The Right to Be Forgotten: An Archival Perspective

According to a 2016 statement by the International Federation of Library Associations (IFLA), the right to be forgotten (RTBF) “refers to an individual's ability to request that a search engine (or other data provider) remove links to information about himself or herself from search results.”¹ The idea is also referred to as the “right to delist,” the “right to erasure,” and the “right to obscurity.”² Internationally, laws and judicial decisions based on the right to be forgotten are intended to protect the privacy of individuals in an increasingly digital world, where access to information is easier than ever and a decades-old news story can be retrieved with a simple Google search. Meg Leta Jones, author of the 2016 book Ctrl Z, argued the need for “digital redemption,” essentially a way to allow people to detach from their pasts and reinvent themselves.³ For someone whose past contains an embarrassing or traumatic incident, particularly one highly publicized at the time, it seems merciful to allow the person to move on with his or her life by providing a way to prevent harmful stories from appearing every time the individual's name is searched. However, the notion of limiting, and in some cases eliminating, access to publically available information has both practical and ethical implications for libraries and archives, and information workers and others have passionately discussed the subject in recent years.

Though the right to be forgotten exists in various forms in many parts of the world and has far-reaching implications, this article will focus primarily on the right to be forgotten as it exists in Europe, especially in the context of Google searching. That said, to understand the scope of the RTBF and its potential effect on the work of archivists and librarians, it is necessary to recognize the various stakeholders and to set the concept in its legal and historical context.

The most obvious beneficiaries of RTBF legislation are the private individuals who want information about themselves that has been published on the Internet to be removed from the results of search engines like Yahoo! and Google. The public's access to stories about these individuals is affecting their private lives. However, several other groups are involved in and affected by the right to be forgotten. The operators of search engines, for example, as well as other data processors, are most often the parties responsible for making and enforcing decisions about specific requests to delist. Google was quick to point out the massive expense in personnel time and hiring this has cost the company.⁴ Authors and Web publishers of the delisted information are also affected, as well as the public as a whole, which has a right to access information on the Internet. Finally, archivists, librarians, and others dedicated to the preservation of the historical record and to providing the public with access to information have an interest in opposing legislation they perceive as a threat to those goals. These groups have been some of the most vocal in their criticism of the right to be forgotten.

Discussions surrounding the right to be forgotten seldom fail to mention a 2012 case concerning a Spanish citizen named Mario Costeja González.⁵ In 2010, Costeja González lodged a complaint with the Spanish Data Protection Agency (AEPD)⁶ against Google Spain and Google Inc., as well as La Vanguardia Ediciones SL, the publisher of a large newspaper in Spain. He complained that when Internet users searched his name on Google, they would see links to two 1998 stories in La Vanguardia's paper that discussed a real estate auction resulting from Costeja González's social security debts. Costeja González requested that the information be removed or otherwise made inaccessible to searchers, as the debts and related proceedings were long in the past and no longer relevant. The AEDP rejected the claim against the newspaper, as the publication of the information was legal at the time of the stories. However, the agency upheld the claim against Google, demanding that Google remove the information from its index and make further access to the stories impossible. Google, in return, appealed to the Spanish High Court, the Audiencia Nacional, which referred the case to the Court of Justice of the European Union (CJEU). The court ruled against Google and made a number of important statements that have become law regarding the right to be forgotten.⁷

First, the court set modern search engines in the context of the existing European data protection standard, the 1995 Data Protection Directive.⁸ The directive, written before the worldwide dominance of the Web and tech companies like Google, was created to provide strict controls for the protection of EU citizens' privacy in data processing. It outlines rules regarding transfers of data to third parties, conditions that must be met for data processing to be legal, the right of data subjects to obtain information from data processors about their data, and data subjects' right to object to the processing or sharing of their data, among other protections. It also allows data subjects to seek judicial remedy from controllers (the parties doing the data processing) for breaches of the directive. The court, in its 2014 decision, judged that the actions of search engines, in collecting and indexing Web sites that contain personal information, constitute data processing and that the operators of search engines are controllers, according to the directive's definitions. Therefore, the court held that, under certain conditions, search engine operators “are obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of search results displayed following a search made on the basis of that person's name . . . even, as the case may be, when its publication on those pages is lawful.”⁹ Specifically, data subjects may request the removal of links when “the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purpose for which they were processed and in light of the time that has elapsed.” The court acknowledged the interest of Internet users, but stated that a data subject's right to privacy generally outweighs that interest, depending on the role played by the data subject in public life.¹⁰

