Friday, 5 November 2010

EU to create "right to be forgotten"

As the public's concern over internet privacy violations on sites like Facebook continues to grow, the EU unveiled new proposals yesterday to give people more control over how their online personal data is collected and used. The new update to EU privacy laws would oblige service providers to make personal information and user-supplied content easily and quickly deletable. Citing the effect such information can have on a person's professional and private life, the European Commission says the issue is important enough to take EU-wide action. The commission says it has even received complaints from its own staff about Facebook's privacy policy. And that must be a big deal, because most of the people I know who work for the commission are on Facebook all day!

Perhaps the most interesting thing about the proposal is that it would create a new right for EU citizens, a so-called "right to be forgotten." The original EU data protection rules date back to 1995, when such issues of online privacy did not yet exist. In theory the right to control over one's own personal stored information is already enshrined in EU law, but the commission said yesterday its applicability to the online world has been patchy and unclear.

 The proposals, which now come in the form of a strategy paper that is open to public consultation, would also increase portability of information. Users would be guaranteed the ability to transport their information from one site to another. The idea behind this being that users are often held captive to sites like Facebook or a photo-sharing site like Flickr because they don't want to lose years of the content they've created by leaving. The commission says the ability to easily move your information and content to another site would ensure that the online service providers like Facebook aren't able to suddenly change their privacy policies in a way which is unpopular with most of their users without users leaving the site in droves.

There was much complaining from users when Facebook changed its privacy settings earlier this year, and I noticed many users were posting threats that they would leave the site over the change. But out of all those people, I only know one person who actually deleted his profile over it. Most users likely felt that they had no choice but to keep their profiles or risk being shut out from what many now consider an essential social communication tool.

Of course not all the changes proposed apply to Facebook. Much of the new law would also target Google and its information-collecting practices. The proposal would require that sites like Google make it clear when they are collecting cookies, small pieces of information about users as they navigate from site to site, for use with tailored advertising. It would also require Google to make it easy and clear for users to block the collection of this information. One way this may be done is by requiring Google to only collect this information if users opt-in to it, rather than doing it by default unless the user opts out.

The commission is conducting a public consultation on the strategy paper that will close in 15 January, and all people, businesses and NGOs are invited to contribute. After January the commission would draw up specific legislation that would then need to be approved by the European Parliament and member states.

Just how seriously is the commission taking this issue? That's a bit unclear. It was notable that EU Justice Commissioner Viviane Reding, who is launching the strategy paper, was not present at the press briefing yesterday. She instead sent three directorate officials to present the new policy, because she had a scheduling conflict we were told. But it seems strange that the commission wouldn't wait to present this until she was available. It also seems odd to me that this initiative isn't being spearheaded by the new "Digital Agenda" commissioner Neelie Kroes. That position was just created last year for the notorious former competition commissioner, and since then I've been quite confused about what it's supposed to be. If this isn't the type of thing Kroes is now doing, then what is she doing??

1 comment:

Lars said...

You're right, I'm surprised Kroes doesn't have any involvement in this. If Reding was unavailable for the announcement, couldn't Kroes have at least filled in? With all of the attention Reding has been trying ot attract to herself lately, I'm surprised she didn't want to make sure she was front and center at this announcement!