Showing posts with label right to be forgotten. Show all posts
Showing posts with label right to be forgotten. Show all posts

Saturday, November 9, 2019

Radiolab ponders journalists who would undo what they wrought

Radiolab tackled the "right to be forgotten," U.S. style, back in August, and I missed it.  Hat tip at On the Media, which just revived the excellent segment.  Here is the summary and audio.

In an online world, that story about you lives forever. The tipsy photograph of you at the college football game? It’s up there. That news article about the political rally you were marching at? It’s up there. A DUI? That’s there, too. But what if ... it wasn’t.
In Cleveland, Ohio, a group of journalists are trying out an experiment that has the potential to turn things upside down: they are unpublishing content they’ve already published. Photographs, names, entire articles. Every month or so, they get together to decide what content stays, and what content goes. On today’s episode, reporter Molly Webster goes inside the room where the decisions are being made, listening case-by-case as editors decide who, or what, gets to be deleted. It’s a story about time and memory; mistakes and second chances; and society as we know it.
This episode was reported by Molly Webster, and produced by Molly Webster and Bethel Habte.

Saturday, September 28, 2019

EU court rules for Google, narrows French 'right to be forgotten' order to Europe

In the latest battle of the feud between Google and the French data protection authority (CNIL), the Court of Justice of the European Union ruled that the CNIL's "right to be forgotten" order should be limited to internet users in Europe.  However, the court did not rule out the possibility of a worldwide order if the facts warrant.

The court wrote:

[T]he right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality....  Furthermore, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world. 

While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679 [GDPR], struck a balance between that right and that freedom so far as the Union is concerned ... it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.

"Proportionality" is a core principle of EU human rights law when regulation collides with individual rights, or, as here, state power is implicated to favor one individual's rights over those of others.  The same principle also constrains supra-national authority over member states.

The case arose from a CNIL fine of Google.  The French authority had ordered Google to de-list search results to protect certain individuals' privacy under the "right to be forgotten," or "right to erasure," when those individuals were searched by name.  "De-listing" or "de-referencing" search results is the front line of right-to-erasure court challenges today, though the specter of erasure orders that reach content providers directly looms on the horizon.

Google complied with the CNIL order only for European domains, such as "google.fr" for France, and not across Google domains worldwide.  Google employs geo-blocking to prevent European users from subverting de-listing simply by searching at "google.com" (United States) or "google.com.br" (Brazil).  Determined users still can beat geo-blocking with sly technocraft, so CNIL was dissatisfied with the efficacy of Google's solution.  Undoubtedly, a dispute will arise yet in which the CNIL or another European data protection authority tests its might with a more persuasive case for global de-listing.

The case is Google, LLC v. Commission Nationale de L’informatique et des Libert├ęs (CNIL), No. C-507/17 (E.C.J.), Sept. 24, 2019.  Several free speech and digital rights NGOs intervened on behalf of Google, including Article 19, the Internet Freedom Foundation, the Reporters Committee for Freedom of the Press, and the Wikimedia Foundation, as well as Microsoft Corp.  The case arose initially under the 1995 EU Data Protection Directive, but carries over to the new regime of the General Data Protection Regulation (GDPR).

Monday, September 23, 2019

EU frets over Privacy Shield adequacy, and NGO insists, emperor still naked

The Commission of the European Union is reviewing the U.S.-EU Privacy Shield framework for conformity with the General Data Protection Regulation (GDPR), and NGO AccessNow is again demanding an inadequacy finding.

A lot is at stake.  For the uninitiated, European regulators have a dramatically different take on the protection of personal information than the free-wheeling free marketeers of the United States.  I've written some about the problem here and elsewhere (e.g., here and here), arguing that the American people are not so far from European privacy norms, but it's our law that lags behind the democratic will.  For my money, the definitive macro analysis of why American and European approaches to privacy have differed is James Q. Whitman's.  Anyway, the GDPR does not allow the export from Europe of information to countries that do not comport with its privacy protections, and that creates a monumental problem for the trans-Atlantic flow of not only information, but commerce.

The problem is not new and existed under the GDPR's predecessor law, the 1995 Data Protection Directive (DPD).  A number of mechanisms were devised to work around the problem, and they were approved by European regulators under the umbrella of "the Safe Harbor agreement."  But it's widely understood, at least on the European side, that Safe Harbor was something of a sham: No one with a straight face could argue that U.S. law was comparable to the DPD.  Safe Harbor in practice comprised mostly industry standards, voluntarily adopted and barely enforced by U.S. regulators.  There's also an important piece of this problem in the vein of national security, government spying, and personal information; I'm not even getting into that.

