A ‘complete right to be forgotten’ was ‘not possible’, said justice minister Simon Hughes in response to questions from a House of Lords’ select committee about proposals for a new EU Regulation and Directive on data protection. Under the new proposals, data subjects – i.e., the person whose data is being collected – would be given greater powers to have their data amended or erased completely – the ‘right to be forgotten’.
The evidence session follows the Court of Justice’s ruling that data subjects can require Google to remove links to information lawfully on the website if they think it is prejudicial to them. The Court’s judgment interprets the current 1995 Directive, but this has been criticised by some as restricting people’s rights to give and receive information.
During today’s session before the EU Sub-Committee on Home Affairs, Education and Health, it was revealed that in a letter to Lord Boswell on the 22nd November 2012, the then Justice Minister, Helen Grant described the right to be forgotten as ‘unworkable’. In another letter dated the 2nd May 2013, Lord McNally also said that he did not support the right as proposed by the European Commission, as ‘it is not technologically possible to remove all traces of data uploaded to the internet’.
Lords today suggested that Hughes was taking a further position in saying ‘there is no right to be forgotten’. He explained to the Committee that the government does not support the right to be forgotten as it’s currently proposed by the European Commission and that they have made that clear in their negotiations. He pointed out that: ‘You couldn’t exercise a complete right to be forgotten, the global information system could not be made to do it, it’s just not possible.’
The Lib Dem MP warned that even the phrase ‘right to be forgotten’ risked giving rise to ‘unrealistic expectations’.
‘My plea to [Google] would be to try to share [with the public] the balance between applications turned down and accepted and share with the government the robust message that this does not mean that something you don’t like about your record can suddenly disappear because you’re going to ask about it.’
Newspapers have the protection of being “media” under European data protection law however, as explained by Charles Arthur in a recent Guardian article, Google ‘explicitly opted out’ of being described as a ‘media’ company. Judges decided that because Google collects lots of data and then processes it, and that that data includes information about people, it is a ‘data controller’ under the meaning of the EU data protection directive. As such, ‘data controllers’ have special obligations in the EU – including the responsibility to remove data that is ‘inadequate, irrelevant or no longer relevant’.
Today, Hughes argued that Google clearly has the capacity to manage this new burden, whereas smaller companies may not be able to afford the costs. He went on to say that: ‘It would be clearly unacceptable that somebody who was wanting to set up a new company [now categorized as a data controller] is going to have potentially a largely impossible task.’
In regards to how the Regulation will affect businesses, if it is enacted in its current form, Hughes said that the government’s assessment of the original proposal was that it would have a net cost to our economy of between £100m and £360m a year which was, he added, ‘no small beer’. In terms of small and medium sized companies the impact assessment estimated that it could cost them between £80m and £290m a year.
‘This is the serious cost of the regulation as it’s currently drafted which is why we’re batting very hard to make sure we don’t have that burden on us as an economy trying to grow our businesses and grow our market.’
When asked by the Committee whether or not he would characterize this law as ‘good’, Hughes replied:
‘I don’t think, both as an individual and as a Minister, that we want the law to develop in the way that’s implied by this judgment which is that you close down access to information in the EU which is open in the rest of the world.’
‘There are other countries that restrict information access, it is not a good position for the EU to be in to look as if it is countenancing restrictions in the access of the citizen to information because it could set a very bad precedent.’
The UK government is currently negotiating with their 27 partners to reach an agreement ‘as soon as is practical’.
In Germany there is an ongoing debate as to whether or not there ought to be a different criteria for the public sector and the private sector. The Minister said that this was not a ‘sustainable argument’.
It was back in January 2012 that the European Commission proposed a comprehensive reform of the EU’s 1995 data protection rules to strengthen online privacy rights and boost Europe’s digital economy. In a press release on the 25th January 2012 EU Justice Commissioner Viviane Reding, the Commission’s Vice-President said:
‘The protection of personal data is a fundamental right for all Europeans, but citizens do not always feel in full control of their personal data. My proposals will help build trust in online services because people will be better informed about their rights and in more control of their information. The reform will accomplish this while making life easier and less costly for businesses. A strong, clear and uniform legal framework at EU level will help to unleash the potential of the Digital Single Market and foster economic growth, innovation and job creation.’
Viviane Reding, EU Justice Commissioner
One of the EU Commission’s key changes in the reform was the ‘right to be forgotten’ – to ‘help people better manage data protection risks online: people will be able to delete their data if there are no legitimate grounds for retaining it’.
There have been a reported 4000 amendments to the proposal so far. Hughes described how the judgment has sent ‘ripples’ and ‘indeed waves’ and that it’s thrown up the need to have the big debate about the balance between freedom of expression and privacy:
‘If this court judgment actually generates a debate about that balance and allows us to get the right results in regulations in Brussels next year we will have hopefully benefited from a large noise out of quite a small focus judgment.’
The European Council has set a target of 2015 for the new law to be put into place.
‘I am respectful of the need to protect data and I’m respectful of the need to protect the privacy of the citizen but I will always look to maximize freedom and freedom of information and the sharing of that information in the EU as well as outside it – I hope that’s a clear statement of what the public interest is from the government’s point of view.’
Simon Hughes, Minister of State at the Ministry of Justice.