been opposed by the British government as it would essentially mean different rules apply to different parts of the United Kingdom. This has reignited the question of allowing Northern Ireland to leave the United Kingdom to reunite with the Republic of Ireland.

Northern Ireland as a whole voted 56% in favor of remaining in the EU. Recent polling suggests that 52% of voters in Northern Ireland said they would support a united Ireland outside Britain if it leaves the EU.


Scottish Independence

It is not only Northern Ireland which poses a serious long-term threat to the UK’s territorial and constitutional unity because of Brexit. Scotland – which unified with England in 1707 after centuries of warfare between the two countries – is also toying with the idea of leaving the UK.

Scotland was the jurisdiction most in favor of remaining within the EU, with 62% voting remain. However, it’s important to remember that only two years earlier, Scotland had a “leave or remain?” referendum of its own – but in respect to the United Kingdom. In 2014, 45% of Scots voted to leave the United Kingdom, while 55% wanted to remain. But now that the United Kingdom is leaving the European Union, some argue that Scotland must go its own way and become an independent country that could – at some point – rejoin the European Union on its own.

Image result for scotland independence
The Flag of Scotland – called Saint Andrew’s Cross – has a blue background with a white diagonal cross. Here, the symbol of the EU – twelve gold stars – have been added to some of the flags as a symbol of Scottish-EU solidarity.

Financial Services

Financial services are a key industry in the United Kingdom, and the degree of inter-linkage between London and the EU economies is both economically substantial and intricate in terms of the legislative interface. The “passporting” system allow banks and finance companies to sell their services across the 28-member bloc with a local license, rather than getting a new license to operate in each member country where it does business. Put simply, banks established the UK can buy, sell and trade financial products across the EU with relative ease.

But Theresa May has already ruled out passporting after Brexit. Some of the world’s biggest banks have begun moving jobs out of London, and many question London’s future as a global financial center. Michel Barnier, the EU’s chief Brexit negotiator, has explained that Theresa May’s proposals for a new financial services regulatory framework “would violate the principle that access rights to the bloc’s financial services market are a gift from Brussels that can be freely withdrawn.”


Commodities and Critical Supplies from the Continent

If Brexit ends up creating regulatory and tariff barriers between the UK and the EU, customs checks and delays could severely hamper the import and export of commodities and critical supplies. Increased tariff and trade complications could disrupt supply chains and drive up operating costs, and the devaluation of the pound leads to higher prices.

Image result for dover brexit queue
Dover is the nearest English port to France, at just 34 kilometres (21 mi) away. Port chiefs said a two-minute delay at Dover would lead to 17-mile tailbacks.

The UK imports 30% of its food from the EU, most of which is fruit, veg, and meat.  Likewise, as explained by The Guardian, many of the pharmaceutical factories that supply the UK are elsewhere in Europe. Getting medicines to pharmacies and hospitals is a complex process, and if European supply chains are disrupted, there could be shortages.  Ministers have therefore drawn up plans to send in the Army to deliver food, medicines and fuel in the event of shortages if Britain crashes out of the EU without a deal.


Expats and the End to Freedom of Movement

For both non-UK Europeans living in the UK and UK citizens living elsewhere in Europe, Brexit means uncertainty about residence, pensions, healthcare, and much more. Will these expats need to apply for visas or citizenship? If so, by when? While the EU has published a guide “to help EU citizens make their own decisions about their current situation in the UK in light of Brexit,” many questions still remain.

Currently, 3 million EU citizens live in the UK and 1 million Brits live in other EU countries. These expats stand to lose all automatic rights and protections overnight, which is a deeply upsetting prospect for many. For example, British expats enjoying their retirement on the Continent could stop receiving UK private pension and insurance payments as UK providers lose the authority to transact within the EU. There is also no official word on the process that EU citizens will need to go through here in the UK, to secure or even apply for permanent residency.


The National Health Service

The National Health Service is revered as a national treasure. Much like a child in a custody battle between divorcing parents, the NHS has been used by both sides of the Brexit debate.

On the side of leaving the EU, Vote Leave claimed that the UK sends £350m ($460m) each week to the EU. Online and at other Vote Leave events, the slogan explicitly read “Let’s give our NHS the £350 million the EU takes every week.”

Related image
Vote Leave’s now-infamous “Brexit Bus” which was championed by former Mayor of London/Foreign Secretary Boris Johnson.


