"The ""Right to Be Forgotten"": Reconciling EU and US Perspectives"

Recent developments in the European Union (EU) have highlighted the potential for the development of a "right to be forgotten."For United States (US) companies, especially those operating on the Internet, the development and enforcement of such a right could prove to be quite problematic.This Article outlines the practical implications of such a right, pointing the way toward possibilities for reconciliation of US and EU views on the application of a right to be forgotten. 2012]THE "RIGHT TO BE FORGOTTEN" 163 explanations of the "right to be forgotten" have followed.8 The European Union, moreover, has emphasized that "privacy standards for European citizens should apply independently of the area of the world in which their data is being processed."9 Recent developments in Spain and Italy have amplified public discussion on the right to be forgotten.In early 2011, Spanish data protection authorities demanded that Google remove links to online news articles on grounds that the articles contained out-of-date information which infringed on the privacy of Spanish citizens.10 At about the same time, Italy announced that it would reguthe right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes.This is the case, for example, when processing is based on the person's consent and when he or she withdraws consent or when the storage period [for data] has expired."Id. at 8. 8. See, e.g., Viviane Reding, Speech-Brussels, Nov. 30, 2010 ("[I]ndividuals need to be able to maintain control over their data.This is particularly important in the [online] world . . . .I want to introduce the 'right to be forgotten.'Social network sites are a great way to stay in touch with friends and share information.But if people no longer want to use a service, they should have no problem wiping out their profiles.The right to be forgotten is particularly relevant to personal data that is no longer needed for the purposes for which it was collected.This right should also apply when a storage period, which the user agreed to, has expired."),available at http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/10/700; see also Viviane Reding, Speech -Brussels, Mar.16, 2011 (discussing how the "right to be forgotten" includes "a comprehensive set of existing and new rules to better cope with privacy risks online.When moderni[z]ing the [EU privacy] legislation, I want to explicitly clarify that people shall have the right -and not only the 'possibility' -to withdraw their consent to data processing.The burden of proof should be on data controllers -those who process your personal data.They must prove that they need to keep the data rather than individuals having to prove that collecting their data is not necessary."),available at http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/11/183; see also Steve Olenski, You Have the Right to be Forgotten Online, Mar. 24, 2011 ("Maybe you've been at a party, up until four in the morning and you or someone you know posts photos of you.Well, it's a harmless bit of fun, but being unable to erase this can threaten your job or access to future employment.")(quoting spokesman for Reding), available at http://socialmediatoday.com/steve-olenski/280649/you-have-right-be-forgotten-online ; see also uTRUSTit, Legal Requirements For Trust In The IoT [Internet of Things] at 26 (Apr.12, 2011) (report co-funded by European Commission) ("To counter what can be referred to as the perpetual memory of the [I]nternet, one could think of a right to be forgotten as a complement to the right to privacy, traditionally referred to as the 'right to be let alone.'Such would enable the data subject to personally determine that their data is no longer processed and deleted when they are no longer needed for legitimate purposes.").9. Viviane Reding, Speech -Brussels, Mar.16, 2011 ("Any company operating in the EU market or any online product that is targeted at EU consumers must comply with EU rules.For example, a US-based social network company that has millions of active users in Europe needs to comply with EU rules. . . .To enforce the EU law, national privacy watchdogs shall be endowed with powers to investigate and engage in legal proceedings against non-EU data controllers whose services target EU consumers.