Monday, March 28, 2011

Enforcement of the Right to be Forgotten

European Union Flag

Much has been made of the ascendency of the right to be forgotten in the European Union. Google's court battle in Spain, the European Commission's adoption of a proposal to clarify the right, and numerous references to the case of Wolfgang Werlé and Manfred Lauber have routinely made the news.

As explained by the European Commission in November 2010, the right to be forgotten is "the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes." This right, on an EU wide scale, is based in Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 reads:

Protection of personal data
  1. Everyone has the right to the protection of personal data concerning him or her.
  2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
  3. Compliance with these rules shall be subject to control by an independent authority.

Insofar as it applies to the right to be forgotten, the interpretation of Article 8 varies within Europe, as a recent panel on social media and online privacy at Westminster demonstrated. But, the general trend seems to be movement towards allowing people to remove information about themselves posted online, irregardless of whether they posted that information, if speeches at the European parliament are any indication. This trend finds a basis in the controversial German court decision that Wolfgang Werlé and Manfred Lauber could prevent information being published about their murder of Walter Sedlmayr (although they could not scrub information that had already been published or archived).

While much must still be clarified about the right to be forgotten the possibility of an effective enforcement regime for the right to be forgotten seems unlikely. This is due to the glaring shortcomings of the various choices for how enforcement may be premised.

Gavel
First, enforcement may be premised on the existence of personal jurisdiction. If the government (presumably, a nation or state) cannot physically seize the offender or assets of the offender it cannot enforce the right (unless it can convince another government to seize the offender or assets of the offender for it).

Let me given an example of how this works. Imagine that you criticize the King of Jordan. (This is highly illegal under Jordanian law so don't). Presumably, the Jordanian government would order you to be arrested. But, if you don't live in Jordan, have no assets in Jordan, and the Jordanian government cannot convince the nation where you are located (or where your assets are located) to seize you (or them) the Jordanian government cannot enforce its law. Essentially, you can violate Jordanian law with impunity. This plays out in exactly the same way with the right to be forgotten. Take the case of Julian Assange. The United States would, presumably, like to prosecute him for disclosing classified military information but cannot because it cannot physically seize him (or convince another government to seize and extradite him).

Second, enforcement may be premised on accessibility of markets. If a government can prevent its citizens from accessing a website that government can use that leverage to enforce that right. Of course, this enforcement mechanism is only effective if that website either obtains or reasonably stands to obtain a substantial portion of its income from the citizens of that nation. Why bother entering the Swiss market with its 7,731,167 people if the government places unreasonable restrictions on the content of your website and you cannot reasonably expect to see a large revenue stream flowing from that country?

China stands as a great example of this kind of enforcement. When Google entered the China market it stood to obtain a large portion of its revenue from that country and, so, agreed to censor search results on Google.cn. When the Chinese government pushed too far, Google realized that the Chinese government was placing unreasonable restrictions on its China venture and, so, decided to stop censoring results on Google.cn. Shortly thereafter, Google decided to leave China, demonstrating the fragility of this type of enforcement.

Country Specific Top-Level Domains
Third, enforcement may be premised on country-code specific top-level domain. In other words, websites that have country specific top-level domains (such as google.fr and google.it) would be deemed to be "located" in specific countries. This location would allow those countries to regulate those websites.

This kind of enforcement is problematic for three reasons: (1) it ignores other top-level domains; (2)it requires international recognition that country-code specific top-level domains are "located" in specific countries; (3) it would be possible to circumvent by moving assets out of the country in which the website is "located."

Essentially, generic top-level domains (and other top-level domains) would be unregulated making them very valuable (since no one country could regulate their contents) unless some kind of universal minimum contacts test could be devised. Further, hosting the website outside of the country and/or moving the assets connected to the website outside the country could allow for an end run around regulation. Enforcing regulation of those websites would require a foreign court to recognize the validity of a domestic court's order, no easy challenge.

The problems with this kind of enforcement was seen when the German courts ruled for Wolfgang Werlé and Manfred Lauber against the Wikimedia Foundation. Although the Wikimedia Foundation, parent company of Wikipedia.org, agreed to remove references to Wolfgang Werlé and Manfred Lauber on its German language site it refused to do so on its English language site. Since the Wikimedia Foundation had no assets in Germany the German government really had no way to enforce the decision, short of convincing another nation's government to do so.

Cyberwar
Fourth, enforcement may be premised on forcing websites to comply. In other words, a nation may launch a sustained cyber attack against a website in order to force compliance. This tactic is a bit underhanded but successfully circumvents the problem of what to do if the government cannot physically seize assets attached to the website and does not have adequate leverage over the website to force compliance.

The problem with this kind of enforcement should be obvious. The website's owners and operations, the nation where the website is actually "located," and sophisticated groups of netizens, such as the Anonymous, may all seek some kind of retaliation. The nature of the retaliation would, obviously,  depend on which parties became involved but could result in some kind of substantial escalation.

In conclusion, without some kind of universal consensus enforcement of the right to be forgotten is problematic. The biggest challenge for those who seek enforcement is the relationship between the internet and  national boundaries. Increased bandwidth and technological globalization has made it very hard for nations to enforce 'rights' and 'duties' on a largely unregulated internet. Even highly regulated portions of the internet, like that behind China's Great Firewall, often see outbreaks of dissent and the government is largely incapable of stopping it. With the capacity of the internet to promulgate the Streisand Effect how the right to be forgotten might be effectively enforced remains to be seen.