Right to be forgotten advocates argue details online can be out-of-date, misleading and even downright wrong
Share 45
inShare6
Email Giles Tremlett in Madrid, Angelique Chrisafis in Paris and Kate Connolly in Berlin
The Guardian, Thursday 4 April 2013 12.41 BST
Campaigners want the right to be able to delete personal data held online. Photograph: Influx Productions/Getty Images
The internet has a long memory. It can remember things long after everyone else has forgotten them. In some cases, this can lead to a pleasant surprise: long-lost pictures, an old witticism, a fragment of a distant conversation.
But growing numbers of people are finding that the internet's long memory can be misleading, malicious or plain wrong. And they are taking the fight to the big repositories of personal data – principally, but not only, Google and Facebook.
Take Mario Costeja. Google his name and one of the first things you find is that he had financial problems in the 1990s and was forced to sell his house to pay off a debt.
That was 15 years ago. Costeja argues that in a world where clients, employers and lovers look up people who interest them on Google, the information is misleading and the damage to his reputation as a reliable forensic handwriting expert is wholly unfair.
"It was a friend who first told me about it," he said, in a telephone interview from the north-western Spanish city of La Coruña. "The debt was paid off, but the formal announcement placed in La Vanguardia at the time suddenly appeared on Google when the newspaper digitalised its archive years later.
"I even changed a letter in my surname on my business cards," he said. "That way people would not find me. These days everyone looks in Google."
"The debt was paid off," he said. "But it seems they have no obligation to publish the fact that you have paid it. At moments like that you lose your dignity and you might lose your home, but do you then have to lose your reputation because it is forever on the internet?"
Costeja has become a pioneer for the idea of the "right to be forgotten", taking his case against Google to the European court of justice in Luxembourg, where a ruling is expected by the end of the year. But he is not alone.
Max Schrems, a 25-year-old Austrian law graduate, is leading a vocal campaign against what he claims are Facebook's illegal practices of collecting and marketing users' personal data, often without consent. Schrems complained to the Irish data protection commissioner (European Facebook users are administered by its Irish subsidiary) that the social networking site held 1,200 pages of personal data about him, despite the fact that he had deleted much of it.
"The problem is that the Irish have very little chance of enforcement. They tried to negotiate with Facebook and its 15 lawyers and it was a totally unbalanced mediation," he said. "My case with Facebook is going in the right direction but Facebook will only go as far as the Irish authorities push it to go, so it's a very slow process, but we have achieved several things, such as a new privacy policy, and changes to data retention so that certain data has to be deleted after a year. A lot of stuff has come out of our case so far, but there's still around 80% of the law that they are not abiding by.
"At the moment, if I park in the wrong spot, I have to pay a fine. If Facebook does something wrong it doesn't have to pay anything. There's a law but there's no consequence."
New EU rules on the right to be forgotten are being championed by the EU justice commissioner, Viviane Reding, heralding the prospect of serious fines for companies that refuse to honour requests from customers to erase personal data. "Now they sense there's a danger of fines," said Schrems. "It changes the game plan."
Recent surveys show that the public – in Britain, and elsewhere – feel that it may be time to redress the balance. Research published by the privacy pressure group Big Brother Watch in February found that 68% of people in Britain expressed concern about their online privacy, with 22% saying they were "very concerned".
Personal data and private information can leak in a number of ways. Respondents to a Guardian survey of readers on their experience of internet privacy threw up the following frequent complaints:
• Difficulties with erasing social media accounts and ensuring all data therein is deleted
• Problems with the Google search function which elevates outdated, tendentious or incorrect information about an individual to the top of the search results.
• Lack of control over pictures posted by other people.
• Worries with internet "tracking" software that monitors usage and builds up a picture of an individual's internet habits.