Those who support(ed) remaining in the EU pointed to the fact that the NHS relies on EU staff. Although a majority of NHS staff in England are British, a substantial minority are not. Around 63,000 out of 1.2 million staff are from elsewhere in the EU, with the most represented nationalities being Irish, Polish, and Portuguese.

Related image


Elisabetta Zanon, director of the NHS European Office, has laid several other key potential Brexit implications for the NHS over at Kings College London’s UK and EU website. One that stuck out to me in particular is that UK health organisations are one of the largest beneficiaries of EU health research funds in Europe, with €760 million ($875 million) in EU funding having supported research in the UK between 2007 and 2013. The NHS has benefited from this funding, as well as from EU collaboration in clinical research more generally. What is the scope for continued European investment for medical research?


Screenshot 2018-10-17 at 9.47.34 PM
Jaguar F Type convertible 😍  Photo by Alex Howe

Manufacturing and Motorsport

Petrol heads around the world know that the Britain is famous for its premium and sports car heritage, and is home to Aston Martin, Bentley, Daimler, Jaguar, Land Rover, Lotus, McLaren, MG, Mini, and Rolls-Royce… to name a few.

But might the auto industry go “extinct” because of Brexit? Land Rover recently announced plans to move some production to Slovakia and Honda has admitted a no-deal Brexit would cost millions of pounds. Additionally, EU regulations require that at least 55% of automotive parts must come from within the EU, which could mean suppliers in the UK are abandoned.


Stranded on an Island

When the UK leaves the EU, it will also leave the single aviation market, which is the regulatory basis for flights in and out of the country at the moment. This impacts not just flights to the EU itself, but to other countries with which the EU has a deal, including the United States. Accordingly, planes leaving the UK could be prevented from using Irish airspace, as the UK’s post-Brexit default trade status under the World Trade Organization does not include commercial travel rules.

Heathrow airport has raised nearly £1 billion ($1.3 billion) in debt to keep it going through a “worst-case scenario” following a hard Brexit. The operator the airport itself has also announced it will move its international HQ from the UK to Amsterdam as a result of Britain leaving the EU. Although a spokesman for British Airway’s parent company stated “we are confident that a comprehensive air transport agreement between the EU and UK will be reached,” Ireland-based RyanAir “believes that the risk of a hard (no-deal) Brexit is being underestimated.” Speaking of airports, there are also growing concerns about those infamous passport queues at Heathrow getting even worse.

Related image
Currently, UK and EU passport holders go through the same expedited passport queue. This will change after Brexit.

Politics and Personalities

Of course, in addition to policy debates, there are also political clashes that may stall or otherwise derail Brexit. These include infighting amongst different factions of the Prime Minister’s Conservative Party, which may threaten Theresa May’s continued leadership.

In a long-read profile of the Prime Minister for the New Yorker, it was posited that Theresa May faces an impossible situation, with populist demands on one side, practical realities on the other and no way to truly reconcile both. “May’s best hope has been to contain the damage on all sides.”

Unfortunately, the British government remains almost exclusively focused on Brexit. “The country — as an administrative entity — has virtually stopped working,” explained Businessweek.

There are also substantial questions about the legitimacy of the referendum itself. The vote was not legally binding, and potential Russian interference with the Vote Leave campaign has also come to light. People’s Vote, a campaign group calling for a public vote on the final Brexit deal, is also gaining in popularity.

For now though, Brexit does appear to be plowing forward, if a bit unsteadily. But it would be unwise to forget that considerable challenges – only a few of which have been mentioned above – still lie ahead.


Coming soon: Why Should Americans Care About Brexit? 



Brexit: An Introduction for Americans

Part One

I’ve attempted to set out the very basics of Brexit in a (currently) three-part guide, made for those who may not be aware of some of the history and context. In particular, this has been written with Americans in mind. Why? Because as a UK resident, I know Brexit will impact me. But as an American myself, I think Americans should know (and hopefully care) about Brexit, too. 

In Part Two of my series, I set out some of the main issues and concerns that have complicated or otherwise stalled the negotiations. Part Three will explain why I think Americans should care about Brexit.



What is the European Union?

What we now call the European Union was first a coal and steel partnership between France, Germany, Italy, Belgium, the Netherlands, and Luxembourg after World War Two. The philosophical foundation centered on the idea that trade and economic interdependence lessens the risk of armed conflict.

