October 2016

DEFINING THE “RIGHT TO BE FORGOTTEN”

By:
ZEESHAN MANZOOR
Assistant Sessions Judge
Karachi West

1. Introduction. Not much has been discussed about the ‘Right to be forgotten’ so far yet it carries significance in the recent legal development in the international human rights law. It has resulted from desire of individuals that their past events should no longer be open to traceability and therefore, should be deleted from internet search engines; such events might have been recorded through photographs, videos, documents or pieces of information, and, the claim under umbrella of ‘Right to be forgotten’ requires the deletion of such sort of data from internet search engines, such as Google, so that those data could not be found by search engines.

2. Defining the term. The exact meaning of the ‘Right to be forgotten’ has yet not been settled. However, it has generally been defined as ‘right to silence on past events that are no longer occurring’ and comes out of the desire that one should not be reminded or judged for what mistakes he had committed and or had been punished for in the past.

3. Origin. The ‘right to be forgotten’ is of quite recent origin and has invited great attention in recent years. The concept is not only new but also a complex one. To LilanMitrou and Maria Karyda, this right seems to have its origin in French law which provides a “Right to oblivion” and in Italian law “that conceived mainly and primarily as the right of a convicted criminal who has served her sentence not to be confronted with information concerning her criminal.”[1]

4. Background. The European Union (EU) formally recognized right to privacy as a fundamental right after the Second World War. It was the enactment of the European Convention on Human Rights (ECHR), and, the adoption of the Universal Declaration of Human Rights (UDHR) that prompted EU member states to make the relevant legislation. The European Union adopted the European Data Protection Directives (Directives 95/46/EC) in 1995. Such directives were meant to regulate the processing of personal data.Article 6(1)(e) of the Directives required the Member States to provide that personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. These directives have been taken as component of human rights law.Article 12 of the Directives pertaining to ‘right of access’ provided a legal base to internet protection for individuals.

The Lisbon Treaty (2007) under Article 7 of chapter III protected privacy as a fundamental right of the EU citizens and acknowledged the right to protection of personal data while declaring that such data must be processed for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law, as under Article 8. Again, the EU charter of Fundamental Rights (EUCFR) provided for the right to the protection of personal data as a fundamental right under Article 8.

In 2012, the European Commission enacted the proposed Data Protection Regulation (DPR) with objective of harmonizing the differences between European countries, and, instituted a “comprehensive form of data protection rules”. The draft superseded the Directives of 1995 and therein specific inclusion of the ‘Right to be forgotten and to erasure’ was found in Article 17.

5. Recognition. The ‘Right to be forgotten’ got its formal recognition in the ruling of Google Spain SL. Google Inc. V. Agencia Espanola de Protection de Datos (AEPD) case C-131/12 wherein the Court of Justice of the European Union (CJEU) stated “the need to assess if the interested person has the right to request that specific information related to him/herself should not be connected any longer to his/her name as resulting from a web search result based on the name itself.”[2] Here is what went on in the case.

In 1998, Mr. Mario Costeja Gonzalez, a Spanish citizen being unable to pay his social security debts, had to face auction of his house. As per Spanish law, every such auction was required to be advertised through some local newspaper; in this case, it was La Vanguardia. The newspaper published an auction notice to recover his debts wherein his name was mentioned. The article was placed online together with other articles of the newspaper archives and was easily searchable on internet search engines.In 2010, a complaint was lodged against the Spanish newspaper La Vanguardia with the national Data Protection Agency and against Google Spain Inc. by him. Thus, he complained that his rights to privacy were infringed by an auction notice of his repossessed home showing on Google’s search results. He added that it was so because the said proceedings referred to had already been resolved a number of years back and their reference was irrelevant in current state of affairs. He requested to require the newspaper delete the record in a way that it would no longer appear either by removing or by altering the pages in question, and, to get the same deleted from search engines by directing the Google Spain or Google Inc. to do so.

The Spanish Court referred the case to the Court of Justice of the European Union with a couple of questions: whether the EU’s 1995 Data Protection Directive applied to search engines such as Google, whether those Directives applied to Google Spain given that the company’s data processing server was in the United States and whether an individual was entitled to place a request for removal of his or her personal data from accessibility via search engine.