The RTBF has some very vocal supporters who argue the benefits of this kind of privacy legislation for the citizens of the European Union. Martine Reicherts (then EU justice commissioner), for example, argued in favor of the RTBF at the IFLA World Library and Information Congress in August 2014.¹¹ In the wake of the CJEU decision, she scolded critics of the right to be forgotten and pushed for the European Member States to pass the proposed EU General Data Protection framework, which was approved on April 27, 2016, and will go into effect on May 25, 2018, as the EU General Data Protection Regulation (GDPR).¹² The GDPR specifically guarantees all EU citizens the right to delist, with some limitations, within the framework of a more general data protection reform. In her remarks, Reicherts reminded the attendees of the goals of Europe's data reform, one of which is the digital single market. The appeal of the digital single market is that by standardizing data processing law across Europe, it will be simpler and cheaper for companies to operate in Europe. Additionally, with the institution of the GDPR, Europe's rules will apply to all companies who do business in Europe, even if they are headquartered elsewhere, which, Reicherts claimed, will “create a level playing field for Europe's digital industry”¹³ by requiring U.S.-based companies to follow European rules when doing business in the EU or processing the data of Europeans. The second point Reicherts emphasized was her view that the GDPR, and particularly the right to be forgotten, is not the threat its detractors claim. According to Article 17 of the GDPR, exceptions to the right to erasure exist, as in circumstances wherein the availability of the information is necessary to exercise the right of freedom of expression and information, to comply with a legal obligation, for public health purposes, for archiving purposes in the public interest, or for the defense of legal claims (GDPR, Art. 17).¹⁴ Reicherts assured her IFLA audience that the CJEU ruling and the GDPR do not allow people or organizations to remove content from the Web “simply because they find it inconvenient.”¹⁵ Specifically, she argued that “this is about requests to remove irrelevant or outdated links, rather than the content they link to,” and, even more directly, she claimed: “No one could have a newspaper article removed from an online archive because they do not like its content.”¹⁶ Reicherts pointed out that Google and other search engines make enormous amounts of money by handling the data of private individuals and suggested that it is only just that they be required to take responsibility for protecting that data.

Despite Reicherts' assurances, the CJEU ruling and the right to be forgotten have been applied in a number of ways since 2014, some of which suggest a stronger interpretation of the ruling's right to delist and a wider impact than Reicherts's speech or even the CJEU's ruling itself imply. The following paragraphs will contain brief examples of the ways the RTBF has been applied worldwide.

Google provides a Web site, for the sake of transparency, that describes several examples of delisting requests and Google's responses to them.¹⁷ An example from Belgium says: “An individual who was convicted of a serious crime in the last five years but whose conviction was quashed on appeal asked us to remove an article about the incident. We removed the page from search results for the individual's name.” An example from Hungary reports that a high-ranking public official asked Google to remove recent articles discussing a decades-old criminal conviction. Google says that it did not remove the articles from search results. In Poland, a “prominent business person” asked Google to remove articles about his lawsuit against a newspaper. This request was denied. Other examples were given of a protester's decades-old injury, a teacher's old conviction of a minor crime, a story about the murder of a woman's long-dead husband, and a Web page that included a woman's home address. Google reports that links to these pages were removed from results of searches for the individuals' names.

Other decisions have been made in the courts. In Germany, the Regional High Court of Hamburg ruled that a newspaper archives (not just the search engine) was responsible for preventing search engine indexing of a story about a criminal investigation that had ended without conviction.¹⁸ Similarly, in a 2015 case concerning a man who had been investigated and cleared of a serious crime, the Colombian Constitutional Court decided that the online journal did not have to remove the information, but it was required to update the article with a note that the person was never convicted and to ensure that search engines could not find the article during a name-based search of the individual.¹⁹ In 2015, the Spanish High Court ruled that a newspaper must prevent indexing of one of its Web pages by search engines, but it was not required to actually remove information from the original articles.²⁰ In Hong Kong, however, in 2010 and 2012, the judiciary redacted names in a matrimonial case and the privacy commissioner ordered David Webb, who created and operates a searchable archives of publicly available court documents, to remove the individuals' names in the copies of court documents stored on his database. In 2015, the Hong Kong Administrative Appeals Board decided that people have the right to have their information deleted, “even in a situation where such information is in the public domain.”²¹ Finally, in a more extreme case in May of 2016, the Belgian Supreme Court (Cour de Cassation) ruled that a newspaper publisher was required to delete information about a person convicted of causing a traffic accident from its digital archives.²² In these cases, unlike in the CJEU ruling, some (sometimes significant) responsibility fell on the online archives themselves, rather than just on the search engines.

