Quo Vadis Digital Citizen? Can a person be only partially forgotten?

In normal life, the answer would be no.
Usually, whether we are going to be remembered or forgotten is not something that we could opt for. We can indeed thrive to by our actions or deeds, but the final outcome of this psychological process is up to third persons having a good or bad perception about us.

In May 2014 the Court of Justice of the European Union (‘the ECJ’) has come to a milestone judgment saying that a person has a right to be forgotten. But the context where the person ought to be forgotten is internet. Not the real world. However, real enough to influence the life of a real person. Thus the ECJ tangled the right to privacy, the right to data protection and the right to expression in a digital world. It brought to internet life Directive 95/46, originaly designed to protect private data of persons processed either by automated means (computer data bases) or by non-automated means (traditional paper). The said Directive could not have envisaged the need for the protection of data on internet, since the internet itself was underdeveloped then.

Mr. Mario Costeja González, the complainant in this case, wanted the Google to remove information on the auction of his property which was published in a local newspapers distributed in Catalonia, Spain, 16 years before. The information consisted of 36 words only. It was published on two dates only. However, still after so many time has lapsed, anyone searching through the name of Mr. Gonzáles using Google, would be offered information about the said auction.

No society would benefit from knowing these few words on selling of his property. Nor would third persons. The only benefit, or more properly malafit was done to Mr. Gonzáles. He wished his name not to be connected with an event that existed many years before, that implied no criminal act nor offence nor damages to third persons.

The ECJ has recognised that by saying that the information to be erased is inadequate, irrelevant or no longer relevant, or excessive in relation to the lapse of time. It authorised Mr. Gonzáles, and other Gonzáleses alike to request search engines to erase the data.

However there we come to a problem. The search engine at issue is Google Inc. But it has its subsidiaries in all the European countries, such as google.es, google.fr, google.at, etc. Therefore Google could come to an idea to erase Mr. Gonzales’s name only from its European subsidiaries.

Why?
Because the judgment was issued by the ECJ, which is called the supreme court of the EU. And which formally does not have jurisdiction over USA, Australia or New Zealand.

And why not?
Because it is internet at issue. And internet does not have borders, at least not the classic ones. And because anyone in Europe could access google.es, but at the same time google.com. So if a person was erased from google.es, he still remains at google.com. And he is visible within Europe, at google.com, but also within USA, Australia, New Zealand, etc.

Let’s imagine that the ECJ judgment implies only his erasure from European Google subsidiaries. What could he do to have his name erased from Google.com accessible worldwide? Well, he could initiate the same proceedings before USA court. And Australian court. And New Zealand court. And African court. Actually before all other courts, apart from European which already gave its ruling. Would that be feasible? Justified? Protective of human rights? An answer may already appear to us.

But what is the relation between the real law and cyber law?
Classic legal theories recognise the teritorrial principle in law. With the emerging of international law, the strictly teritorrial approach was a bit modified, by spreading certain features to supranational level. We now face the emerging of a cyber law. In cyber law, uncertain is the teritorry, its control, the area of application. What is not uncertain are the subjects of law. They are still real. Their status is still certain. Therefore the ECJ judgment pointed out that the subjects of the right to erasure are the inhabitants of the EU. The category ‘inhabitants’ is in this case certain.

If we recall the well established case-law of the European Court of Human Rights, it has defined the jurisdiction of a state on a less formal manner. It took into consideration the effective jurisdiction. Not the one which was determined by borders. Nor the one recognised internationally. Therefore the formally Cyprus teritorry could be considered as belonging to Turkey for the purpose of Turkey being respondent party for violations of human rights (see Cyprus v. Turkey, ECtHR judgment of 2001). Such a legal construction enabled the Court to act in an effective manner when dealing with human rights violations which needed a real remedy. A remedy which is effective.

In this case, strictly formally speaking, Google supsidiaries at the European teritorry would be liable. However, can we restrict the information so as to flow only in Europe? Can we determine with certainty that no person in Europe will use the Google.com world url. The answer would be NO. If we have a new media for spreading information potentially violating human rights, we must adjust our legal rules applicable to it. And apparently the praxis.

On this account, the ECJ did make a step further by giving the Directive 95/46 its cyber life, although almost twenty years ago when it was created no such spread of internet was imaginable. It also did make a link of the right to be forgotten to the right to respect for private life under the European Convention on Human Rights, the instrument which already celebrated its 60 years birthday. Such connections make those instruments living together with the growth of society.

Should we then confine ourselves to some old outdated theories? Should we close eyes to real life? The European Court of Human Rights pointed that the right to privacy should not be interpreted restrictively (Amann v. Switzerland, ECtHR judgment of 2000, Rotaru v. Romania, ECtHR judgment of 2000, etc.). Why should we then restrict the application of ECJ judgment to European subsidiaries of Google? Would the purpose of the protection of EU inhabitant be achieved if we act restrictively? If an international principle in dealing with human rights violations is restitutio in integrum, can then a person be ‘in integrum’ forgiven if we allow only for narrow application of ECJ judgment? By answering these questions, we will determine the tommorow’s effect of similar violations. We have to imagine how the tommorow would look like in order to act now. And to act with no constraints that would impair the efficiency of law.

The Hong Kong Deputy High Court Judge, Marlene NG, on the other side of the world, in her judgment of August 2014, in a similar case, has said in concluding remarks to her judgment: ‘…the internet has become a universal medium.  The advantages of having easy access to a rich store of information are many, and they have been widely applauded.  But such benefit comes at a price; any risk of misinformation can spread easily as users forage in the web. The art is to find the comfortable equilibrium in between.’

We therefore have to accept the fact that the law must follow the growth of society, and not walk by it. The law should follow life and each segment of its development.

So the only logical answer to the first question of this text would remain: No, the person cannot be partially forgotten, neither in real life, nor in the cyber world.

Jasna Čošabić, PhD
Jasna Čošabić, PhD
Professor of EU and IT law, GDPR specialist