We hear every day that technology is changing rapidly, and that we are at risk of others violating our rights through digital means.   We hear about cyber attacks that steal data, such as credit card numbers, social security numbers, names, incomes, or addresses. We hear about attacks that steal intellectual property, from movies to plans for the F-35 Joint Strike Fighter. Indeed, we face a continual onslaught from not only the cyber criminals, but from the media as well. One of the lesser-reported issues in the US, however, has been a different discussion about data and rights protection: the right to be forgotten.

Last year, The European Court of Justice ruled in Google vs. Costeja that European citizens have the right, under certain circumstances, to request search engines like Google, to remove links that contain personal information about them. The Court held that in instances where data is “inaccurate, inadequate, irrelevant or excessive” individuals may request the information to be erased and delinked from the search engines. This “right to be forgotten” is a right that is intended to support and complement an individual’s privacy rights. It is not absolute, but must be balanced “against other fundamental rights, such as freedom of expression and of the media” (paragraph 85 of the ruling). In the case of Costeja, he asked that a 1998 article in a Spanish newspaper be delinked from his name, for in that article, information pertaining to an auction of his foreclosed home appeared. Mr. Costeja subsequently paid the debt, and so on these grounds, the Court ruled that the link to his information was no longer relevant. The case did not state that information regarding Mr. Costeja has to be erased, or that the newspaper article eliminated, merely that the search engine result did not need to make this particular information “ubiquitous.” The idea is that in an age of instantaneous and ubiquitous information about private details, individuals have a right to try to balance their personal privacy against other rights, such as freedom of speech.

In a more recent case, Dan Shefet, a Danish lawyer, asked Google to delink defamatory material pertaining to him from Google’s French site.   Shefet’s case, however, differed than the Costeja ruling in that his request was ultimately to delink all material from the global search engine and not merely links associated with Google.fr. The idea was that the right to be forgotten requires that information pertaining to someone could be easily accessed through other national search engines (e.g. google.de, google.com, google.ch). Mr. Shefet won. The French judge ruled that a parent company can be held liable for the actions of its subsidiary (a sort of Respondeat Superior argument).

Yesterday, the advisory council to Google on the “right to be forgotten” issued its report. The members of the advisory council, however, disagreed with the French judge’s ruling. Their opinion was that while the Internet defies territoriality, the requests of one individual’s right to be forgotten as a European Union (EU) right, may not be a right of another individual outside of the EU. In effect, by requesting that data be erased or delinked from other countries’ search engines, this would undermine their sovereign rights to determine what information is present in their societies. As Luciano Floridi, one of the leading experts on the council explains, “my place, my rules, but your place, your rules. How could one explain to Brazilians that some legally published information online should no longer be indexed in a Brazilian search engine because the European Court of Justice has ruled so?” The council, thus advises that the right to be forgotten requests for erasure and delinking be limited to the EU.

The “newness” of the right to be forgotten is not, however, that new. In effect, the idea is about the right to a good reputation (i.e. laws against libel or defamation of character), and framing information in such a way that it unnecessarily impinges on one’s right to privacy. I am uncertain if anything here is entirely new in concept; the only thing truly new is that we are able to access a wealth of information from a variety of sources instantaneously. We are creating new “data” about every mundane detail of our lives; moreover, through this generation of data we have not particularly cared about who owns that data or what they do with it.

What these two cases show, however, is that a balance was made about reputation and privacy. In the case of Mr. Costeja, the balance was one where he had paid his debts and wanted to move on with his affairs, and the continual linkage of this piece of information was unnecessary. In the case of Mr. Shefet, the requests were to take down defamatory material.   Typically, the state would be the only locus required to adjudicate these disputes. However, we are facing a transnational issue where the actors are not merely individuals, but corporations, individuals and other states.   Our international legal institutions are ill equipped to deal with this. Professor Floridi’s notion that “my place, my rules” may make sense on some fronts, but not on others.   For example, if I have a right, a right against you that I expect my government to enforce, but the enforcement of this right requires other sovereign states to cooperate, then that right is not really a “right.” On Kant’s reasoning, a right is “an authorization to use coercion,” meaning that I can use coercive force to ensure that you uphold your duty and respect my right. To square various theoretical circles, the state is usually seen as the authoritative body to wield that coercion. But, states cannot use coercive force (lawfully) against other states. Each is sovereign, and so they have no sway over the affairs of the other. “My place, my rules” only works when I don’t require another place to enforce my rules.   In effect, what we have here is a right that is unenforceable, and so, is not really a right. So, the right to be forgotten means that one can only be forgotten in the EU. Yet we know that this is clearly not sufficient given the transnational and global reach of the Internet.   If the right to be forgotten is really a right, then it is something on the order of what Kant identifies as a “right to a good reputation after one’s death.” It is a right that we have by virtue of our humanity, but attempting to make sense of it is a logical impossibility unless we create a digital Leviathan.