Peter Waldkirch is a second year LL.B. student at the University of Ottawa.
The BBC recently reported on a proposed law in France about creating an online “right to forget” (Internet legislation would seem to be a hot issue in France; recent news includes the October 2009 acceptance of the graduated-response “3-strikes” HADOPI 2, and President Sarkozy has been talking about a “Google tax”). There doesn't seem to be much concrete information available about the proposed law yet, but the BBC article suggests that the “right-to-forget would force online and mobile firms to dispose of e-mails and text messages after an agreed length of time or on the request of the individual concerned.” As with many attempts to regulate content on the Internet, the first question that comes to mind is the practical enforceability of any such rule – John Gilmore famously said that “The Net interprets censorship as damage and routes around it”, and there's plenty of evidence to suggest that statement still has a great deal of truth. The proposed law also raises interesting questions about how societies and nations are struggling to come to grips with a digital world in which vast amounts of personal data are collected -- and never forgotten.
The proposed French law addresses real concerns that the Internet – which, unlike individuals or communities, never forgets – poses a threat to users who may find themselves struggling with the perpetual online presence of their past actions. The BBC article quotes Professor Frau-Meigs of the Sorbonne, who observes that “People and young people need to be protected by the State so that there is fairness in the way this protection is established”. Canada's Privacy Commissioner, Jennifer Stoddard, has also noted that young people in particular are perhaps ill-equipped to fully appreciate the consequences of their online behaviour and are at risk of having their Internet presence haunt them in their future lives (I wrote about the Office of the Privacy Commissioner's last annual report here). It's easy to find stories about people being harmed by the persistence of online data. In BC, for example, a provincial NDP candidate was forced to withdraw after some of his Facebook photos became public. Here in Ottawa, a local grocery chain fired several employees over online discussions. For many more examples, just do a search for “Facebook fired” or getting “dooced” (named after popular blogger Heather Armstrong, aka dooce, who was fired for comments made on her blog).
I think it's important to keep in mind that examples like these are really just the very tip of the iceberg. Most people today have been online for ten or fifteen years at the most (Mosaic, often cited as the first web browser, was released in 1993), and the ubiquity of social networking is more recent than even that. What will a discussion like this sound like in another ten or twenty years, when there will be a generation of adults whose entire lives were documented online?
Within the European context a law of the sort proposed by France is not totally novel. For example, Germany's “right to personality”, which allows, amongst other things, for released criminals to prevent the publication of their name in association with the crime for which they were convicted, forms the basis for a current lawsuit against Wikipedia (the NY Times writes about the case here; an examination of the German constitutional basis of this law can be found in: Paul Schwartz, “The Computer in German and American Constitutional Law: Towards an American Right of Informational Self-Determination” (1989) 37 American Journal of Comparative Law 675 – sorry, no publicly available link).
While the Internet may route around censorship, I think it is also clear by now that this doesn't mean that laws are irrelevant to the Internet. Although legislation of the sort contemplated by France likely cannot do anything to prevent someone from saving a copy of someone else's embarrassing photograph and spreading it themselves, it could certainly affect the privacy and data-retention policies of larger publications. Returning to the German example discussed above, for example, there is little that can be done about people spreading the convicted murderer's name in e-mails or instant messages, but publication of the name in major media can certainly be stopped.
While the reasons for the perceived need for laws regulating online memory may be clear enough, care will be needed in drafting any such legislation to prevent overly invasive protectionary measures. Evgeny Morozov observes that there is already an established industry in Search Engine Optimization (SEO), and one of their services is “burying” information a client may want forgotten so that it only turns up deep in any search results. In his article Morozov observes that one such company, Reputation Squad, is quoted in the BBC article, and that laws such as that proposed by France could end up effectively subsidizing their business. I would further add that laws such as this could become weapons in the arsenal of large organizations to stifle criticism. The BBC article quotes another SEO expert who describes how his company deals with “negative buzz” from bloggers: “If they don't instantly remove the litigious items, and there's always a hardcore who refuse to budge, then we have to, shall we say, insist a little harder”. If any “right to forget” legislation bleeds over into the territory of defamation law, it could pose a threat to online free speech.
Additionally, I think the proposed French law also raises some very interesting questions about the relationship between privacy, memory, and identity – and how we, as societies and governments, are grappling with new technological realities. Here I am deeply indebted to Professor Ian Kerr. For example, in an article written with Professor Jane Bailey, “Seizing Control? The Experience of Capture Experiments of Ringley & Mann” (available from Kerr's website here), the authors discuss the idea of CARPE technology – Continuous Archival and Retrieval of Personal Experiences. Technologist Steve Mann has given life to his idea of inverse surveillance or “sousveillance” through his Eyetap technology – devices which record absolutely everything he sees. Furthermore, memory – of both the individual and the collective – is a central means through which we imagine ourselves and our place in society. Privacy, memory, and identity are all deeply linked, and the persistence of digital data challenges these deeply held relationships. The proposed French law can be seen as an effort to grapple with these changes. (For those interested in this sort of angle, I would highly recommend Lessons from the Identity Trail, an interdisciplinary approach to privacy law led by Ian Kerr. The book is available under a Creative Commons license and can be downloaded from the link.)
While CARPE-like technology represents an extreme end of the information-gathering spectrum, it is clear enough that more and more of our personal information is ending up online, often stored somewhere in the cloud. Left purely to technological and market forces, this trend is unlikely to reverse itself. In this context, battles over who has the right to hit the delete key will undoubtedly become more fierce.