"The ruling confirms the need to bring today's data
protection rules from the 'digital stone age' into
today's modern computing world where data is no longer
stored on 'a server', or once launched online disappears
in cyberspace"
— European Commission vice-president Viviane Reding ("who has led the EU's data privacy efforts")
What—and I'm asking in earnest—is that quote even supposed to mean?
It just sounds like "once you publish something online it will be replicated in so many places that trying to get it removed is meaningless". Which is true and irrelevant to the question if people should be able to get things taken down from Google, a highly visible place being the leading search engine by a huge margin. It's like saying "because we can't erase every single physical record in the world you can't demand to take down that libelous billboard in Times Square". Not that I think Google is that billboard, it's just indexing what's already there.
Does this mean we should accept and ignore character smears, witness protection, cyberbullying and libel? Is it okay for someone to surrender the arbitrary association of content to their name which may not be true?
The solution might not be beautiful or scalable but removing search results could seriously improve some people's lives'.
I'm not talking about allowing people to remove information pertaining to trying to hide poor behaviour online or bad reviews online. I'm talking about the life ruining things.
Except this case was about a life-ruining thing that was true.
And raises some potential problems: suppose I default on my mortgage and get foreclosed, and you end up buying my house. Now, the fact that I was once the owner and that it changed hands in the foreclosure is part of the chain of ownership of that property, and may become necessary information if your ownership is ever challenged.
Does my "right to be forgotten" preclude your right to prove your ownership of the property?
It was a 1998 foreclosure. Under US law, items older than 7 years are stricken from credit reports (though other actions may remain part of a record). In a world in which arbitrary reasons for denial exist, being prejudiced by a 16 year old, or 26 year old, or 46 year old financial mishap would seem ... less than just.
How about the roughly 485,000 households in the US receiving foreclosure notices in the 2010 foreclosure crisis. I'm sorry, that was in September 2012 alone. If that's a persistent Web record, should that follow them around for the rest of their lives?
Or, in a different context, does a rhinoceros have a right to be forgotten? http://redd.it/25ll1v
There are several things your over-simplified analysis is missing here.
One is that the "right to be forgotten" does not exist in a vacuum -- it has to coexist with a bunch of other rights, and weighing how important each of them is in relation to the others is incredibly difficult. And that's without getting into as-yet-uncodified rights (example: making history more accessible via scanning/OCRing of old newspapers, which now seems like it'd have to come with a censorship regime built in to expunge news that's "meant to be forgotten").
Another is the practicality issue, in that information of this sort is actually incredibly hard to destroy, and often is required to be published in order to provide a fair process to everyone involved.
Finally, there's the issue that this is going after Google, but that doesn't actually accomplish the kind of "forgetting" you seem to be talking about. Sure, the general public won't see a newspaper listing about the foreclosure in Google anymore, but the people in a position to use that information to wreak institutional harm still will have access to it, because the databases they use are not publicly accessible, meaning it's not possible to determine if you're even in them in order to sue for removal.
Digitizing old newspapers isn't all that great an intrusion -- though it makes old content available, you're still bound by the bandwidth of those original print sources. It means that you might see what had been talk-of-the-small-town splashed around on national or international coverage now. In a levels-of-harm basis, it's not so bad.
On the weighted importance, one of the interesting elements I've seen said of Xeer (mentioned recently on HN: https://news.ycombinator.com/item?id=7736841) is that there's a concept of increasing obligations with increasing power or wealth (this is hearsay from a reddit comment, the Wikipedia article doesn't touch on this). It's similar to how I feel disclosure rules should operate. Someone with little or no impact on society should fear little disclosure. Someone with a great deal of impact (financial, political, military, religious, cultural power, or with a record of criminal acts causing suffering or death to others) should be obliged to disclose more of themselves.
As for coming up with automatic rules, I doubt that's possible, but then, it's not in law either -- that's why we've got judges.