What began as a purely economic trading bloc has  developed into a unique economic and political partnership involving 28 European countries. Importantly, countries of the European Union (known as Member States) benefit from access to the Single Market, which allows goods, services, labor (workers) and capital to move freely between countries without tariffs or borders.


So, is the European Union like America, and the member countries are like “States” ?

On the surface, perhaps. You can travel across national borders in the same way you can travel across state lines. Likewise, thanks to the single market, commodities and services can flow between countries, without being subject to tariffs or other trade frictions. Within the 19 countries of the Eurozone, you can even use the same currency. But remember: the EU is a political system, not a country.

As a political science student in university, I had Max Weber’s definition of a nation state drummed into my head: “a human community that (successfully) claims the monopoly on the legitimate use of force within a certain geographical territory.” The EU does not have the power of coercion through police and security forces: this power still belongs to the individual member states. The EU relies on member states to enforce laws and policies, and discretion is permitted in certain areas, including national security.

Screenshot 2018-10-12 at 6.37.18 PM
This map (via BBC) shows the current Member States, and their date of joining the EU. Croatia joined most recently, in 2013.


What are the branches of EU government,
and who is in charge?

The EU doesn’t have a President or Prime Minister in the traditional sense. Rather, four institutions work together to run the EU and handle policies ranging from agriculture, environment, health, trade, foreign relations, security, justice and migration.

  • European Council – represents the governments of the individual member countries. The Council sets the EU’s overall political direction, but has no powers to pass laws. The President of the Council is currently Donald Tusk. He is the principal representative of the EU on the world stage.
  • The Commission – also known as the “guardian of the treaties,” the Commission promotes the interests of the EU as a whole.
  • Parliament – represents the EU’s 510 citizens and is directly elected by them.
  • European Court of Justice – the ECJ is the supreme court of the European Union in matters of European Union law. It is composed of one judge per member state – currently 28 – although it normally hears cases in panels of three, five or 15

Although there is no “Capital of Europe,” Brussels in Belgium is home to three of the four key institutions (the ECJ is based in Luxembourg) and is somewhat of an “informal” capital.


Why is the United Kingdom leaving the EU?

A referendum was held on Thursday 23 June, 2016, to decide whether the UK should leave or remain in the European Union. Leave won by 51.9% to Remain’s 48.1% (see a detailed breakdown of the results here). More than 30 million people voted, representing nearly 72% of eligible voters and 46% of the UK population.

To put this figure in perspective, In the United States, roughly 55% of eligible voters and 42% of the population voted in the 2016 Presidential elections.

Was the Brexit referendum question flawed in its design?

Some have lamented the fact that EU citizens living the UK were excluded from voting, as were 16 and 17 year olds. Also worth noting is that England and Wales voted in favor of Brexit, whereas Scotland and Northern Ireland backed staying in the EU. This has led to further questions on democratic legitimacy and the possibility of the Union breaking apart, as discussed below.


Whose idea was this?

The United Kingdom, generally speaking, has had a love-hate relationship with the ideas of a “united Europe” and an “ever closer union” for decades. However, relations have deteriorated considerably over the last ten years. The 2008 global financial crisis, the subsequent Eurozone crisis, an influx of immigrants and refugees, terrorism, and social malaise brought concerns about the relative merits of EU membership into the mainstream political debate.

Related image
Nigel Farage

Perhaps no other political movement was as vocal about the UK leaving the EU than The UK Independence Party, a right-wing Eurosceptic populist party. Colloquially known as UKIP (“you-kip”), the party was led at the time by Nigel Farage – whom you may have seen campaigning next to Donald Trump or appearing on Fox News as a commentator.

To quell infighting within his Conservative Party, and to satisfy voters contemplating leaving the Conservative Party for UKIP over the EU question, Prime Minister David Cameron decided to hold the referendum. He supported the UK remaining in the EU, and although he didn’t have to, he resigned the morning of the referendum announcement.

Interestingly, despite campaigning for Remain and stating that “the UK has made a mistake in leaving the European Union,” Cameron insists that “calling a referendum was the right thing to do.

Related image
David Cameron resigned as Prime Minister when the referendum results were announced. Although Cameron campaigned to remain within the EU, “the British people made a different decision to take a different path. As such I think the country requires fresh leadership to take it in this direction.”

