Thursday 11 January 2018

GDPR: Forget me (not?)

I have registered on the FutureLearn course Understand the General Data Protection Regulation offered by University of Groningen and as the course access, for me, expires soon ploughing through the activities.

I found the concept Rights to erasure and data portability in the General Data Protection Regulation (GDPR) particularly interesting. This is stipulated in Article 17 GDPR and known as the right to erasure or the right to be forgotten.

forget me not flowers
Forget me not flowers
Is it a good thing to have this right? As in many cases the answer is not black and white; there are lot of grey areas.

The right to be forgotten is a good thing because by exercising this right one can get unwanted images, posts that may appear on Web about oneself to be removed. For example, in the late teen years it may be funny to upload images on pub crawls and of various silly activities one has taken part in, but it may not be funny anymore to have them attached to ones name on a Google search when they are professionals.

On the other hand, if some individuals exercise this right to remove historical data that are unfavourble to them, would this not impact adversely on other people? For example, suppose a person has historical convictions for fraud and under the right to forget requests all links to his historical offences are removed from search pages. Later on this person sets up a bookkeeping business. A potential customer coming for business may want to know the background of the bookkeeper. But because the links to the previous offences are removed from search sites the potential customer is unable to find accurate information about the background of the bookkeeper.

Can requests to be forgotten create a biased search with 'blocked' or 'filtered' results? Will this affect the freedom of expression?

Article 17 paragraph 3 of the GDPR states that there are exceptions:

(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); 
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or 
(e) for the establishment, exercise or defence of legal claims. 

I've got more questions to think about than I started with - not a bad thing though