Saturday, 13 November 2010

Clarifying the “right to be forgotten”

One of the proposals contained in the European Commission’s recent plan to amend the data protection directive came from the premise that individuals should always be able to access, rectify, delete or block their data, unless there are legitimate reasons, provided by law, for preventing this.

Today’s image appears in a number of newspapers, and is of a group of demonstrators in triumphal poses on the roof of Millbank Tower, during the riot on 10 November. I wonder how many of them are regretting their decision to climb to the top of the building, in protest at the Government's decision to increase tuition fees for students. I also wonder if this image includes a picture of the person who hurled a fire extinguisher from the roof. It crashed to the ground inches from policemen who said they would almost certainly have been killed if it had struck them. Police Federation representatives have called for the person responsible to be charged with attempted murder. Among the 55 or so arrested in relation to the protests, ten were still at school.

Millbank Tower is designed with one wing of 27 floors and the other wing of just 8 floors. The students climbed up to the 8th floor roof - above the offices occupied by the Conservative Party, Conveniently sited next door to the MI5 Headquarters, Millbank Tower provides office accommodation for a number of high profile political and other organisations. Current and previous tenants have included the Labour Party, the United Nations, the Central Statistical Office, the Parliamentary Ombudsman Commission, the Local Government Ombudsman, UK India Business Council and the Ministry of Justice Records Management Service. And yes, it’s also the London home of the Information Commissioner’s Office.

I was out in Westminster the night after the riot with someone who also works in that building. He described how the initial frisson of excitement among the office workers quickly turned to apprehension, as they realised that the mob was attacking a very thin blue line of riot police. And then the live television pictures of rioters, inside the building and just a few floors away from where he was working, caused growing consternation. It’s really not funny when you find yourself caught up as an innocent victim of the chaos. Many of the office workers were extremely distressed. You don't expect to face an angry mob, or to fear your life is in danger, just because you share an office building with workers from a mainstream political party.

But should the people in this image be able to re-write history and demand that their personal data be deleted from the image?

The answer can only be no – and the reason must be that it is not their personal data any more.

This seems to be the logic of the Commission’s proposal, as it suggests that the right to be forgotten relates to the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person's consent and when he or she withdraws consent or when the storage period has expired.

In instances such as the riot, the processing of their personal information was never based on consent in the first place. It was based on other conditions in the Directive.

And what this will probably lead to is more data controllers wondering if consent really is an appropriate condition for processing personal information, or whether they ought not rely on other conditions if they can possibly help it. At work, for example, I always prefer to use the legitimate interests of the data controller condition, rather than rely on consent. It’s a much easier test to meet for all practical purposes. And it gives me much more control over how I use information that is required for, say, coroprate, purposes.

I would hate to see more politicians, for example, trying to argue that it is appropriate that they have a right to insist that we forget about any of their previous misdeeds. Memories of the recent sleazy Parliamentary expenses scandals have not yet faded away.

Indeed, we have Wikipedia to thank us for providing us with a tool that enable us to refresh our memories every now and again. The media are currently running stories about the ease with which journalists managed to hack their way into the voicemail accounts of many high profile individuals some 5 years ago. The House of Commons Home Affairs Select Committee is currently carrying out yet another enquiry into the way the Metropolitan Police investigated the allegations.

But take a good look at the record of the Chairman of the Home Affairs Select Committee. Look him up on Wikipedia. And ask yourself how many of those allegations of misbehaviour you’ve already forgotten (or didn’t know about in the first place). If people who have allegedly behaved like that can end up as the Chairman of an influential Parliamentary Committee, then the demonstrators who are pictured on the roof of Millbank Tower probably have nothing to fear should they wish to become public servants.