My keynote on RTBF from BILETA 2016. I argue that the RTBF is misunderstood as a dangerous control on freedom of expression online, that jurisdictional issues can be overcome and that the problems we should be worrying about are (i) copyright btake downs and (ii) lack of control over spread of profiled semi anonymised data.

1. SUNNY SPELLS? NON
FOGGY THINKING ABOUT
THE RIGHT TO BE
FORGOTTEN
Lilian Edwards
Professor of Internet
Governance
University of
Strathclyde
BILETA 2016

2. PANIC AMONG THE LIEGES
AFTER GOOGLE SPAIN
Jimmy Wales, Wikipedia
7 June 2014
“In the case of truthful, non-
defamatory information
obtained legally, I think
there is no possibility of any
defensible ‘right’ to censor
what other people are
saying..
We have a typical situation
where incompetent
politicians have written
well-meaning but
incoherent legislation
without due consideration
for human rights and
technical matters
.. There is no “right to be
forgotten” — there is
apparently a “right” in
Europe to censor some
information that you don’t
HL Committee on the Right
to be Forgotten 30 July
2014
“It is no longer reasonable
or even possible for the
right to privacy to allow data
subjects a right to remove
links to data which are
accurate and lawfully
available. ..
..the 'right to be forgotten'
as it is in the Commission's
proposal, and a fortiori as
proposed to be amended by
the Parliament, must go. It
is misguided in principle
and unworkable in practice.

3. “FOGGY THINKING ABOUT
THE RIGHT TO OBLIVION”
Peter Fleischer, Google, March 9 2011
“More and more, privacy is being used to justify
censorship. In a sense, privacy depends on keeping
some things private, in other words, hidden,
restricted, or deleted. And in a world where ever more
content is coming online, and where ever more
content is find-able and share-able, it's also natural
that the privacy counter-movement is gathering
strength. Privacy is the new black in censorship
fashions. It used to be that people would invoke libel
or defamation to justify censorship about things that
hurt their reputations. But invoking libel or
defamation requires that the speech not be true.
Privacy is far more elastic, because privacy claims can
be made on speech that is true.”

4. 1. BRASS TACKS
Right to be forgotten (RTBF) – GDPR, art 17. Right of DS to
“obtain from the DC the erasure of personal data” if
 data no longer necessary for original purpose
 DS withdraws consent
 DS objects to their PD being processed on basis of “legitimate
interests” or in public interest AND no overriding legitimate
grounds for processing OR user rt to object eg against automated
profiling
 They have been “unlawfully processed”
NB not very new if at all – see eg Zanfir on DPD art 12(b)
and14; extension to third parties is novel
1. Aimed at hosts/publishers NOT exclusively (if at all) at search
engines or linkers.
2. Intended primarily to protect children’s follies, not pedophiles
and criminals
3. Clear exceptions – see art 17(3).
inc. Freedom of expression and information;
Archives, historical, statistical and scientific research (cf Wikipedia

5. 2. GOOGLE SPAIN V COSTEJA ECJ
C-131/12, MAY 2014
1. Search engines are data controllers (determine means
and purposes of processing) of personal data under art
2 DPD.
 “finding information published or placed on the
internet by third parties, indexing it automatically,
storing it temporarily and, finally, making it available
to internet users according to a particular order of
preference must be classified as ‘processing of
personal data’ “. [also collect, retrieve, record,
organise, disclose – art 2 DPD}
2. Google (US based) falls within EU DP jurisdiction
under art 4(1)- establishment in Spain selling
advertising “inextricably linked to” SE = “processing
carried out “in the context of the activities” of
establishment [in Spain]
3. -> arts 12(b)/14, individuals have the right to ask for

6. COSTEJA CONTD
Does judgment show disregard for fairly balancing
privacy with freedom of expression? (explicit para 81)
1. Sufficient to ask original publisher/host for
deletion, not search engine?. No..
Search engines make it “appreciably easier for
any internet user making a search in respect of
the person concerned and may play a decisive
role in the dissemination of that information
[thus] it is liable to constitute a more
significant interference with the data subject’s
fundamental right to privacy than the
publication on the web page”
(paras 37,80)
 Plus (para 84) original publisher may not be in EU ->
“effective and complete protection of data users
could not be achieved if the latter had to obtain
first or in parallel the erasure of the information

7. COSTEJA CONTD
2. Exceptions protecting the public interest in
access to expression? “fair balance should be
sought”
 “However, that would not be the case if it
appeared, for particular reasons, such as the
role played by the data subject in public life,
that the interference with his fundamental
rights is justified by the preponderant interest
of the general public...” (para 98)
 See exceptions in art 17 DPReg – wider,
clearer?
 Take down enforcement role for DPA if refusal
to delink by search engine. (para 77)
3. Should there be a need to show “prejudice”
caused by the link to get delinking?
No. Why? – LE. Not needed by art 12 DPD; a
fundamental right of private life not reputation
(so truth not = defense); harms extremely hard
to show.
ECJ: “fundamental right” of DS overrides

8. AND
YET THE
SKY
FALLS?Daily Mail, 31
May 2014

9. GOOGLE’S TRANSPARENCY
REPORT
23 examples given, 13 involve perpetrators of
crimes; 3 sexual crimes, 2 perpetrated by
priests (one investigation only).
Of the remaining 10, 5 involve “victims” (1
possibly of revenge porn), 1 a doctor accused
of malpractice, 1 a woman’s address, 1
“embarrassing content”, 1 a public official being
deselected, 1 a lawsuit
12 removed, 11
not removed

