When is it my turn to be forgotten?: The Evolution of Data Protections in Europe

Add a comment

Introduction


On November 4 1950, the Convention for the Protection of Human Rights and Fundamental Freedoms was signed by the twelve (12) members states. Starting with the Universal Declaration of Human Rights as a basis, the European Convention exceeded the scope and potential of the United Nations as they also included a court allowing the appeal of nation states, associations, and private individuals when one of rights had been breeched.1 While the European Convention established the protection of many rights, the one under my focus today can be found in Article 8. As originally written:

  • Everyone has the right to respect for his private and family life, his home and his correspondence
  • There shall be no interference by a public authority with the exercise of this right such as in the accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others

How has this article, written nearly 75 years ago and well in advance of our current digital landscape, served to buoy up the strongest and most advanced protections against digital rights? Unlike the current originalism bent currently running amuck in our houses of justice and legislation in the United States of America, the European Convention and the European Court of Human Rights adheres to the notion “that the Convention is a living instrument which, as the Commission rightly stressed, must be interpreted in the light of present-day conditions” as first enumerated in Tyer v. The United Kingdom (1978). Recognizing the need to interpret law exists beyond the confines of the European Court of Human Rights for France, Germany, and the United Kingdom approach the interpretation of historical law(s) with similar perspectives.2 The goal for the European System resides centrally on an understanding of the need to protect actual human beings in such a way with “not rights that are theoretical or illusory but rights that are practical and effective” thereby requiring a contemporary understanding of legal frameworks.3

History of Data Protection in Europe

You can see this influence in the Charter of Fundamental Rights of the European Union from 2000. In this relatively short document, the drafters outlined specific categories to be protected including dignity, freedoms, equality, solidarity, citizens’ rights, and justice. Under the heading of justice, articles 7 and 8 provide for the following:

  • Article7: Respect for Private and Family Life
    • Everyone has the right to respect for his or her private and family life, home and communications
  • Article 8: Protection of Personal Data
    1. Everyone has the right to the protection of personal data concerning him or her.
    2. Such data must be processed fairly for specific purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
    3. Compliance with these rules shall be subject to control by an independent authority
Article 8 in the Charter of Fundamental Rights, however, was not the first wide-reaching attempt in Europe to protect data as the Council of Europe passed the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. Approximately 44 years ago, the convention set forth reasonable, and hauntingly modern, protections including a requirement that data be obtained in a fair, lawful, and not excessive manner, be kept accurate and timely, only stored for as long as needed at the time of collection, and to not collect information not relevant to the original inquiry. The Convention for the Protection of Individuals with Regards to Automatic Processing of Personal Data provided additional protections which include the right:

  1. To establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
  2. To obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
  3. To obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this Convention;
  4. To have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.
The aforementioned rights created a interwoven set of real-life safeguards for individuals and their data. In tandem, both of the articles point directly to the concept of “the right to be forgotten” which Viviane Reding championed during her time as the European Commissioner for Justice, Fundamental Rights, and Citizenship. In 2012, the EU reformed the 1995 Data Protection Directive including protections for individuals such as increased data portability and a “right to be forgotten” to reduce online data risks by permitting individuals “to delete their data if there are no legitimate grounds for retaining it.”4 From an American legal perspective, the right to be forgotten directly contradicts our current understanding of the First Amendment.

Once material has been made part of public records, for example, as in the case of Cox Broadcasting Corp. v. Cohn, Americans no longer have a right to privacy. In this case, Cohn’s 17 year-old daughter was raped and murdered. One of the six defendants decided to not accept a plea deal; therefore, the victim’s name was entered into the court proceedings and was made part of a broadcast. In the majority opinion Justice White wrote, “By placing the information in the public domain on official court records, the State must be presumed to have concluded that the public interest was thereby being served…The freedom of the press to publish that information appears to us to be of critical importance to our type of government, in which the citizenry is the final judge of the proper conduct of public business.” The Google Spain decision highlights the antithetical legal thinking present in European Jurisprudence. Mario Costeja Conzález with the Spanish Data Protection Authority sued Google Spain as link to a 1998 announcement in a newspaper concerning the sale of his real estate to cover social security debts he had incurred. The search engines, according to the Court of Justice of the European Union are “data controllers,” subject to data privacy laws even when the information had already been made public.5

Conclusion
As evidenced in the paragraphs above, protections for individual users and their data in Europe have been evolving and attempting to meet the growing challenges to maintain not only the ownership of their data but their privacy as well. The United States, however, took a very different course. Spurned on for decades by Frederick Turner’s paper given at the 1893 World’s Fair

Thus American development has exhibited not merely advance along a single line, but a return to primitive conditions on a continually advancing frontier line, and a new development for that area. American social development has been continually beginning over again on the frontier. This perennial rebirth, this fluidity of American life, this expansion westward with its new opportunities, its continuous touch with the simplicity of primitive society, furnish the forces dominating American character.

When we jump forward a century and then consider Lawrence Lessig’s discussion of 1990, we are presented with another lawless frontier open to American exceptionalism. Lessig described the Internet seemed “to promise a kind of society that real space would never allow – freedom without anarchy, control without government, consensus without power.”6 The current state of the Internet, with a smattering of protections and laws that may or may not be respected, tells a very different story.
Endnotes:
  1. William K. Coblentz & Robert S. Warshaw, “European Convention for the Protection of Human Rights and Fundamental Freedoms,” California Law Review 44, no. 1(March 1956): 94 – 104.
  2. Eirik Bjorge, “The Convention as a Living Instrument Rotted in the Past, Looking to the Future,” Human Rights Law Review, 36, no. 7 – 12(2017): 243-255.
  3. Jean-François Renucci, Introduction to the European Convention on Human Rights: The Rights Guaranteed and the Protection Mechanism, (Strasbourg: Council of Europe Publishing, 2005): 6.
  4. “Commission Proposes a Comprehensive Reform of Data Protection Rules to Increase Users’ Control of Their Data and to Cut Costs for Businesses,” European Commission, January 24, 2012, https://ec.europa.eu/commission/presscorner/detail/en/ip_12_46.
  5. Stefan Kulk & Frederik Zuiderveen Borgesius, “Privacy, Freedom of Expression, and the Right to be Forgotten in Europe,” in The Cambridge Handbook of Consumer Privacy (Cambridge, UK: Cambridge University Press, 2018): 310 -311.
  6. Lawrence Lessig, Code: Version 2.0, (New York: Basic Books, A Member of the Perseus Books Group, 2006): 2.

Leave a comment