The EU gave it’s its landmark judgment on May 13, 2014. It held that the EU rules apply to search engines even though the physical server of a company processing data is located outside Europe provided that they have a branch or subsidiary in a Member State which promotes the selling of advertising space offered by the search engine. It further held that EU data protection law applies to search engines for the reason that search engines are controllers of personal data and Google was not obliged to escape its responsibilities when handling personal data by taking plea that it is a search engine. It furthermore held that individuals had right under certain conditions to ask search engines to remove links with personal information about them in cases where the information is “inaccurate, inadequate, irrelevant or excessive”.[3]

6. Procedure. In compliance of the EU’s ruling on ‘Right to be forgotten’ in May 2014, the Google created a new form allowing the taking down of unwanted Uniform Resource Locators (URLs) which could be filled through the search engine’s website. It would be allowable to the citizens of 28 EU member countries and so also would provide support for non-EU member countries: Iceland, Liechtenstein, Norway and Switzerland. The form requires the applicant to identify their country of residence, a photo ID of the individual for whom the request is being placed, to list the name of what results are wished to be removed for, to list one or more URLs they want removed and the explanation as to why such URL is desired to be dropped: the explanation has to be in terms of ruling from EU showing how the desired URL goes to be “irrelevant, outdated, or otherwise inappropriate or excessive” as goes the wording in the said ruling. After the form is submitted, Google sends an email to applicant confirming that the request has been received. Requests are then reviewed on case-to-case basis by the Google Advisory Committee in terms of the information or URL being either irrelevant, outdated, or otherwise inappropriate or excessive.[4] The decision is then made accordingly.

7. Subsequent development. The EU ruling furthered the development of the right as part of law in some other countries. Few instances are given here. In September 2015, the French data protection authority required Google to scrub search results globally across all versions of its website, not just European domain.[5]In Canada, the Supreme Court granted Google leave to appeal the ruling in 2016 in one case Equustek Solutions Inc. v. Google Inc., 2015 BCCA 265 which required Google, as a third party to block search results operated by the defendant on its Canadian search engine, google.ca; the question whether judges have legal power to force Google outside their borders is yet to be answered.[6]In Russia, the ‘right to be forgotten’ was given force of law on the first day of the current year, 2016 whereby it enabled the web surfers to file a personal request to have deleted the links to obsolete information pertaining to them.[7]This year also, Tiziana Cantone, a 31 year old Italian woman who had appeared in a sex video clip which went viral across social media brought mockery for her as the footage was viewed by almost a million internet users, won her ‘right to be forgotten’ after a long court battle; and, the Court ordered the video to be removed from various sites and search engines, including facebook. It is another matter that she lost her life in suicide soon after the Court decision as she was also ordered to pay 20,000 euros as in legal costs – which several Italian media outlets considered to be her final insult.[8]In Japan, a Court in Saitama, gave in current year, recognition to the ‘right to be forgotten’ in a case wherein the appellant demanded Google Inc. to remove three-year old news reports of his arrest in connection to child prostitution and pornography.[9] And in India this year, the Delhi High Court admitted a plea filed by a Delhi Banker, who wished his personal details concerning his years back already settled marital dispute, to be removed from online searches including law website named Indian Kanoon;[10] the matter is still pending before the said Court.

8. Google response.According to one version, Google had received 386,038 “right to be forgotten” removal requests by February 2016 since the EU ruling and had accepted approximately 42% of them.[11]

9. Case of Pakistan.There are no clear cut laws concerning ‘right to be forgotten’ in Pakistan.The latest law concerned; The Prevention of Electronic Crimes Act, 2016; is a voluminous one. It contains seven chapters and fifty five sections. It addresses several issues / offences such as unauthorized access to information system or data, unauthorized copying or interference with information or data, cyber terrorism, hate speech, electronic fraud or forgery, offences against modesty of a natural person, child pornography, cyber stalking, and confidentiality of information etc. This act addresses offences and not the ‘right to be forgotten.’

The Electronic Transaction Ordinance, 2002 was published in the gazette on September 11, 2002. It contains as many as nine chapters, forty five sections and a schedule yet it does not cover ‘right to be forgotten’. A bill called ‘Electronic Crimes Act, 2004’, carrying thirty five sections,was enacted in the year 2004 with a commitment to cover almost all offences being committed through electronic media as apparent from its preamble but this also does not touch the ‘right to be forgotten’.

However, the ‘right to privacy’ which presumably is correlated to the concept of ‘right to be forgotten’ is protected under Article 14 of the constitution of Pakistan, 1973 which makes the dignity of man, and subject to law, the privacy of home, inviolable.