After the Referendum Vote,
was the UK declared free from EU rule?

Put simply, no. In order to leave the EU, there are a few legal procedures that must be followed (including the triggering of Article 50, addressed below). Furthermore, when the UK leaves the EU, it will also leave the framework of rules and regulations that govern an incredibly wide spectrum of policy areas. The UK still needs to figure out what sort of relationship it wants to have with its neighbors.

Practically speaking, it really is like a divorce. If normally can’t just sign the paperwork one day and be done with the other spouse forever. You need time to discuss what happens with your house, cars, and other assets, as well as your liabilities like the mortgage, credit card debt and little Henry’s school tuition. You also need to decide what your future relationship will look like.


Why is there a deadline of March 2019?

After the Referendum Vote and Cameron’s resignation, fellow Conservative Party politician Theresa May became Prime Minister.  In March 2017 – nine months (and quite a few legal battles) after the vote – her government “triggered Article 50” of the Treaty of Lisbon. Although Article 50 is only five paragraphs long, this now-famous provision sets out (inter alia) that:

  1. any EU country may decide to quit the EU;
  2. the exiting country must negotiate its withdrawal with the EU;
  3. there are two years to reach an agreement (unless everyone agrees to extend it) and;
  4. the exiting country cannot take part in EU internal discussions about its departure.

The date of 29 March 2019 is therefore important, because it marks two years from the date of the UK’s invoking of Article 50 – the deadline mentioned at paragraph 3.

Related image
What’s behind the smiles? Brexit Secretary Dominic Raab (left) shakes hands with Michel Barnier, a French politician serving as the EU’s Chief Negotiator for Brexit.

So what’s happening now?

This is certainly a busy time for politicians, lawyers, lobbyists and concerned citizens. Negotiations about future relations between the UK and the EU are taking place now, in an attempt to reach an agreement as soon as possible.

In July 2018, Theresa May unveiled her cabinet’s official view of a proposed Brexit deal – known as the Chequers Plan. But European Council President Donald Tusk rejected the Chequers plan at an EU summit in Salzburg last month, leading to increased speculation that the UK could leave the EU without a deal.

Meanwhile, calls to hold a “People’s Vote” to allow the British people to have a “final say on Brexit” are gaining momentum. More than 100,000 people are estimated to attend the biggest Brexit protest to date on Saturday, 20 October.

Speaking at a press conference yesterday (16 October), Tusk admitted that he has “no grounds for optimism before tomorrow’s European Council on Brexit. As I see it,” he continued, “the only source of hope for a deal for now is the goodwill and determination on both sides.”

Up Next: Are we there yet? The key questions and concerns complicating the Brexit negotiations


Related image
…. hmmm, not quite ….

Airbrushing history? Photos of Oxford Student Celebrations Raise Questions About Privacy Rights and Journalism

Airbrushing history? Photos of Oxford Student Celebrations Raise Questions About Privacy Rights and Journalism

A former Oxford University student asked image agency Alamy to remove photographs of her celebrating the end of exams. Now, the photographer accuses Alamy of “censoring the news”.  Is this a threat to freedom of the press, or has the woman’s human right of privacy been correctly protected?

The end of exams are a liberating and happy time for university students around the world. At Oxford, students take their celebrations to another level by partying en masse in the streets, covering each other in champagne, shaving foam, confetti, flour and silly string in a tradition known as “Trashing.”

Screenshot 2018-10-14 at 9.37.21 AM
An Alamy photo of Oxford celebrations from 1968. “Trashing” has become a bit more crazy since the 1990’s.

Speaking to the Press Gazette, Photographer Greg Blatchford explained that during the 2014 Trashing, a student invited him to take photographs of her celebrating on the public streets. Some of the images show her swigging from a bottle of champagne, while in others she is covered in silly string.

Blatchford then sent “about 20” images to Alamy as news content. The former student subsequently stated that she “loved” the images in email correspondence to Blatchford, and even shared them on Facebook. This summer, four years later, the woman contacted Alamy to have the photos deleted. The company removed the images – much to Blatchford’s dismay.

Screenshot 2018-10-14 at 9.37.58 AM
An Alamy stock image of Oxford University Trashing celebrations. Note: THIS IS NOT ONE OF THE SUBJECT PHOTOGRAPHS.

