In 2012 the European Commission published a proposal for a new regulation that is intended to clarify the new uniform legal framework for the protection of personal data within the European Union. By establishing a "right to be forgotten" for data subjects, the European authorities pretend they will give EU citizens new tools to combat the increasing threat to their right to privacy apparently posed by the internet.

Despite the democratic and social repercussions at stake, this regulation is currently being debated by the European Parliament in relative anonymity, but it is important for citizens to understand the new rules. Indeed, the proposed regulation will likely upset the balance of national laws governing the press in many EU Member States.

Freedom of the press

In democratic countries, freedom of the press is generally only subject to two main restrictions: defamation and breaches of a person's right to privacy. Furthermore, in many European countries, the limitation period for filing a defamation suit is quite short (three months in France, one year in England and Wales, etc). If the injured party fails to bring the appropriate legal action within the limitation period, the publication is deemed to be legitimate and in the public domain. So how is it possible for the proposed new EU regulation on personal data to endanger the cardinal principles of national press laws?

Extending the meaning of personal data

Firstly, personal data law has long since broken out of its original IT file mould and moved into the media. The term "personal data" has a very broad definition, both in the current directive and in the proposed regulation: "any information relating to a data subject". And the data processing to which the legislation refers includes the "disclosure by transmission, dissemination or otherwise making available", provided it is at least partly automated. The Court of Justice of the EU stated in 2003 that processing includes publishing information about a person on a web page. Given the level of automation of the modern printing process, there is no reason to believe that the future regulation will not also apply to the publication of information in the paper edition of a newspaper.

Using these criteria, history is reduced to a collection of personal data, and journalists commenting on the news are simultaneously carrying out multiple instances of processing that would be covered by the new regulation. It follows that posting an article on the internet referring to, for example, the Trotskyist past of a former French prime minister would count as processing personal data. The media are currently permitted to publish this type of information on the internet and to archive these articles, which are simply an example of people exercising their right to freedom of expression. If data subjects are given the right to be forgotten, it is possible that these archives will have to be deleted.

Do remarks count?

The issue at stake here pertains to the questionable right of a person to wield control over remarks made by other people about him or her and to force other people to keep quiet about certain details from his or her past. For supporters of this new right, the idea is to prevent the information available about a given person on online networks from remaining fixed and intangible even though that person may have changed. People should thus be able to control their image as conveyed by the internet to ensure that it is always in line with the changes they have made in their personal lives. This conception of the right to be forgotten is based on two highly objectionable ideas.

The internet threatens civil liberties

The first is that the internet is a threat to civil liberties due to its unlimited capacity to memorise information and to provide access to it. In other words, information is tolerable provided that it remains difficult to access, just as library archives in the past were the realm of scholars. This is an insult to progress and to the knowledge society so beloved of the European Commission in other situations. It goes against the spirit of the decisions handed down by the European Court of Human Rights (ECHR) recognising the importance of internet archiving to the protection of freedom of expression.

Does personal date belong to the data subject?

The second idea is that personal data belongs to the data subject and is connected to that person in such a way that he or she is entitled to have total control over its circulation.  Yet it is evident that as soon as a person makes public declarations, acts publically whether in a political, artistic or professional context, or where that person jeopardises the public interest, his or her words or actions are no longer private: they belong to the public domain and can be debated and reported.

It can only be hoped that the lawmakers will take account of the evident risks that introducing this right to be forgotten will create for freedom of expression and therefore set strict rules for its application. Yet, in its current form, the proposed regulation is far from including the necessary legal protections.

It is essential here that we not lose sight of article 10(2) of the European Convention on Human Rights (the "Convention"), according to which freedom of expression may only be restricted where "necessary in a democratic society", including for the protection of the rights or reputation of others. As the ECHR often recalls, this need must be "convincingly established", regarded as "answering a pressing social need" and "proportionate to the legitimate aim pursued". People cannot cite their right to privacy as grounds for having information removed unless they can also prove that removal is necessary.

The right to erase data

The current version of the regulation proposes to completely reverse this principle. It provides that data subjects will have the right to erase data as part of their right to be forgotten where they object to the processing of that data. This is possible "on grounds relating to their particular situation, at any time […] unless the controller demonstrates compelling legitimate grounds for the processing". Otherwise, the data controller must erase the data without delay "except to the extent that the retention of the personal data is necessary […] for exercising the right of freedom of expression".

These provisions are clearly structured to make the right to erase data the rule, and freedom of expression the exception to that rule, one that is only acceptable if the author of the content in question can establish its necessity. However, the party wanting to restrict freedom of expression should always bear the burden of demonstrating why this is absolutely necessary and not vice versa. Freedom of expression is self-existent and is not conditional on need. It applies to futile or optional information as well as information perceived as making a real contribution to public debate. To reverse these principles is to rob them of all substance.

No legal certainty

An even more serious matter is that although the future regulation is meant to establish a right to be forgotten, the precise grounds for that right are not apparent in the regulation itself. Legal certainty, which is also a fundamental requirement under Article 10(2) of the Convention, is completely lacking from the current draft. The text merely refers to a number of situations in which the "right to be forgotten" might apply, but none are given specific boundaries, and indeed some allow for completely arbitrary interpretations!

According to the draft text, the "right to be forgotten" can be cited as a reason to delete data "which is no longer necessary for the purposes for which it was collected". Yet it is difficult to see what standard the courts might use to determine that an online publication has become obsolete and therefore no longer fulfils its legitimate purpose of informing the public. The online posting of a news article, even an old one, can always be of interest in terms of information access, even years after its original publication. The passage of time alone cannot be used as justification for requiring anonymity.

Generally speaking, the right to be forgotten would also apply when the data processing at issue cannot prove to be "necessary for the purposes of the legitimate interests pursued by a controller" or "where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data". Not only does the text of the current draft regulation leave it to the courts to determine, at their own discretion, whether the interests of the data subject must prevail over those of the data controller, but it does not remotely clarify what type of interests would qualify. The right to be forgotten therefore ultimately seems to be a "hollow" right without any specific content; its purpose is to protect interests that are completely undefined at the present time.

Defamation to come under European rule

The proposal from the European Parliament that the right to be forgotten should prevail over any processing that "may…lead to defamation" is also worth noting. These rules would go much further than what is allowed under national laws– barring not only proven defamation but also the "risk" that it may occur!

This provision would also bring the concept of "defamation" into the scope of Community law, with the Court of Justice bearing responsibility for defining the concept henceforth. Finally, the fate of the brief statutes of limitations in the law of a number of member states in the field of defamation would be determined once and for all: the right to be forgotten would give complainants the means to have "defamatory" texts withdrawn years after their first publication on the Internet, even when it is no longer possible for them to take action on the grounds of defamation itself.

Individual freedoms

In conclusion, the freedom of expression was not given the consideration it deserved within the proposed regulation. The Commission and Parliament are addressing the issue in an excessively complicated, technocratic vein when it would suffice, given the stakes in terms of individual freedom, to reiterate a few plain and simple principles. More exhaustive consideration by EU institutions and Member States will surely be necessary.
 
Sébastien Proust is Of Counsel at the Paris office of Herbert Smith Freehills  [email protected]