The question of how to balance personal privacy and public access to information is not a new one for archivists, and it certainly did not originate with the debate over the right to be forgotten. In 2004, Jannah McCarville pointed out that archives in Canada have been dealing with restricted materials for many years.²³ That statement can easily be applied to archives everywhere. McCarville's article, which examines the challenges for archivists who must balance individuals' right to privacy against providing access to records in light of then-recent privacy legislation, reminds the reader that the right to be forgotten is not an isolated idea or event that just happened in 2014. The requirements of deeds of gift and various statutes have long required restrictions on access and have honed archivists' skills in weighing the requirements of privacy and access.²⁴ McCarville's article specifically references privacy legislation in Canada, including the Privacy Act of 1983 and the Personal Information Protection and Electronic Documents Act, which was inspired by Europe's 1995 directive and passed in 2002. Her fear was that companies that deal with personal information but do not fully understand the law would destroy data rather than give it to archives, thereby losing some of Canada's history. She also pointed to claims by some privacy advocates that “personal information should be controlled by the individual who created it or to whom it relates, even if that individual wants the information destroyed,” commenting that “Any person with a historical perspective shudders to think how historical records could be manipulated and misconstrued if such privacy advocates had their way.”²⁵ This potential rewriting of the historical record is a significant part of the anxiety that RTBF legislation causes among archivists, librarians, and other information professionals.

On a theoretical level, the right to delist may prove to be equally unsettling to archivists, in that it may force us to reconsider and rearticulate our understanding of what an archives actually is when represented in a digital format. This article will not attempt to tackle the complex questions of digital surrogacy, though they must be discussed in the coming years as archivists continue to grapple with the concept of a right to be forgotten. Instead, this article focuses on two categories of concerns regarding RTBF legislation: questions of clarity and transparency in the application of the law and points of conflict with specific professional values of archivists and other information professionals.

Patricia Glowinski and Blake Relle wrote a research post about the RTBF for the Society of American Archivists (SAA) Issues and Advocacy blog. In the post, the authors briefly summarized the right to be forgotten and listed some criticisms concerning the clarity of the law. Among those are a complaint that the “rules [of the RTBF ruling] are vague and unclear,” and “Due to the vagueness of the ruling, the principle could expand beyond search engines.”²⁶ History has already proved this to be a valid concern. Judicial application of the RTBF has varied from nation to nation over the past two years, and responsibility for erasure has already fallen on some online archives, most notably in the Belgian case mentioned earlier, in which an online newspaper was directed to remove a story entirely from its digital archives.²⁷

Other concerns voiced in the Issues and Advocacy post, and echoed in the 2016 IFLA statement on the right to be forgotten, include issues of transparency: “The decisions for delisting/erasure are left to corporations,” and “There is no transparency or accountability to the delisting of information.”²⁸ On this point, Google has made a strong effort toward transparency, which nevertheless cannot possibly reveal a complete picture of the company's decisions or decision-making process. In 2014, Google assembled a team of experts who held several meetings throughout Europe to discuss the ethical implications and practical decisions around the right to be forgotten. Luciano Floridi, professor of philosophy and ethics of information at the University of Oxford and a member of the council, reported on these meetings throughout the year, and the council published a report in January 2015.²⁹ Despite this openness, the details of Google's privacy-related decisions cannot be known. The RTBF section of Google's Transparency Report Web site provides only 23 anonymized examples out of the 647,110 requests (concerning 1,805,318 URLs) received to date (December 2016).³⁰

Another significant point of friction between the RTBF and archival and other information professions is equal access to information. Article 19 of the Universal Declaration of Human Rights affirms the right of all people to “seek, receive and impart information and ideas through any media and regardless of frontiers.”³¹ This is an important value to archivists and librarians. The Library Bill of Rights, published by the American Library Association (ALA) refers to the society's dedication to “free access to ideas.”³² Similarly, the Core Values Statement of the SAA says that “Archivists promote and provide the widest possible accessibility of materials.”³³ IFLA's ethical code holds that librarians have a social responsibility to support the recording of and access to information, and the IFLA statement on the RTBF contends that the ideal of freedom of access to information “cannot be honoured where information is removed from availability or destroyed.”³⁴