The Electronic Transaction Ordinance, 2002 provides under section 36 that if any person who gains or attempts to gain access to any information system with or without intent to acquire the information contained therein or to gain knowledge of such information, whether or not he is aware of the nature or contents of such information, when he is not authorised to gain access, as aforesaid, shall be guilty of an offence under this Ordinance punishable with either description of a term not exceeding seven years, or fine which may extend to one million rupees, or with both. And the section 38 of the Ordinance makes this offence non-bailable, compoundable and cognizable while section 39 of the Ordinance makes it triable by the Court of Sessions.

The ‘Electronic Crimes Act, 2004 provides under section 4 that unauthorized access to electronic system with intent to infringe privacy comes within ambit of ‘criminal access’ which is punishable for a term extending to two years or with fine not exceeding three thousand rupees or with both. The Act makes it triable by the Court of Sessions, as under section 25.

The literal meaning of the word ‘privacy’ depicts, “absence or avoidance of publicity or display; the state or condition from being withdrawn from the society of others, or from public interest; seclusion.”[12] The phrase ‘Right to privacy’ means, “the right to be let alone; the right of a person to be free from unwarranted publicity; and the right to live without interference by the public in matters with which the public is not necessarily concerned.”[13] Louis Brandeis explains ‘Right to privacy’,“the right most valued by a civilized man.”[14]

It is this ‘right of privacy’ that is actually to be protected and preserved and when this right is infringed, there comes space for the ‘right to be forgotten’ in general parlance.

With not the slightest hesitation in my mind, I find myself in conviction that Pakistan would sooner or later need to consider and legally cover this ‘right to be forgotten’. I find the answer in affirmative to the question about whether such situations as to seeking right to be forgotten could ever arise in Pakistan. After all, what would prevent an aggrieved from doing so? If in India, why not in Pakistan? A face book profile, a blog, a list of preferences on YouTube have become indispensable parts of internet users’ daily lives and, often become detrimental to the interests of people focused on social media. For instance, if Italy has an example of Tiziana Cantone, a 31 year old woman who faced social media hazards then Pakistan have epitome of a 26 year old female FauziaAzeem (more often known as Qandeel Baloch)who was allegedly murdered by her brother in the spate of ‘honor killing’ for her photos and videos on face book.[15]Needless to say, the present Pakistani youth is confronted with this modern age electronic quagmire; many young boys and girls are trapped by their peers and the immodest video clips go viral often ruining their family lives.

And how about the concept of rehabilitation of the convicted accused; whether the fate of the reformed and rehabilitated offenders should always remain challenging for them in their lives even though they had repented their past and had committed to become responsible citizens of the countryand whether they should continue for all times to remain disadvantaged group of society in various walks of life? And how would be the concepts of probation and parole given treatment? This is all food for thought.

Again should this not be a matter of public interest,being pertaining to public at large or at least in which a substantial section of population is interested, coming within ambit of Article 199 and 184 of the Constitution of Pakistan, 1973 is a question left to the leading legal fraternity of the country while having a glimpse over what actually Public Interest Litigation is.

Public Interest Litigation is a valued form of litigation to protect the fundamental, human, social and economic rights. It comes from American jurisprudence where it was designed with objective to provide legal representation to the groups and interests that are unrepresented, and it’s need was an outcome of the situation when ordinary market place for legal services failed to provide such services to significant segments of American population.[16]

Black’s Law Dictionary defines ‘Public interest’ as the ‘general welfare of the public that warrants recognition and protection; something in which the public as a whole has a stake. It defines ‘Public Interest Litigation’ as a legal action initiated in a Court of law for the enforcement of public interest in which public or class of the community have pecuniary interest by which their legal rights or liabilities are affected.

10. Criticism on the ‘Right to be forgotten’.The concept of ‘right to be forgotten’ is criticized on the plea that it would restrict the ‘right to freedom of speech’ and ‘right to information’. The Europe’s final draft of General Data Protection Regulation, 2016 says that data protection must be balanced with free expression and that request to that effect can be denied on free expression grounds (Article 13, R. 3a) but it provides no guidance on what those free expression grounds are.[17]

Rights to freedom of speech and information are declared fundamental rights in many countries. The first amendment to the American constitution prohibited making any law abridging of freedom of speech. The constitution of Pakistan 1973, protects freedom of speech and expression under article 19 and guards access to information in all matters of public importance subject to regulation and reasonable restrictions by law under Article 19-A.The balance between the ‘right to be forgotten’ and ‘right to information or speech’ has yet to be maintained.

Then, there is an argument that by invoking ‘right to be forgotten’, the Google would be restrained from producing natural results.

Then, one may also argue as to those pieces of information becoming part of record and history which are source of education and historic research could not be deleted for those would infringe rights of general public to information.