Costeja's case falls into the second category. When he first complained, Spain's data protection agency ruled only partially in his favour. La Vanguardia newspaper, which published the information, was protected by freedom of speech or information rights and, so, had no obligation to remove the item. The information was true and was part of a list of properties, posted in the newspaper by law, belonging to debtors that the government was planning to forcibly sell.
Google, however, was told to remove its link. It was, in effect, deemed to be making money out of Costeja's personal data – and a further 180 Spaniards have won similar orders.
The internet giant challenged the decision and now Spain's national court has asked European judges for guidance.
Costeja's lawyer, Joaquin Mu̱oz, said his client was asking for the right for data to be eradicated Рjust as he might demand of any other company storing his personal data. "This should not be confused with a right to correction, which is different," he said.
He thinks Google could easily include the kind of button that it uses to report abuse on YouTube for "right to be forgotten" requests. Muñoz said other countries who sent representatives to the court, including Italy and Austria, backed the Spanish position.
But Google claims it is defending freedom of expression and battling censorship. It argued that – as a company operating from the US – European data directives did not apply to its search engines and that these did not process or control personal data. The company told the court it was simply an intermediary that indexed already published data.
"There are clear societal reasons why this kind of information should be publicly available," William Echikson of Google, wrote in a web post. "People shouldn't be prevented from learning that a politician was convicted of taking a bribe, or that a doctor was convicted of malpractice.
"Search engines point to information that is published online – and in this case to information that had to be made public, by law. In our view, only the original publisher can take the decision to remove such content."
Simple programming tools, known as "robots txt", also exist that newspaper archives could use to block search engines.
"I am not against freedom of expression, I have always been in favour," Costeja said. "But what Google does is a kind of cut and paste and I am against that."
Complaints
With its instinctive sense of privacy, France has seen a sharp rise in internet-users demanding the "right to be forgotten" online, as more people lodge formal complaints with the national data protection agency asking blogs and websites to delete items such as compromising or out-of-date personal information or embarrassing photographs.
The French data protection watchdog, La Commission nationale de l'informatique et des libertés, or CNIL, which has joined other European bodies in backing new European commissionmoves for data protection, is dealing with growing requests for information to be removed from French sites and in most cases has successfully negotiated for data to be deleted.
Isabelle Falque-Pierrotin, president of the CNIL, said: "We have more and more complaints over the right to be forgotten. In 2012 of 6,000 complaints overall, more than 1,000 concerned the right to be forgotten, more or less directly. It has become a big issue here, the number of complaints has gone up 42% in one year."
Formal complaints to the watchdog include parents who want photographs of their children to be deleted, the removal of incorrect data or people demanding that online references to historic court decisions not mention their name but be made anonymous – a legal right in certain cases in France after a sentence has been served. Many right to be forgotten cases concerned people who had created a profile on an online community which years later they had forgotten existed, had lost their log-in details and worried about a profile that "no longer reflected reality or could damage their search for work". These cases were often easily resolved with sites agreeing to remove defunct profiles.
The right to be forgotten online has long been a political debate in France, with the former rightwing minister for digital development, Nathalie Kosciusko-Morizet, setting up a charter in 2010 aimed at protecting personal information. "The internet must not be demonised, there are numerous types of content posted online that we want to keep, but in certain cases we would like to be able to delete them," she said. Her ideas included a centralised online complaints mechanism for requests for accounts to be deleted. Some companies, including Microsoft France, signed up to the non-binding charter, but other major players, such as Facebook and Google, did not.
Misconception
Opponents of right to be forgotten legislation argue that as well as an attack on freedom of expression, it might allow people with something to hide to twist their online persona. They also argue that it is effectively impossible to remove anything once it has been published, as it can instantly be replicated via a screengrab.
But Viktor Mayer-Schönberger, a leading advocate of the right to be forgotten, says this is a misconception. "If you can be deleted from Google's database, ie if you carry out a search on yourself and it no longer shows up, it might be in Google's back-up but if 99% of the population don't have access to it you have effectively been deleted."