Transcript IS THERE A “FUNDAMENTAL RIGHT TO FORGET?” Bruxelles – 20 May 2009

IS THERE A “FUNDAMENTAL RIGHT TO FORGET?”
1
Bruxelles – 20 May 2009
Right to forget vs. Right to be forgotten: two
different rights, or two different features of the
same right?

Two different concepts:
–
–
–
Right to forget: right not to be accountable for one’s
conduct after a certain amount of time and beyond a given
framework of relationships
Right to be forgotten: right not to see one’s past coming
back forever
These concepts, in particular the latter one, raise three
main questions: until when, to what extent, and by whom



2
Should our past be known
Should a person be accountable for past conduct
Should past conduct be made known, also to entities other
than those entitled to know because of the specific tasks
discharged and/or because of their relationships with the data
subject
International instruments and Community law:
the foundations of the rights protecting personal
identity and dignity
3

Article 8 ECHR, CoE Convention 108/81, Directive 95/46/EC,
Charter of Fundamental Rights (Nice), Lisbon Treaty (article 16
TFEU, article 39 TEU, article 6 on CFR binding nature): the
foundations of the right to data protection

In particular: the Directive highlights the relationship between
identity, human dignity and data protection the Directive can
regulate personal identity seen as a feature of the relationship
between individual and society

Identity is a dynamic concept: past information may kept to
the extent it is functional to the relationship between
individual and society
Directive 95/46/EC
• The Directive sets out limitations and conditions for the
processing of personal data (lawfulness, purpose
limitation, proportionality)
• In particular: Conditions for lawful processing (consent,
performance of contract, legal obligation, public interest)
• Data subjects’ rights: information (10,11),
rectification, erasure (12), objection (14)
access,
• In this context, right to forget and right to be forgotten
are regulated by data protection principles: the
information on one’s past may be kept and used if it is
necessary for the data subject’s rights/expectations
4
The public interest

The Directive contains provisions that highlight the public
interest in processing personal data (whether past or
present):
–
–
–

5
Historical, statistical, scientific purposes (with safeguards);
Journalistic purposes, artistic/literary expression;
Ordre public (security, defence, law enforcement) – in the
law.
In these cases the scope of protection afforded to
personal data is reduced: the individual’s consent is no
longer the main foundation of the processing  The
individual is no longer fully in control
The Interests at Stake
6

Societal interests: personal data may be disclosed to a
large number of entities (e.g.: historical/statistical
research, journalism)  ISSUE: Further purpose of
processing compared to collection: Is there a current
interest in knowing the data?

Public interests (article 13 directive): special regime on
processing mechanisms and data retention  Need to
check whether “institutional” purpose is to be achieved,
especially in the light of recent developments (fight
against terrorism, Lisbon Treaty)
The Interests at Stake: Public
Administrative Agencies





7
Openness of public administration + Need for ensuring effectiveness
and efficiency in discharging public functions
Issue: Should there be a limitation on the administration’s right to
process personal data for the above purposes?
Directive leaves it to Member States to find a suitable solution.
Our DPAs are often required to balance the interests at stake, on a
case-by-case basis
Guidelines by the Italian DPA: “After a certain time span,
dissemination of the data via websites may impinge disproportionately
on the data subjects’ rights – in particular if the underlying
measures/provisions were adopted long before and the respective
purposes have already been achieved. As well as ensuring that the
data are accurate, updated, relevant and not excessive, a local
authority is required to ensure compliance with data subjects’ right to
oblivion after achieving the purposes for which the data have been
processed.”
The “Right to Forget”
and the Digital Age

New technologies = New issues
–
Loss of control on one’s personal data
–
Information forever available
Search engines: fragmented identity; difficult to erase data
(Collaboration with Google: cache memory)
–
Online archives are much more easily accessible (Decisions by
Italian DPA: Online archives of media)
–
Trend: Public bodies increasingly publish personal information on
the web (to improve efficiency & effectiveness of their work)
(Decision by Italian DPA: Publishing of decisions by Italian Antitrust
Authority on the Internet)
–
8
The Broader Picture
-
-
9
The “right to forget/be forgotten” is
challenged by new technologies
In fact, the whole legal framework is
challenged
(directives,
Convention
108/81)
Need to develop new, international,
harmonised approaches (International
Standards?)
The Broader Picture
10
-
We should not do without the right to build up
our own identities, even in the digital age
-
Issue: Right to limited data retention (How to
ensure it? Realistic?)
-
“Right to oblivion”
determination

Informational
self-