A few years ago, as a largely vexatious experiment, I asked Google to exercise my “right to be forgotten”. I planned to write about this at the time, but I forgot.
Remembering yesterday, when I read about new proposals for British data protection laws, I also realised that I’d forgotten what it was I wanted forgotten. Checking back in my email, though, which forgets nothing, I see that it was a request for Google to remove all search results about me once winning a prestigious award for writing about perfume. “I find this embarrassing and fear it may lead people to either laugh at me or notice when I don’t smell terribly nice,” I had written, on the online request form.
Google declined, on the basis that the information that I had won a prize for writing about perfume, like a girl, was in the public interest. This might seem reasonable to you, and it does to me, too, because I was, as discussed, being largely vexatious. Had I been so inclined, though, it is possible that I could have taken this further, right up to the European Court of Justice. The test case, the one that created this “right” in the first place, concerned a Spanish man, Mario Costeja González, who wished it to be “forgotten” that his home had once been repossessed. He won. Although, of course, it wasn’t forgotten at all. Or, at least, not by me.
Our new laws, should they come to pass, are about a slightly different right to be forgotten. Matt Hancock is the digital minister, a description that makes him sound only like Westminster’s answer to Siri. He wants people to have more control over what happens to their personal information online. Part of this concerns information in social media posts, which they may have posted in their youth. Other parts concern the data about us harvested by internet companies, with or without our explicit knowledge.
Unlike the above, it all seems wholly sane. Which, as I shall explain when this column eventually becomes about Brexit (because all columns these days eventually become about Brexit) is probably just as well.
Advertisement
Data is the internet’s main industry. Some might call it the internet’s only industry. Properly understood, this theory goes, the true forebears of Google and Facebook are not the media companies they increasingly threaten but actually mining and drilling behemoths such as BP, Shell and Koch. Like them, they are primarily in the business of extraction. We, the users, are the coalface, the goldmine, the well. Into us they hack, and out of us they pull the stuff they wish to sell. Which, in turn, is bought by people who want to sell us everything else.
Roughly speaking there are two world views pertaining to this sort of stuff, and they are divided by the Atlantic. In the West, things are more Wild. It is not quite the case that American companies can do whatever the hell they like with the data they hold on their users, but they definitely do own it, and their users definitely do not. In the EU breaching data protection is already regarded as a violation of human rights. In the US, it’s more a mildly mischievous slip that might lead to a lawsuit.
The disparity goes further. The “right to be forgotten up top”, for example, may be broadly workable in a European context. In the US, though, it runs directly counter to the First Amendment on freedom of speech. Or, to put that another way, in the EU it may be illegal for Google to link to a particular news story about Mr González’s home repossession, but in the US, it’s illegal to tell Google that it cannot.
In the European Court of Justice right now Google and France are slugging it out over whether the EU provision stretches beyond EU borders. If it does, then it trumps the US First Amendment. If it doesn’t, with a global internet, it is meaningless.
Such clashes will not end and cannot easily be resolved. People already talk about two internets, with one existing behind the Great Firewall of China, and the other everywhere else.
Advertisement
It is not wholly fanciful to imagine that a regulatory mismatch between the US and the EU could deliver a third, with US tech behemoths avoiding fines and courts by confining EU users to services that behave as the EU insists.
In the US, if anything, internet privacy is going in the opposite direction. In April Republicans in Congress voted to kill fledgling privacy laws brought in by Barack Obama which prevented ISPs from selling browsing histories without consent. In one version of the future American dystopia, your health insurance goes up every time you use the Domino’s pizza delivery app. The EU has the political will to fight against that sort of thing. The US, not so much.
Now for the Brexit bit. Look, I did warn you. Because soon, we won’t be in the EU, will we? We will be taking back control. Our new data protection bill, though, may be a test case in how little extra control we actually gain. Its main effect will be to bring the EU’s own new General Data Protection Regulation into British law. The happy spin on this is that it will “prepare Britain for Brexit”, and indeed that is what Mr Hancock has said. Yet how passive an act that feels. As the US tries to shape the internet one way, and the EU another, we are now simply spectators. Our only choice is to choose with whom to tag along. Indeed, you might almost say we have exercised our right to be forgotten already. How does it smell?