Now you’re just somebody that I used to know

Now you’re just somebody that I used to know

The GDPR has been in force for less than two weeks, but Europeans have already started to contact companies left, right and centre to exercise their newly enshrined statutory “right to be forgotten.”

However, this right is not absolute, and only applies in certain circumstances. Let’s look at the balancing act between a data subject’s right to have their data erased on the one hand, and an organisation’s need to maintain data for legitimate purposes, on the other.

Organisations (data controllers and processors) are obliged to only collect and use personal data in a lawful manner, as set out in Article 6. There are several types of “lawful processing,” including in instances where an individual grants his or her explicit and informed consent. But lawful processing also covers the use of data for a controller’s legitimate interests, the performance of a contract, or legal obligations, such as fraud prevention. For more on lawful processing, check out my earlier post – Lights, camera, data protection?

With this in mind, it’s important to note that only in certain scenarios does an individual have the right to be forgotten. Under Article 17(1), their data must be either:

  1. no longer necessary for the original purpose
  2. processed based on consent, which is now withdrawn
  3. processed based on the organisation’s legitimate interests, which the individual objects to;
  4. processed for direct marketing purposes, which the individual objects to;
  5. processed unlawfully (in contravention of Article 6);
    or
  6. erased to comply with a legal obligation.

But before an organisation hits “delete” it must see if any purposes for retention apply. In pre-GDPR days gone by, data subjects had to prove they had the right for their data to be erased. The burden now lies with the controller to prove that they have a legal basis for retaining the data. If so, the organisation has a lawful reason to refuse the erasure request. In fact, deleting data when an exemption does apply could be a breach of the law!

The purposes for retention under Article 17(3) are:

  1. the right of freedom of expression and information;
  2. complying with a legal obligation, or for performing a task in the public interest;
  3. for reasons of public health;
  4. for archiving in the public interest, including scientific or statistical research; or
  5. for the establishment, exercise or defence of legal claims.

Additionally, “manifestly unfounded” or “excessive” requests may be refused outright.

From what I’ve seen in practice over the last few days, most erasure requests are made because an individual no longer wants to receive marketing emails. Fair enough: in shifting responsibility onto corporate controllers, the right to be forgotten strengthens individual control. It also signifies public disapproval of entities which process – and, in some instances abuse – enormous quantities of personal information without the explicit consent or knowledge of the individuals concerned.

For those of us interested in the societal and human rights implications (I’m telling you – data protection isn’t just for the techies amongst us!) it’s worthwhile to consider how journalism fits into the picture.

As Oxford’s International Data Privacy Law summarises rather eloquently: The nebulous boundaries and susceptibility to misuse of the right to be forgotten make it a blunt instrument for data protection with the potential to inhibit free speech and information flow on the Internet.

As early as 2012, Reporters Without Borders (formally, Reporters Sans Frontières) criticized the right to be forgotten – then in early draft stages – as a generalised right that individuals can invoke when digital content no longer suits their needs. This runs the risk of trumping the public interest in the information’s availability. RSF also contends that the demand for complete erasure of online content, or the “right to oblivion”, could place impossible obligations on content editors and hosting companies.

EU Commissioner Viviane Reding responded to the criticism from RSF by explaining that the [GDPR] provides for very broad exemptions to ensure that freedom of expression can be fully taken into account.

Note – this post covers the statutory Right to Erasure under Article 17 of the GDPR. Although related, it is distinguished from the recent high-profile cases against Google, in which the English Supreme Court held that a defendant convicted of a crime was entitled to the right to be forgotten, and therefore delisted from Google search results. A more serious offence, with fewer mitigating circumstances, did not attract the same right.

photo © Cassidy Kelley

Google prepares for the first “Right to Be Forgotten” trials in England

Google prepares for the first “Right to Be Forgotten” trials in England

All human beings have three lives: public, private, and secret.
― Gabriel García Márquez

The European Union’s Court of Justice decision in Google Spain v Agencia Española de Protección de Datos, Mario Costeja González (“Google Spain”) confirmed the “right to be forgotten” for European citizens. This right is further enshrined in the upcoming General Data Protection Regulations (GDPR). Accordingly, European data protection law grants individuals a qualified right to have personal data relating to them removed from search engines.