Privacy Shield is stronger than Safe Harbor, but the GDPR is a lot stronger than the DPD.  There have been remarkable advancements in privacy law in some states, notably California, in the EU direction.  And quite a number of court challenges have followed, winding their way through the process, some derived from objections in the commercial sphere, some the civil rights sphere: you've probably heard of "the right to be forgotten."  But our patchwork state laboratories hardly sum reassurance to Europe.  So in the absence of a comprehensive peace offering at the federal level, the debate over the EU's adequacy determination regarding Privacy Shield pretty much boils down to whether or not we're going to admit that the emperor is naked.

AccessNow, a global NGO and sponsor of RightsCon, has consistently called for honesty about the emperor's sorry state.  A recent memo calls on the Commission to rule Privacy Shield inadequate, and AccessNow has invited republication of a new infographic in support of its position.  I hereby oblige. It's past time we get serious about protecting personal information in the United States and stop commercial exploitation of human identity upon industry's abusive invocations of civil rights such as the freedom of speech and freedom to contract.

[UPDATE, 23 Oct. 2019, at 13:53 U.S. EDT: Privacy Shield still good, per EC report issued today.]

Thursday, September 20, 2018

John Does on sex-offender registry lose all civil rights claims against state, despite possible errors in listings

Persons listed on a part of the Massachusetts sex-offender registry for perpetrators who "moved out of state" have no constitutional privacy claims, state or federal, against commonwealth officials, despite a possibility of egregious error in listings, the Massachusetts Appeals Court ruled yesterday.  The case is John Doe, Sex Offender Registry Board No. 474362 v. Sex Offender Registry Board, No. 17-P-985 (Mass. App. Ct. Sept. 19, 2018).

Plaintiffs sued officials of the Massachusetts Sex Offender Registry Board (SORB) on theories of procedural and substantive due process under the federal and state constitutions after their names, pictures, and criminal histories were posted on the SORB website as "moved out of state."  The claimants alleged errors in the reporting, both in accuracy of the information and in the propriety of the posting.  The court recited the facts of one egregious case that suggested merit in the allegations of error:
[John] Doe No. 106929 came to Massachusetts in 2005 to attend school. He had previously been convicted in California for engaging in sexual relations with a sixteen year old when he was nineteen years old; California's age of consent was eighteen. After learning that Massachusetts had preliminarily classified him as a level three offender, Doe No. 106929 immediately left Massachusetts, and SORB ceased publishing his photograph and criminal history. Ten years later, in June of 2015, Doe No. 106929 learned through an Internet conversation that SORB had resumed publishing his name and photograph—this time on its "moved out of state" page. The sex offense listed on the page was "rape of a child." Doe No. 106929 received no notice from SORB regarding SORB's new practice, or that his name was being republished on SORB's Web site. Moreover, after Doe No. 106929 left Massachusetts, a court in California had entered an order expunging the record of his sex offense. Doe No. 106929 lost two jobs in California in 2015 once this information was made known at his workplaces.
The SORB abandoned its practice of publishing "moved out of state" records in 2015, but the superior court rejected the state's mootness defense.

Nevertheless, the Appeals Court rejected all plaintiff claims.  Affirming on federal procedural due process, the court held that the defendants were entitled to qualified immunity, because federal case law has not established any clear wrong in privacy violation.  Indeed, federal constitutional law points widely to the contrary.  Affirming on federal substantive due process, the court held that the claimants were unable to meet the demanding "shocks the conscience" standard that can turn what otherwise might be a state tort into a violation of the Fourteenth Amendment.  And reversing on claims under the Massachusetts Declaration of Rights, the court held that the defendants were entitled to sovereign immunity.  The Massachusetts legislature has voluntarily abrogated sovereign immunity for claims of "threats, intimidation or coercion" under the Massachusetts Civil Rights Act, but plaintiffs did not make such claims.

The court's reasoning on constitutional law is sound, but the facts point to the continuing failure of U.S. law to keep pace with Americans' privacy expectations in the digital age, especially relative to the pace of privacy law developments elsewhere in the interconnected world.  John Doe No. 106929's case is especially troubling in light of his California expungement.  Expungement already is an embattled concept—cf. "ban the box" movement—in the age of the internet that never forgets and the refusal of American policymakers to engage with the right to erasure.  For persons who committed crimes but served their time, that can mean stinging and enduring punishment well beyond what society and the justice system already determined was due.  The consequences are even more grave when the punishment is civil in nature, not even necessarily predicated on a criminal conviction.

