Critics have viewed the judgment as offering a wide and amorphous leeway on free speech and an outrageous attempt to limit progressive European Union laws only to European Countries
BY DENNIS NDIRITU
On September 24, Europe’s highest court, the Court of Justice of the European Union (CJEU) ruled that Google will not be required to enforce Europe’s controversial Right to be forgotten law outside of the European Union.
The right to be forgotten, also known as the right to erasure, enables European residents through the General Data Protection Regulations (GDPR) of the European Union to demand that Google and other search engines/social platforms remove information or personal references to them that they consider to be inaccurate. This may include requests for removal of embarrassing or inconvenient information such as criminal convictions.
The right to be forgotten dovetails the right to access to information meaning that the right to control one’s data is meaningless unless a person can take action when they no longer consent to processing, when there are significant errors within the data, or if they believe information is being stored unnecessarily and therefore is not an absolute right.
Under Article 17 of the GDPR, an individual has the right to have their personal data erased if: the personal data is no longer necessary for the purpose an organization originally collected or processed it; an organization is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent; an organization is relying on legitimate interests as its justification for processing an individual’s data, the individual objects to this processing, and there is no overriding legitimate interest for the organization to continue with the processing; an organization is processing personal data for direct marketing purposes and the individual objects to this processing; an organization processed an individual’s personal data unlawfully; an organization must erase personal data in order to comply with a legal ruling or obligation and where an organization has processed a child’s personal data to offer their information society services.
However, an organization’s right to process someone’s data might override their right to be forgotten in instances where; the data is being used to exercise the right of freedom of expression and information; the data is being used to comply with a legal ruling or obligation; the data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority; the data being processed is necessary for public health purposes and serves in the public interest; the data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy; the data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing and the data is being used for the establishment of a legal defense or in the exercise of other legal claims.
The right to be forgotten gained prominence following the landmark 2014 case of Google v. Spain, where the European Court of Justice ruled that the European citizens have a right to request that commercial search firms, such as Google, that gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant. In this case, a Spanish citizen demanded that Google remove pages from 1998 that detailed the forced sale of a property that he had owned at the time. While the Court did not provide that newspapers should remove articles, it found that the fundamental right to privacy is greater than the economic interest of the commercial firm and, in some circumstances, the public interest in access to information. The European Court further affirmed the judgment of the Spanish Data Protection Agency, which upheld press freedoms and rejected a request to have the article concerning personal bankruptcy removed from the web site of the press organization.
This has served to guide Google on dealing with requests for deletion when the information in question is hosted on its European domains. However, Google had failed to extend this right beyond the European Union boundaries thus meaning that, for example, an offending item could be erased from history on google.co.uk, but still be found on google.com.
This prompted France’s data regulator, the Commission Nationale de l’Informatique et des Libertes (CNIL), to dispute this loophole and insist that European Union law extend to all domains. It sought to implement this by fining Google €100,000 (sh11.4m) in 2016 for non-compliance with its demand forcing Google to appeal to the Court of Justice of the European Union for a final determination on the matter.
In its determination, the court agreed with Google, noting that the Right to be forgotten is not a global right. It was its opinion that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.
Interestingly the court also ruled separately that links do not automatically have to be removed just because they contain information about a person’s sex life or a previous criminal conviction. Such items could justifiably remain if there is a case that removal would breach other people’s freedom of information rights. It added that Google and other search engines have an obligation to “discourage” users from using technology such as Virtual Private Networks (VPNs) in order to circumvent domains where the Right to be Forgotten does apply and that it is down to national courts around the European Union to determine whether appropriate measures have been taken. National courts were also tasked with the responsibility of handling the local cases.
While this may be seen as a good ruling and it will definitely have great ramifications in third world countries such as Kenya whose privacy laws are at an infancy stage, critics have viewed the judgment as offering a wide and amorphous leeway on free speech and an outrageous attempt to limit progressive European Union laws only to European Countries.
If enacted into law, social media group administrators will be required to inform the Communication Authority of Kenya of their intention to form groups and will be required to control undesirable content and discussion on the platform they control.
This comes at a time in Kenya when the State seeks to tighten the noose on regulation of digital communication through the Kenya Information Communication (Amendment Bill), 2019, which among other things seeks to regulate blogging and management of social media communication channels. The Bill proposes that users and group administrators who allow offending content on their social media platforms be jailed. If enacted into law, social media group administrators will be required to inform the Communication Authority of Kenya (CAK) of their intention to form the groups and will be required to control undesirable content and discussion on the platform they control. They must further have a physical address and data showing all their members.
Should it be enacted, Facebook and WhatsApp users will need to closely monitor what is posted on their walls. WhatsApp group administrators will also need to keep tight control on their members and eject those posting offending content together with carrying out due diligence to ensure that all its users are of the age of majority. The Bill defines social media platforms to include “online publishing and discussion, media sharing, blogging, social networking, document and data sharing repositories, social media applications, social bookmarking and widgets,” which is set to elicit serious concerns from privacy policy experts and data enthusiasts.
Also to be affected by the regulations are bloggers, who the Bill defines as those involved in “collecting, writing, editing and presenting news or news articles in social media platforms or in the internet.” They will be required to obtain CAK’s authority to run a blog lest they risk spending up to two years in jail or pay fines of up to Sh500, 000. The regulator will further maintain a register of bloggers in the country and develop a bloggers’ code of conduct.
Prof. Makau Mutua warns that courts in plural societies, especially on matters religion, race and ethnicity must never run a head of society to curb rights and freedoms where there is no social or political controversy. This must be borne in mind by our courts in the wake of this overzealous legislation meant to curtail our hard earned freedom of expression and limit our cherished right to privacy.
Even though it is not arguable that the Right to be forgotten in its current form is bad law and open to enormous abuse by the nefarious elements of society, it is worse still that this has been buttressed by the European court and will be interwoven with this new radical proposals to our detriment.
The new Bill could definitely benefit from a substantial revision to better reflect its objectives.
