A Grave New Threat to Free Speech From Europe
At the end of January, Viviane Reding, the European Commissioner for Justice, Fundamental Rights, and Citizenship, announced a sweeping new privacy right: the “right to be forgotten.” The proposed right would require companies like Facebook and Google to remove information that people post about themselves and later regret—even if that information has already been widely distributed. The right is designed to address a real and urgent problem in the digital age: It’s very hard to escape your past on the Internet now that every photo, status update, and tweet lives forever in the digital cloud. But the right to be forgotten takes a dangerously broad approach to solving the problem. In fact, it represents the biggest threat to Internet free speech in our time.
The new right’s intellectual roots can be found in French law, which recognizes le droit à l’oubli—or the “right of oblivion”—a right that allows a convicted criminal who has served his time and been rehabilitated to object to the publication of the facts of his conviction and incarceration. (In America, by contrast, publication of someone’s criminal history is protected by the First Amendment.) Now that the Internet records everything and forgets nothing, European regulators have concluded that the difficulty of escaping one’s past is not merely a problem for criminals—but instead applies to everyone.
In endorsing the new right, Reding downplayed its effect on free speech, and press accounts have been similarly reassuring. In a post at The Atlantic, John Hendel wrote that “the overhaul insists that Internet users control the data they put online, not the references in media or anywhere else.” But the regulations that were actually proposed on January 25 are not limited to personal data people have posted themselves; instead, they create a much broader right to delete personal data, defined broadly as “any information relating to a data subject.”
In a widely cited blog post last March, Peter Fleischer, chief privacy counsel of Google, noted that the right to be forgotten, as discussed in Europe, can apply in three situations, each of which proposes progressively greater threats to free speech. The regulations that the European Commission proposed in January are troubling because they extend to all three.
The first category is the narrowest: “If I post something online, do I have the right to delete it again?” Since Facebook and other social networking sites already allow users to do this, creating a legally enforceable right here is mostly symbolic and entirely unobjectionable. It would also usefully put pressure on Facebook to abide by its own stated privacy policies, by allowing users to confirm that photos and other data have been deleted from its archives after they are removed from public display.
But the right to delete data becomes far more controversial when it involves the second category: “If I post something, and someone else copies it and re-posts it on their own site, do I have the right to delete it?” Imagine a teenager regrets posting a picture of herself with a bottle of beer and, after deleting it, later discovers that several of her friends have copied and reposted the picture on their own profiles. If she asks them to take down the pictures, and her friends refuse or can’t be found, should Facebook be forced to delete the picture from her friends’ albums without the owners’ consent?