Your criticism in going after Google has merits, though any law such as the EU one should address not only the access and indexing of such information, but of its use. Though proving someone knows a certain fact or accessed a specific piece of information is at best difficult.
That is a contrived example. In your example, the information would be kept, the fact the property was foreclosed would probably be stored in a cabinet or computer system in an office somewhere. You would make an effort to seek out and obtain that information legally and with justifiable cause. (To prove your ownership.) It would not be publicly accessible for the world to see for there is no reason for it to be. It would be a bit like medical records.
The core part of the argument to the right to be forgotten is to treat some pieces of information as medical information, i.e, private or not your concern. Things that you would rather not be known for they bestow little benefit to you except for you to profit at my expense. A lot of people find this uncomfortable, for good reason.
> The core part of the argument to the right to be forgotten is to treat some pieces of information as medical information
That sounds great, but this case clearly shows that's not the case at all. This is information that can be widely and freely reported, just not by everyone. A newspaper could run it as their front page story every day, but some other people can't report it, and, in fact, can't even tell you the fact that someone else is saying something related to the topic you're searching for. That's something very different than treating it as private data.
One thing about restricting public disclosures to established news organizations, as had been the case prior to the advent of the Web, is that there's a distinctly limited bandwidth for this. While _an_ individual could be smeared, the ability to do so on a mass basis was distinctly limited.
I haven't read the EU decision yet, nor have I made up my mind as to whether or not it does or doesn't have merits. In general I subscribe to the principle that there's a proportionality appropriate to disclosure: that the greater a person's (or institution's) power and responsibility, the greater the obligation for disclosure of relevant details of their life, most particularly as it might affect others (individuals, organizations, government(s), etc.).
She's saying that, in her view, people should own their information. Where Google (or anyone else) chooses to store it, should not be an excuse for denying what she sees as the right to manage that information.
At a high level, I imagine she would support a law that requires all information that can be associated with an individual (google account, ip address, etc) to be stored with metadata tracing it back to that identity and require that companies be able to remove all the data by metadata.
What do people find confusing about the quote? It seems like pretty standard politician to me.
> At a high level, I imagine she would support a law that requires all information that can be associated with an individual (google account, ip address, etc) to be stored with metadata tracing it back to that identity and require that companies be able to remove all the data by metadata
What does that have to do with linking to a factually true news story about a guy? It seems a lot more like she's trying to conflate things for a soundbite.
In any case, making all statements that are about information about someone transitively "personal information" seems like an awfully bad idea. That's great when Google can track an account or an IP address, but where's the metadata for Mario Gonzalez to be found in a newspaper's story about Mario Gonzalez? And considering that news stories are often about more than one thing, what's the balance when a story is about someone who wants the event to be forgotten and someone who doesn't (or it's important that it's not)?
In all seriousness though, in the UK credit record agencies can only keep 6 years of financial information - a search engine is not subject to any regulation around this and could for example return an insolvency event from 16 years ago.
Reding is saying this is a double standard and infringes on an EU citizens rights and that they'd like to regulate this.
A search engine does not know how old the contents of a page are. They'd have to diff different versions of a page, which is not foolproof; for html it's particularly noisy compared to, say, code. Even when that strategy works, or when there's only one version of a page, it's only possible to determine when the search engine first saw a piece of content, not when that piece of content was created.
In contrast, things on a credit history are dated.
> A stag gore victim who complained that six newspapers made "inappropriate" references to her transgender status has said the press "trampled all over" her private life.
> The Press Complaints Commission (PCC) said the six papers had agreed to amend their online stories.
> Dr Stone, 44, said she hoped fewer people would now face press intrusion.
> She complained to the PCC that the Daily Mail, The Sun, The Scottish Sun, Daily Mirror, Daily Telegraph and Daily Record had made "irrelevant" references to her gender when covering the story in December.
She is a transgender woman. Six newspapers made undue reference to her transgender status. She claims that it is irrelevant to the news articles and that she has some right to privacy with that part of her life under article 8 of the ECHR.