The right to be forgotten under the GDPR

Because the woman was able to be identified from the photographs, they constitute “personal data” as defined by Article 4 of the General Data Protection Regulation (GDPR). Under Article 17 GDPR, data subjects have the right in certain circumstances to compel the erasure of personal data concerning him or her.

For example, if the data was originally collected or used because the individual gave their consent, and that consent is subsequently withdrawn, the company may honour the request for deletion (Article 17(1)(b)). However, a company can also use a “counter attack” if an exception applies. Importantly for news and media agencies, if keeping the data is necessary for exercising the right of freedom of expression and information, they may be able to refuse the request and keep the data (Article 17(3)(a)).

For more details on how the right to be forgotten works in practice, see my earlier post, Now You’re Just Somebody That I Used to Know.

Are journalists under threat from privacy lawyers?

Blatchford explained that although they are now considered “stock images,” they were originally “news” photos and should not have been removed. By deleting the photos, Alamy “are censoring the news. I’m incensed that someone can influence news journalism and censor the past where clearly if photographs are taken in public, with the full consent of participants they can turn around and say ‘sorry, that’s not news’ later. This sets a precedent for anybody to walk up to a news organisation and say I don’t like the pictures of me. Journalists will then start feeling the threat of lawyers.”

In a statement to the Press Gazette, Alamy’s director of community Alan Capel said the images were submitted as news four years ago, but moved 48 hours later to the stock collection. “Therefore we are surprised that this is deemed to be ‘censoring the news.’ As per our contract with our contributors, we can remove any images from our collection if we see a valid reason to do so.”

The university said that participating in trashing can lead to fines and disciplinary action since it is against the university’s code of conduct
The comical images of students wearing sub fusc (formal academic attire) while partying are often published in newspapers around the country in May.

Privacy and press freedom have long been considered competing interests, but that’s not to say that striking an appropriate balance between the two is impossible.

On some level, I do sympathise with the photographer. I also struggle to buy Alamy’s argument that the images are not “news content” and are now “stock images.” The classification of an image should be based on its context, purpose and subject matter – not the time that has elapsed since the event, nor the label attributed to it on a website.

Stock images are, by definition, professional photographs of common places, landmarks, nature, events or people. By contrast, the Oxford Trashing photos are attributed to a specific time (May), place (Oxford), category of people (students), and event (celebrating the end of exams). They are popular for several reasons. Firstly, they illustrate a charming and comical juxtaposition. Although these students attend one of the oldest and most prestigious Universities in the world, they are – after all – entitled to a bit of fun. Secondly, Trashing has received increased press attention in recent years, as students have become subject to complaints fines, disciplinary action, and even police enforcement. These images clearly show, in ways that words alone cannot, matters of public interest.

Screenshot 2018-10-14 at 1.04.41 PM.png

In this particular instance however, I think Alamy have made the right decision in deleting the images.

Although the Press Gazette does not name the woman, it does note she is “a marketing director in New York.” It’s entirely plausible that she has valid concerns that the images of her participating in Trashing may negatively impact her reputation and career, or otherwise cause some sort of harm or embarrassment.

She claims that “there was no consent given to publish or sell my photos anywhere. I am not a model nor have given permission to any photographers to take photos of me to publicly display or to sell. This was a complete breach of privacy.” This contradicts what the email records show, but even if she had lawfully consented to the photographs being taken at the time, she is entirely within her rights to now withdraw consent. 

On balance, Alamy probably has dozens – if not hundreds – of images from the 2014 Trashing at Oxford. The likelihood that the images of this woman in particular are somehow especially newsworthy is minimal. Had Alamy refused to delete the photos, the woman would have been entitled to raise a complaint with the Information Commissioner’s Office. ICO enforcement action can include injunctions, sanctions, or monetary fines. Furthermore, Alamy would risk becoming known as an organisation that doesn’t care about privacy laws, thereby damaging its reputation.

Contrary to Blatchford’s concerns, it is doubtful that an organisation would delete a genuinely newsworthy image, simply because someone doesn’t like how they look. The right to be forgotten is not an absolute right to be purged from history, but a right to regain control of how information about you appears online.

For more details on how the right to be forgotten works in practice, see my earlier post, Now You’re Just Somebody That I Used to Know. If you’re interested in how celebrities control images of themselves, see Fame and Fortune: How do Celebrities Protect Their Image?

Header image by Alex Krook via Flickr