This right is however considered by some to be a uniquely European phenomena, which resulted from one unusual CJEU judgement. Now, two upcoming cases against Google will be the first time in which the “right to be forgotten” will be considered by the English Courts. 

Two unnamed claimants, known only as NT1 and NT2, are bringing a companion case against Google to enforce their right to be forgotten. (NT1 v Google and NT2 v Google,  [2018] EWHC 67 (QB) (Rev 3))

Continue reading “Google prepares for the first “Right to Be Forgotten” trials in England”

Fake News? How about Fake Journalist™ 

Fake News? How about Fake Journalist™ 

Last week, the New York Times filed a lawsuit against Contessa Bourbon for causing substantial damage and injury to the paper’s business, goodwill and reputation. Despite having never worked for the Times, Contessa has been representing herself as one of their reporters – both in person, and on social media.

According to the lawsuit, Bourbon pretends to be a NYT reporter to gain access to press events: she recently interviewed US Education Secretary Betsy DeVos and the Turkish Ambassador under such pretenses. Despite receiving cease and desist letters from the Times previously, Bourbon continues her charade. She tweets about articles she claims to have written for the paper, and her profiles on Facebook, LinkedIn, and Instagram state that she is a NYT reporter.

However, with the exception of impersonating police officers or medical doctors (and in England, solicitors), simply pretending to be someone you’re not isn’t technically illegal. The problem impersonators and poseurs face is when they (almost inevitably) break laws concerning privacy matters, defamation, criminal fraud – or, in the NYT’s case – intellectual property.

Continue reading “Fake News? How about Fake Journalist™ “

Reputation: Taylor Swift’s protections under American and English defamation law

Reputation: Taylor Swift’s protections under American and English defamation law

this post is featured on the University of the Arts London’s intellectual property blog, creativeIP.org

♫♬ Now we’ve got problems / and I don’t think we can solve them (without lawyers…)

The right to freedom of expression is not an absolute right: there are certain restrictions in place to protect an individual’s reputation. But those restrictions vary significantly, depending on which side of the Atlantic you’re on. Considering the shared legal traditions of the United States and Great Britain, their differences on the issue of free speech is surprising. 

In early September, PopFront published an article entitled “Swiftly to the alt-right: Taylor subtly gets the lower case kkk in formation.” Exploring the singer’s (somewhat convoluted, if not contrived) connections to the American alt-right, PopFront suggests Swift’s song “Look What You Made Me Do” resonates with Breitbart readers, Trump supporters, and white supremacists, et al. The article also shows a screenshot from Swift’s music video juxtaposed with a photo of Hitler, noting that “Taylor lords over an army of models from a podium, akin to what Hitler had in Nazi Germany.”

Continue reading “Reputation: Taylor Swift’s protections under American and English defamation law”

Questioning the General: parallels to Soviet media control?

Questioning the General: parallels to Soviet media control?

Earlier this month, Representative Frederica Wilson of Florida reported that President Trump made insensitive, off piste comments over the phone to the widow of a soldier recently killed in Niger. According to Wilson, Trump told Myeshia Johnson that her husband “knew what he signed up for, but I guess it still hurt.” Trump flatly denied such comments. President Trump’s Chief of Staff, retired Marine Corps General John Kelly, rushed to Trump’s defense. Kelly called Congresswoman Wilson an “empty barrel,” and noted he was “stunned” over alleged comments she made “grandstanding about her own actions in Congress” at a building dedication ceremony honouring slain FBI agents.

Continue reading “Questioning the General: parallels to Soviet media control?”