Essay/Opinion: For a purportedly narrow opinion, the European Court of Justice’s recent decision on The Right To Be Forgotten certainly seems broad to me. It’s clear that it reaches an enterprise like Wikipedia -- neither a serious journalistic enterprise nor a literary or artistic work, so therefore a data controller. Apart from its breadth, theres also its vagueness, which gives it a whole new dimension of free-expression wrongness. The conflation, obviously, is between The Right To Be Forgotten and The Right To Privacy, since in practice the former is being used to censor public records entirely, or make them more difficult to find (e.g., your bankruptcy), rather to protect private information (e.g., your love letters). Probably the biggest misrepresentation of the ECJ opinion is that it has to do with privacy. But its nearly as a big a representation to describe it as a narrow holding, unless one thinks that limiting Article 19 rights to seek and to impart information only to journalistic institutions or novelists is narrow. The ECJ opinion makes clear that the decision applies to search engines but not (yet) to the databases of source journals (such as The New York Times or the Guardian). But of course it can affect the work of Wikipedia editors and other Wikimedians looking for online sources if search engine results can be censored in this way. In addition, it seems possible that the ECJ opinion can be understood to apply to Wikipedia itself, which, while not a search engine, may qualify as a controller as that word is defined under Article 2 of Directive 95/46 of the European Parliament (on the protection of individuals with regard to the processing of personal data and on the free movement of such data). Look at these relevant definitions from the text of the ECJ opinion: ------------ Article 2 of Directive 95/46 states that ‘[f]or the purposes of this Directive: (a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; (b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; ... (d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law; ... Article 9 of Directive 95/46, entitled ‘Processing of personal data and freedom of expression’, provides: ‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’ --------------- (Note that processing of personal data need not be done by automatic means. I read this to mean that Wikipedia editors themselves may qualify as engaging in the processing of personal data. And the definition of controller expressly includes a natural ... person.) Assuming that Member States would assert jurisdiction over Wikipedia (even though Wikipedia is hosted in the United States), could Wikipedia articles be defended under the solely for journalistic purposes or the purpose of artistic or literary expression language of Article 9 of the Directive? That language doesnt strike me as a very good fit for what Wikipedia does. It seems worth asking: I. Can an individual citizen be classified as a controller under the Directive? (The answer is clearly yes.) II. Can an individual citizen who doesnt even use digital devices -- who maintains a paper-card filing system -- be considered a processor of data? (The answer is clearly yes -- processing doesnt have to be automatic, and filing systems are expressly mentioned under Article 3 of the Directive: This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’) III. Is personal data limited to obvious things like names, addresses, birthrates? (Expressly the answer is no -- practically anything can qualify as personal data if someone, somewhere, can directly or indirectly use it to identify you. See Article 2 of the Directive.) IV. Can processing of personal data be done without a computer, without any ordering at all, or with random ordering (such as shuffling of cards)? (Answer: Yes. Even dissemination qualifies. Even your own consultation qualifies. See Article 2.) V. Is the right being protected a privacy right? Manifestly not, since not only did the Costeja Gonzales case center on searchable article that *remains public in a newspaper database*, but also the subsequent flood of requests consistently (if not always) bring up complaints about facts that happen to be in the public record. Are newspapers, artists, and novelists safe? You be the judge of Article 9: Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression *only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression*.’ [Emphasis mine.] And of course its by no means clear how these exemptions and derogations will be applied, or by what criteria. More importantly, what about the presumption that its journalists, artists, and the literary classes that need this only if protection? Hasnt the digital revolution been about empowering *all* citizens not only to engage in freedom of expression but also to seek and to impart information (to quote the language of Article 19 of the UN Universal Declaration of Human Rights)? I could go on and on. The important thing to take away from the ECJ opinion in the Costeja Gonzales case is that virtually anything human beings, collectively or individually, do with data (digital or analog) can subject those human beings to censorship, including the obliterating of purportedly irrelevant (but factually true) information. The Universal Declaration wasnt drafted to protected the rights of professional journalist or artistic classes -- its 20th-century drafters thought more broadly than that, just as the 18th-century Framers of the U.S. Bill of Rights did. So, the ECJ decision is not just an assault on Google -- although it very much is that -- or an assault on search engines generally. By its own expansive, vague, broad language it is an assault on fundamental rights that inhere in every citizen where the fundamental freedoms of expression and inquiry are protected. Just one mans opinion, of course.
Posted on: Tue, 12 Aug 2014 19:09:43 +0000
Trending Topics
Recently Viewed Topics
© 2015