The state should have no more license to defame or invade privacy than any person.  The common law maxim prized by the renowned Justice Oliver Wendell Holmes, Jr., himself a Bay Stater, asserts that for every wrong, the law provides a remedy (ubi jus ibi remedium).  Yet where digital privacy is concerned, profitable commerce in information seems to be holding at bay common law evolution, legislative innovation, and good sense.

Saturday, April 7, 2018

Popular singer's 'right to be forgotten' outweighs free speech in Italian case over archival video and biting commentary

Because Manchester City FC might need it after today's derby match, let's consider the right to be forgotten.

As an aspect of European, and increasingly global, data protection law, "the right to be forgotten," or right to erasure, unsettles the tummies of American media advocates.  The right to erasure runs up against the presumptive rule of U.S. First Amendment law that there can be no punishment for the republication of truthful information lawfully obtained.  Read more about that here (predating implementation of the EU General Data Protection Regulation).  The Italian Court of Cassation has issued a potentially important decision at the intersection of the right to erasure and the freedom of expression.  

Hat tip @TheItalianLawJournal.  For a few months to come, or until a better translation comes to light, I'm parking a very rough Google Translate rendition of the ruling here in PDF.  The translations that follow here are mine, refining the Google Translate rendering. The original court decision can be found here.


Antonello Venditti by Angela_Anji (CC BY-NC-SA 2.0)
The case stemmed from a TMZ-style confrontation by an RAI-1 "Live Life" («La vita in diretta») crew of Italian singer Antonello Venditti (Facebook) in 2000.  I've not seen the video, but Venditti apparently resisted the interrogators with sufficient gruffness that he earned his way onto the program's 2005 "ranking of the most obnoxious and grumpy characters in the entertainment world."  The story occasioned rebroadcast of the 2000 segment, along with commentary mocking his diminished fame in the intervening years.  Antonello took offense and sued, claiming "a right to be forgotten" attached to the 2000 video. 

Of peculiar resonance with current events in the United States, the Italian court took note of a German right-to-erasure case about "an affair in which a German citizen, who held a major political and business position in Germany, had requested the erasure of information from the web relating to an episode of collusion with Russian crime dating back several years earlier, republished several years after."  The Court of Justice of the EU ruled that "the public's interest in information prevailed over the individual's interest in oblivion."  However, the Italian court observed, the ruling resulted from a fact-intensive inquiry.

The court must engage with "the search for the right balance between the interest of Internet users in information and the fundamental rights of the person," the Italian court explained.  "Therefore, the editor of a newspaper that stores in its historical archive on the internet the news, making it available to a potentially unlimited number of people, is required to prevent, through the dissemination of even remote facts, without any meaningful and current public interest, possible harm to the right to be forgotten by the people who were involved."

The freedom of expression must yield to the right to erasure, the court held, upon analysis according to five factors:

  1. the contribution made by the dissemination of the image or of the news to a matter of public interest;
  2. the actual and current interest in the dissemination of the image or news (for reasons of justice, police, or protection of the rights and liberties of others, or for scientific, educational, or cultural purposes), to be considered absent in case of prevalence of a popular interest [italics added; in original, divulgativo: I'm not sure how to translate that and don't think "popular" or "informed" is right], or, worse, merely economic or commercial interest of the subject that spreads the news or the image; 
  3. the high degree of notoriety of the subject represented, for the economic or political reality of the country;
  4. the methods used, for the particular position held in public life, and, in particular, to obtain and give information, which must be truthful (because it is drawn from reliable sources, and with a diligent research work), disseminated in ways that are not excessive for information purposes, in the interest of the public, and free from insinuations or personal considerations, so as to highlight an exclusive objective interest in the new dissemination;
  5. the preventive information about the publication or transmission of the news or image at a distance of time, in order to allow the interested party the right of reply before its disclosure to the general public.
Applying its multi-factor test, the court decided that RAI's interest in the rebroadcast video segment was outweighed by Antonello's privacy and data protection rights.  The court below had erred by finding Antonello's fame dispositive.  Reminding one of the analysis of Elmer Gertz in U.S. defamation lore, the court held that Antonello's large public following "certainly" did "not invest[ him] with a primary role in national public life."  Moreover, RAI's purpose, five years on, lacked merit. The court found it "undeniable that the reiterated broadcast ... had [the] unique purpose of allowing the inclusion of the singer ... in a ranking of ... 'the most obnoxious and grumpy of the entertainment world,' invented by the same broadcaster, allowing, in this way, the satisfaction of an interest that is exclusively informative [again, divulgativo], for commercial purposes, and for the television operator's audience."  The broadcaster's derogatory comments about Antonello's fame in 2005 aggravated the offense, the court added.  