10. TIPPMANN AND POWLES JULY
2015
Private coding of Google data used to analyse
requests made.
Codes identified for “serious crime”, “public
figure”, “political” and “child protection”
Rest were “private or personal information”
Less than 5% of requests made came from
criminals, politicians and high profile public
figures – rest from “everyday members of
public”
Thus c 95% “ordinary” requests
Google : ”the data was not reliable enough for
publication”

11. A PRACTICAL EXERCISE

17. 2. WHY WORRY SO MUCH
ABOUT RTBF TAKE DOWNS?
Daphne Keller:
“The new provision looks like bad news for free
expression and information access online…the new
“right to be forgotten” regulation risks becoming a
powerful instrument that individuals and companies can
use to suppress far more information than GDPR drafters
ever intended.”
“It is already far too easy for individuals or companies to
raise dubious legal claims against content they disagree
with, and pressure private Internet platforms to take it
down…. I advised Google on its responses to legal
removal requests for many years, and can attest to the
volume of false accusations made, through ignorance or
malice, against legitimate online expression.”

18. Google Transparency report : April 5
2016
RTBF take downs, May 2014- now
825,218 actual URLs delinked to a name (not “removed”)

19. Google Transparency Report for copyright take down requests ,
as of April 10 2016

20. SCRUTINY AND ACCURACY?
Keller : “the new, worse take down”
Claims high percent false claims for delinking :“Data
released by Google and Bing tells us this pattern is strong
under the current right to be forgotten law — at least half of
removal requests are invalid. ..overall, false accusations
often succeed.”
True (tho cfSpanish experience - but again is © not far
greater worry?
Copyright take downs Google FAQ: “FAQ: “We removed 97%
of search results specified in requests that we received
between July and December 2011.”
Urban, Karaganis, Schofield 2016: “automating enforcement
can introduce errors. These errors can be hard to catch, as
the vast majority of automated claims are not substantially
reviewed by humans. Further, OSPs generally described
the counter notice procedure as impractical and
infrequently used”.
Nearly 30% of 108m take down requests “of questionable
validity”.
Surely requests for take down of info relative to ones own
name are prima facie easier to spot if “false” than automated

21. 3. REAL PROBLEMS
1. Jurisdiction – national, EU wide, global? Google has agreed to EU
wide removal but not .com. Lack of harmonisation potential despite
A29 guideline – eg French DPA and courts refused to allow merely
EU delinking in Shefel.
2. 2. Due process.
(a) Should a private co be judge?? Cf normal process for art 12
DPD? (non judicial with right for redress via DPA) and indeed
ordinary takedowns
(b) Alternative arbitration body? Who pays? Pays for
representation?
(c) Post delinking notice to original publisher? (see
Kuczerawy/Ausloos) Is there value except to create a Streisand effect
and bad PR for the RTBF? To create further invasions of privacy
for the data subject?
Cf a pre delinking notice – which would allow the
publisher to mount defense? Defend press freedom? Data subject to
bring more evidence?
(d) Right of appeal? At moment, extremely informal both
within Google and DPAs. Many DPA reversals of G decision(UK,
Spain, Fr, etc)

22. 3. AFTER THE GDPR ENTERS
INTO FORCE?
https://support.google.com/legal/contact/lr_eudpa?produc
t=websearch
“Search results you want removed from the list of results
produced when searching for the name
“For each URL you provided, please explain:
(1) how the linked URL relates to you (or, if you are
submitting this form on behalf of someone else, why the
page is about that person); and
(2) why the content on this URL in search results is
distributed unlawfully, inaccurate, or outdated. We may ask
you to provide additional documents in support of your
request.Q. What happens when GDPR art 17 enters into force with
much wider grounds to make such request from data
controller? Eg withdrawal of consent, general unlawful
processing?

23. 4. “BASTARD DATA” –
IMPLICATIONS FOR RTBF?
Joe McNamee, SCLJnl, March 2016
“Should we still be talking about 'privacy' in a world invaded
by bastard data? We all knew what privacy was when it came
to our data. We had our names and addresses, we had our
store cards, we had our medical records.. We knew what our
data were. We knew what we had to hide or protect. We knew
the dangers and the benefits.”
“In a highly interconnected world of 'big data' the situation
has changed fundamentally. Data are merged and compared.
New data are generated and these, in turn can be compared
with new data sets, with further new data being collected.
Data have become fertile and has bastard offspring that
create new challenges that go far beyond what society
previously considered (and, unfortunately, still considers) to
be 'privacy‘”
Rights to erase meta data? Traffic data? Presumptively
personal data?
Effects on third parties? Receivers of pseudonymised data?

24. EXERCISE
You are Google.
Decide if a link to the story submitted from a particular persons name
should be removed.
1. http://www.telegraph.co.uk/technology/google/11040911/The-
EUs-Right-to-be-Forgotten-Google-removes-link-to-Telegraph-story-
about-convent-girl-madam.html
2. http://www.telegraph.co.uk/news/uknews/1556958/Crimewave-
teenager-gets-Asbo-for-3-years.html
3. http://www.dailymail.co.uk/news/article-1358753/Muslim-
refused-job-accuses-airline-bosses-racism.html
This requires you to consider
- who asked for the delinking
- did that person have the right to ask for the delinking
- if they did, is there any reason Google should deny them that
right?
For extra points, do you think the story should be delinked just from