Furthermore, RTBF enforcement causes significant inequality in access to information. In March of 2016, Google changed its process for delisting Web sites.³⁵ It now delists from all European versions of Google and uses geolocation to ensure that European users cannot simply search using google.com to avoid the restrictions. Mack Freeman, a writer for the Intellectual Freedom blog of the ALA's Office for Intellectual Freedom, illustrated this practice with an example of a RTBF request filed in Germany: For such a request, if granted, the specified URL will be blocked for anyone searching the individual's name in Germany using any version of Google and for anyone searching in Europe using any European version of Google, but will not be blocked for someone outside of Europe using any version of Google or for someone in another European country using a non-European version of Google (like google.com). Thus, “access to information will become incredibly variable based on who is doing the searching and from what geographical location they are doing it. It also makes access to what used to be thought of as a hard public record as something that is variable and shifting.”³⁶

A concern closely related to both the idea of equal access to information and to transparency in application of the law is that of equity in enforcement of the RTBF. James Neal, a librarian emeritus of Columbia University, spoke at the ALA midwinter conference in January 2016 and discussed concerns about creating a “new digital divide,” in which “people with wealth will be able to exercise influence in ways regular people can't.”³⁷ Another possibility for a lack of equity is the same old digital divide with which we are already familiar. For the sake of practicality, Google requires RTBF requests to be submitted via Web form, which requires access to the Internet and a set of technical skills that is not yet universal.

Also reflected in RTBF legislation is the problem of accountability, a prominent idea in SAA's Core Values Statement. Access to records of public and private sector individuals and groups provides a means of holding those individuals and groups accountable to both present and future interests and of protecting the rights of citizens, consumers, employees, shareholders, and others.³⁸ Removing links to true, legally published information on the Web could have a significant impact on these kinds of accountability worldwide, even if unintended. In addition, some powerful voices support even stronger privacy protections than have already been accepted in current RTBF rulings. For example, the French Commission Nationale de l'Informatique et des Libertes (CNIL) fined Google 100,000 euros in March 2016 because it judged Google's new geolocation block to be insufficient. CNIL claimed that the right to privacy should not depend on the location of the Internet searcher, but that information delisted in one country should be delisted everywhere.³⁹ Google objected, pointing out that the French government can only control what Google does in France.⁴⁰ Some freedom of information advocates have pointed out a startling potential result of such thinking: If CNIL's position were upheld for all countries, “it could easily open the door for authoritarian regimes to whitewash the past everywhere.”⁴¹ This possibility is not included here to be extreme or frightening, but rather to point out the way a legitimate national data protection agency recently tried to interpret the right to be forgotten, and as a caution that archivists and all concerned citizens should continue to pay attention to the application and interpretation, not just the letter, of the law.

A final point of conflict the RTBF poses for archival and library ethics concerns censorship, freedom of expression, and copyright. The ALA's Library Bill of Rights asserts that librarians should challenge censorship and “cooperate with all persons and groups concerned with resisting abridgement of free expression.”⁴² Moreover, delisted information is not just written about someone, but by someone, and is often published legally. Blocking access to that content amounts to a violation of both copyright and freedom of expression,⁴³ despite the fact that information is not (usually) removed from the Web entirely. Removing access to content is censorship as much as deleting the content altogether would be. The SAA Issues and Advocacy post on the subject is more explicit. The authors quoted Jason Zittrain of the Berkman Center for Internet and Society, who contended: “It's like saying the books can stay in the library, but you have to set fire to the card catalogs.”⁴⁴

A final note: The right to be forgotten is an international phenomenon, codified most notably in the European Union, but it has usually been considered incompatible with the First Amendment of the United States Constitution.⁴⁵ However, some consider the RTBF concept to be “infectious” and suggest that it could spread to the United States as information companies working in a global environment see the convenience of having only one policy on the subject with which to deal.⁴⁶ Regardless of one's opinion on the benefits or risks of the right to be forgotten, it is essential that archivists actively seek to understand the changing nature of archives in a digital environment and to be informed about RTBF legislation, including the 2014 CJEU ruling, the various applications of that ruling, and especially the new EU General Data Protection Regulation. As Jannah McCarville pointed out more than a decade ago, “As the guardians of those records that make up our collective memory, archivists have a responsibility to be informed about new developments in privacy legislation and to consider the long-term implications of that legislation on their existing and future archives.”⁴⁷ But for more than just our archives, archivists and other information professionals should be careful to monitor the progress of RTBF legislation and enforcement worldwide, and speak up when it conflicts with basic freedoms—for the sake of the public's fair and equal access to information and for the press and public's freedom of expression.