Regaining digital privacy?: The new “right to be forgotten” and online expression

This article considers how the newly-formulated “Right to be Forgotten” in Article 17 of the EU’s new General Data Protection Regulation will apply to “online expression”, that is, content placed online via social and other forms of media. It starts by seeking to refute the argument that the widespread sharing of personal information online means that digital privacy no longer matters, considering in particular the key role that privacy as informational control plays in self-actualisation and how the advent of a right to erase may alter judicial understandings of informational autonomy. It goes on to consider some of the key interpretive dilemmas posed by Article 17, in particular the questions of when individuals and online intermediaries may be fixed with obligations under the Regulation and who may claim the broad “journalism exemption”; in doing so it contests the notion that the privacy obligations of social media platforms like Facebook should invariably be treated differently from those of search engines like Google. It then goes on to argue that the right to privacy enshrined in Article 8 of the European Convention on Human Rights, as interpreted by the Strasbourg Court, is likely to be an important factor in the interpretation of the new right, and how it is balanced with freedom of expression. Using a variety of data dissemination scenarios it considers how Strasbourg’s ‘reasonable expectation of privacy’ test, and the factors that underlie it, might apply to the resolution of different kinds of erasure claims under Article 17. In doing so it analyses the applicability of a number of relevant factors drawn from the Strasbourg case law, including the content of the personal data in question, its form, whether the data subject is a “public figure”, implied “waiver” of privacy rights, how the data was collected and disseminated and whether it relates to something that occurred in a physically public location.