By Jane Wachira
In 2016 during the interviews for Chief justice, one of the applicants, Prof Makau Mutua, was hard pressed to explain a tweet from 2013 in which he vowed never to recognise Uhuru Kenyatta as president. The tweet, which was made in 2013, read, “I CAN’T and WON’T recognize Uhuru Kenyatta as President…” Evidence of the said tweet was pulled from his twitter account and was a key subject of his interview.
Political figures, celebrities and ordinary persons have had their skeletons from ages ago unearthed from the depths of the Internet. Secrets and misdeeds of the past resurface to haunt their current peaceful and different lives, threatening to ruin their now good reputations. Such has been brought up in interviews and during vetting of persons for the purpose of holding public office. Despite the phrase “the internet never forgets”, modern jurisprudence seems to be gearing towards rebutting this through the introduction of a right to be forgotten.
The right to erasure
The right to be forgotten, also known as the right to erasure, has the broad principle that an individual has a right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
Individuals have a right to have personal data erased and to prevent processing in specific circumstances, including: where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed; when the individual withdraws consent; when the individual objects to the processing, and there is no overriding legitimate interest for continuing the processing; the personal data was unlawfully processed; the personal data has to be erased in order to comply with a legal obligation; and the personal data is processed in relation to the offer of information society services to a child.
One can refuse to comply with a request for erasure where the personal data is processed for the following reasons: to exercise the right of freedom of expression and information; to comply with a legal obligation for the performance of a public interest task or exercise of official authority; for public health purposes in the public interest; archiving purposes in the public interest, scientific research, historical research or statistical purposes; or the exercise or defence of legal claims.
The Google Spain decision
The right to be forgotten was introduced in the landmark case of Google Spain SL, Google Inc. vs. Agencia Española de Protección de Datos, Mario Costeja González (2014) – famously known as the Google Spain judgment – at the Court of Justice of the European Union (CJEU). A Spaniard named Mario Costeja Gonzalez had hit financial difficulties. To solve them, he put up a property of his for auction – the details of which were covered in a newspaper, which subsequently went online. The auction happened in 1998, and with those troubles now behind him, Mr Gonzalez was keen to move on.
But there was a problem: whenever one searched for his name, news about the auction still featured prominently. He argued that this continued to damage his reputation, and ought to have been removed from Google’s search results. The Luxembourg-based Court of Justice of the European Union agreed with him, and, in doing so, set a major precedent over what is now referred to as the “right to be forgotten”.
The EU court made reference to the Right to be forgotten, the rules today (1995 Directive), and the rules tomorrow (proposed data protection regulation). The 1995 Data Protection Directive, (on which the ruling was based) in Article 12 already included the principle underpinning the right to be forgotten. A person could ask for personal data to be deleted once that data is no longer necessary.
The court also made mention that the proposed Data Protection Regulation was about much more than the right to be forgotten. It found it a fundamental modernisation of Europe’s data protection rules, establishing a number of new rights for citizens of which the right to be forgotten was only one (data portability, data breach notifications, for instance), creating a single market for data in the European Union and streamlining cooperation between the member States’ regulations.
In recognising that the right to be forgotten exists, the Court of Justice commented that the right to be forgotten would be an empty shell if EU data protection rules were not to apply to non-European companies and to search engines. The proposed data protection regulation, for the first time, would leave no legal doubt that no matter where the physical server of a company processing data was located, non-European companies, when offering services to European consumers, were bound to apply European rules.
To make the right to be forgotten more effective for individuals, the Commission also proposed reversing the burden of proof: it is for the company – and not the individual – to prove that the data cannot be deleted because it is still needed or is still relevant; and lastly, that the proposed Data Protection Regulation creates an obligation for a controller who has made the personal data public to take “reasonable steps” to inform third parties of the fact the individual wants the data to be deleted. The European Parliament went even further to include, in its compromise text, an obligation for the controller to ensure an erasure of this data. It added that individuals have the right to erasure where a court or regulatory authority based in the Union has ruled as final and absolute that the data concerned must be erased.
Following the decision, the European parliament voted to include in its legislation at Article 17, “the right to erasure,” which reads, “The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, and to obtain from third parties the erasure of any links to, or copy or replication of that data, where one of the following grounds applies: where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed; when the individual withdraws consent; when the individual objects to the processing and there is no overriding legitimate interest for continuing the processing; the personal data was unlawfully processed; the personal data has to be erased in order to comply with a legal obligation.”
The Manni case
However, the Google Spain case did not resolve everything. In 2015, the Italian Supreme Court asked the CJEU for a preliminary ruling on questions regarding the right to be forgotten. The business of Salvatore Manni went bankrupt in 1992, and this fact was included on the relevant company’s register, managed by defendant, allegedly causing plaintiff damages. The latter, requested the defendant to render his name anonymous or restrict access to the register. The Italian Court was essentially wondering whether information legally consigned to and made public by the defendant, could be erased, anonymised or access-restricted after a certain time. Also at stake was the question of whether Article 6(1) (e) of the Data Protection Directive supersedes European and national company law requirements regarding notice on the company’s register.
In this case, the CJEU was asked to assess the obligations of the original publisher of the information, unlike in Google Spain. In addition, in the Manni case, the original source of the information is required by law to publish such information. Furthermore, the CJEU was only asked whether the source can be required to make data “less accessible,” not whether the data must be removed entirely, which appeared like a right to obscurity.
The right to be forgotten has been identified to be in harmony with the “right to privacy” while being conflict with the “right to know”, “right to access information” and “freedom of the media”. In the Google Spain decision, the European Court of Justice ruled that the European citizens have a right to request that commercial search firms, such as Google, which gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant. The Court did not say newspapers should remove articles.
The Court also found that the fundamental right to privacy is greater than the economic interest of the commercial firm and, in some circumstances, the public interest in access to information. It (The Court) further affirmed the judgment of the Spanish Data Protection Agency, which upheld press freedoms and rejected a request to have an article concerning personal bankruptcy removed from the web site of a press organisation.
African nations have also enacted omnibus data protection legislation providing a right to deletion or, at a minimum, a right to correction. The Tunisian Data Protection Act requires erasure (or destruction) of data at the end of the specified or authorised retention period (or of such period mandated by specific laws), or when their purpose for collection has been achieved, or where no longer necessary for the activity of the data controller.
In addition, the right to deletion, in case of data being inaccurate, ambiguous, or where their processing is unlawful, exists within the concept of right of access. South Africa’s Protection of Personal Information Act (PPI Act) provides that a data subject may request deletion or correction of personal information that is “inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully,” or request destruction or deletion of personal information that the responsible party is no longer authorised to retain under Section 14 of the PPI Act. Kenya, so far, has the Data Protection Bill, which is yet to become law.
Today, the right to be forgotten is used to represent a multitude of rights, and this fact has caused difficulties in interpretation, analysis, and comprehension of such rights. These rights have become of utmost importance due to the increased risks to the privacy of individuals on the Internet, where social media, blogs, and other outlets have entered into common use as part of human expression. Search engines, as Internet intermediaries, have been enrolled to assist in the attempt to regulate the internet, and the rights falling under the moniker of the “right to be forgotten,” without truly knowing the extent of the related rights.
Thus, the international community ought to come up with guidelines for adjudication of the right to be forgotten and to include the same in covenants that can be ratified by party states. ^
Email your news TIPS to Editor@nairobilawmonthly.com, and to advertise with us, call +254715061658 anytime of the day