11. Conclusion. Advancement in technology always poses new challenges and threats. The internet is a world of technological environment in itself. The records that automatically form part of internet or search engines find their permanence in the data collection of the engines. The matters that find place in newspapers, magazines, law related documents, other social media channels such as by use of YouTub, twitter, facebook, whatsapp and viber become prey to abuse of the technology and often end up in irreparable losses to many. It is inarguable that it has opened door to anti-social and criminal behavior in ways that could never be imagined before as the technology itself offers new and highly sophisticated ways towards infringement of inherent rights of man such as that of privacy. This rapid development of information technology in this world of change brings challenges to the legal systems across the globe.

And one of the challenges that have recently moved the nations is that of evolution of ‘right to be forgotten’. However, it does not come as a surprise. It in fact is a reaction to new challenges posed to maintenance of balance between the right to information and speech, since content available on search engines becomes an easy prey to those who are knowledgeable and use it either for illegal or unlawful purposes.

The ‘right to be forgotten’ is challenge of the day. The civilized nations are working over it. Internet search engines are being moved in compliance of the celebrated EU ruling of 2014. The scope is being widened day by day. Awareness has evolved amongst citizens of the neighboring countries where the Delhi High Court had been moved to take up the matter. Repercussions of social media abuse are being witnessed here in Pakistan as well. So, the time is not too far when it will move the people of this country to seek such right.

Lastly, it is still debatable as to whether the ‘right to be forgotten’ has raised to the status of international human right. The reason is quite simple. The balance between ‘right to be forgotten’ and the already cherished rights of freedom of information and speech has yet to be established. A lot has to be done and rules are yet to be finalized as to in what situations this right may be considered and as to what it’s parameters should be. The definition of the EU ruling terms “irrelevant, outdated, or otherwise inappropriate or excessive” is yet to be established, consented upon and interpreted by the legal experts.

[1]. Mitrou, Lilian; Karyda, Maria, “EU’s Data Protection Reform and the right to be forgotten – A legal response to a technological challenge?” available at file:///C:/Users/%60e65y/Downloads/MITROU-KARYDA-Right_to_be_forgotten-FINAL.pdf, as visited on September 23, 2016.

[2]. Alberto Lama, The “right to be forgotten”: The first Italian decision, page available on http://warwicklegal.com/news/68/the-right-to-be-forgotten-the-first-italian-decision, visited on September 23, 2016.

[3]. European Commission, Factsheet on the “Right to be Forgotten: ruling (C-131,12), available on http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf, as visited on September 23, 2016

[4]. Sullivan Danny, How Google’s New “Right to be forgotten” Form works: An Explainer; at http://searchengineland.com/google-right-to-be-forgotten-form-192837; visited on September 25, 2016.

[5]. Gibbs Samuel and Agencies, Google to extend ‘right to be forgotten’ to all its domains accessed in EU; web: https://www.theguardian.com/technology/2016/feb/11/google-extend-right-to-be-forgotten-googlecom; visited on September 25, 2016.

[6]. GollinPhilipe, The “Right to be forgotten” and its impact on social media discovery, web: https://www.commonwealthlegal.com/blog/the-right-to-be-forgotten-and-its-impact-on-social-media-discovery; visited on September 25, 2016.

[7]. ‘Russia’s ‘right to be forgotten’ comes into effect’; web https://www.rt.com/politics/327681-russia-internet-delete-personal/; visited on September 23, 2016.

[11]. Gibbs Samuel and Agencies, Google to extend ‘right to be forgotten’ to all its domains accessed in EU; web: https://www.theguardian.com/technology/2016/feb/11/google-extend-right-to-be-forgotten-googlecom; visited on September 25, 2016.

[12]. The New Oxford Dictionary (Vol. 2, 1993).

[13]. Black’s Law Dictionary, 6th Ed., 1990.

[14]. Olmstead v. United States, (1928) 277 US 438, 478:72 Law Ed 944.

[15]. Gabol Imran, Subhani Taser, Qandeel Baloch murdered by her brother in Multan:Police, Dawn News, http://www.dawn.com/news/1271213; visited on September 26, 2016.

[16]. Massey, I.P., Dr., Administrative Law, Eastern Book Company Lucknow, ISBN: 81-7012-559-6, pg.277.

[17]. Keller, Daphne, THE FINAL DRAFT OF EUROPE’S “RIGHT TO BE FORGOTTEN LAW”; Webhttp://cyberlaw.stanford.edu/blog/2015/12/final-draft-europes-right-be-forgotten-law; visited on September 26, 2016.