I tend to agree with her, and if companies operating in the EU ignore her polite validly formed requests she goes to regulatory body, and if they decline her request she goes to law.
The correct target here is the people writing the original factual but intrusive articles, and not the people linking to those factual but intrusive articles.
I'd be interested to see if Google's registration with various data protection bodies across Europe is in compliance with whatever this ruling supposes. This ruling feels like a big change to make Google more responsible for handling personal data than they were before.
And yes, that is what makes this ruling so incredibly dangerous.
Whilst personal privacy is important, it needs to be balanced by the right of the broader society to know things. I think this ruling swings to far away from the "right to know".
it seems, given the existence of a market for commercially archiving/indexing ala lexisnexis, this means that europeans will have the right to be forgotten by their neighbours (using google), but not by their neighbour's lawyers (using lexis/etc). they might be subject to the same rules, but most of the time people don't know these services and so are not going to request it. weird ruling.
That's kind of how it worked before everything was readily available online. There was all kinds of information about you available in the public record, but if your neighbors wanted it they had to go to the offices of whatever government agency held the information and get it from an actual physical record on paper or microfiche.
The meant you had reasonable privacy from curious and nosy neighbors and coworkers, but if someone actually had an important enough reason to need your information to justify the legwork or the expense to hire someone else to do the legwork they could get it.
Why doesn't the article address the elephant in the room: the websites that make private information available are at fault here, Google is only the proverbial messenger. I'm all for the right to be forgotten, but the problem should be addressed at the source.
Sadly, the text of the "right" allows suits against the search engines, and it's easier to find and sue major search engines than the owner of every site returned by results.
Yeah, the actual one removes results. There are examples where they just return blank results pages for some people's names.
I just thought the blurred names would be a fun trick that would still let people get to content for a day, might raise awareness without alienating as many users.
Is it a fault that a website publishes news of someone's bankruptcy, or that a certain person was once convicted of a sex crime? This right to be forgotten certainly is not a concept I have every heard anyone advocate for in the US.
Credit cards, social security numbers, copyright work, stolen trade secrets, and other sensitive personal information are different. What this EU ruling seems to say is that if anything embarrassing or uncomfortable has ever happened to you in the past it should be erased from the historical record, as if it never occurred. That is kind of like in grade school, being banned by the teacher for reminding another student that they shit their pants.
> That is kind of like in grade school, being banned by the teacher for reminding another student that they shit their pants.
That is so oddly specific that I have to ask: were you the kid that shit his pants, or the one who had to be told not to remind the kid that he once shat his pants?
I was the one that continually reminded someone if they ever did anything embarrassing. Usually to the point I was yelled at by a teacher or the individual's own parents.
Those sites (largely) only serve traffic by way of Web searches and ad networks. Both of which are far easier to target than fly-by-night pop-up websites.
So going after the search engines, advertising networks, hosting providers, and backbone providers makes plenty of sense.
That differs on a case-by-case basis. The lawsuit from the submission was apparently about a local paper publishing about the guy losing his home. The problem should have been addressed by local laws regarding whether such information may be published in the first place (or at least without last name).
This must suck for any startup operating out of the EU. Would this mean that anyone can request anything to be removed from the internet if the company operates out of the EU? It's hard to determine if a given piece of information is "private" or not. This would make it nearly impossible to run any kind of web startup from the EU.
`The presumption by internet companies and others that they can use peoples personal information in any way they see fit is wrong, and can only happen because the legal framework in most states is still in the last century when it comes to property rights in personal information.`
The irony here is that in order to be able to get people forgotten, companies will need to do a much better job at knowing what information belongs to whom (build an identity) so it can be forgotten. The problem also becomes, people who share names etc... and by extension should we be destroying news papers from decades ago? I believe many are archived in libraries and be used for the same kind of research, albeit less convenient, of information that has not been forgotten...
What—and I'm asking in earnest—is that quote even supposed to mean?