The court also rejected "satire" as a defense.  The representation of Antonello was not "paradoxical, surreal and hyperbolic critique," but referred to "true fact," "clearly directed to a mere and unjustified denigration of the artist."  The broadcaster sought to use the 2000 video to represent Antonello in 2005 as "a singer, for years, in decline."

This case is the very stuff of American media advocates' nightmares.  Newspapers decry the right to erasure as a threat to online archives—though representations in archives, as archives, are readily factually distinguishable from the Antonello case.  The more realistic threat would be to the "TMZ"/"Talk Soup" format of entertainment media, or even the clever uses of archival video that have become the staple of commentary on The Daily Show with Trevor Noah and Last Week with John Oliver.  Certainly under a rule such as the Italian court employed, broadcasters, even straight news broadcasters, would have to take more care with their use of B roll.  

I've advocated in favor of evolving U.S. privacy law toward European data protection norms.  But the Italian court went too far here, lending credence to American nay-saying.  I fault the court's analysis of Antonello as, in U.S. terms, a "private figure."  The lower court got it right in finding Antonello's public status dispositive relative to this RAI commentary.  It's especially telling and troubling that as to the satire argument—the RAI program seems on the mild side of the Talk Soup genre—the court faulted RAI commenters for the truth in their observation of Antonello's waning fame.  The court set up the Italian judiciary to be a "super editor" of popular media, an arbiter of taste.  American courts appropriately struggle with newsworthiness determinations in privacy law because they do not want that job.

Wednesday, August 9, 2017

Book Review: So You've Been Publicly Shamed, by Jon Ronson



In an afterword to his 2015 book, Jon Ronson reported that So You’ve Been Publicly Shamed was not the first-draft title.  

Indeed, it must have been a struggle to name this wide-ranging volume.  Ronson explores shame in many contexts, from the woman whose off-color joke about AIDS on Twitter “blew up [her] life” (as the N.Y. Times put it) to the clients of a busted prostitution outfit, to the featured participant in “a German-themed BDSM orgy” (as the New Statesman put it).  I’m not here naming the Twitter woman, because if you read the book, I think you’ll agree she’s been named—and shamed—more than enough.

By Ronson’s broad definition of public shaming, I’ve been there.  Ronson does little to distinguish those who fairly earned some degree of public shaming—such as a journalist who made up quotes—from those who were disproportionately rebuked, or just misunderstood, or falsely maligned.  Ronson’s light touch with judgment—he admits he has not always been so evenhanded in his own social media life—frustrated me at first, as I’m one who likes to see justice done, or at least to wring my hands when it’s not.  However, I came to appreciate Ronson’s approach.  His reluctance to reach normative conclusions forced me, as reader, to acknowledge my own.  Do I really know how This American Life fact-checks, say, David Rakoff, versus Mike Daisey (see “Retraction”)?  Do I need to have an opinion at all on what consenting adults do in their sex dungeon?  (See also extended adventures with Jon Ronson in the porn world at his 2017 podcast, The Butterfly Effect, coming to iTunes free in November.)

Judgment would get in the way of Ronson’s search.  Chapter to chapter, Ronson leads us in a dogged effort to understand the shaming mob.  (Cf. the excellent work of Prof. Ken Westhues on mobbing.)  When does the mob spring into action, and when does it not?  Ronson tells stories of public shamings from the perspectives of the victims.  He went to the trouble of tracking them all down to get their stories; the Internet doesn’t usually bother.  (In my experience, neither does The New York Times, nor even a respectable author.)  Can the victim do anything to fight back against a public shaming?  Ronson gives us a fascinating glimpse into the sometimes shady world of online reputation management.  And ultimately:  Is there such a thing as redemption in the Internet age?

That was the question that kept me turning pages.  Coverage of Ronson’s book since 2015 really obsessed on the implications of social media, but this book is about so much more than that.  Despite my ongoing research into online erasure, or “the right to be forgotten” (e.g., here and here, and an exciting panel discussion at NCA 2016, reported here and here), I was surprised to see Ronson make the connection.  He considers the RTBF later in the book, tackling the conflicted feelings about RTBF that a lot of people in the journalism world have over interacting rights to expression, privacy, and identity. 

I continue to be captivated by the redemption problem, which I wrote about in a Washington Post opinion column some years ago.  I won’t tell where Ronson’s search leads, because that would spoil the fun.  Suffice to say, there’s plenty of work yet to do, if justice is really our aim.