Case Study 5

260

Case Studies

Privacy and the Right to Be Forgotten

Henri was a well-known shopkeeper and café owner in a small town on the outskirts of Paris. He was thrust into a vortex of controversy in the summer of 2007 when he was falsely accused of sexual harassment by a disgruntled clerk under his employment. Henri was completely exonerated, but links to old, damaging articles in the local newspaper remained accessible through Google. That newspaper was particularly aggressive in its initial coverage of the events and did not give Henri the benefit of the doubt, despite his protestations of innocence. Years later, people still brought up the incident to him or his family, often with an accusatory tone. Henri wanted this portion of his past, full of these false allegations and innuendos, to be expunged. Since most people came across this reporting through their search of Google.fr, he had asked Google for its help in suppressing the links to these old stories. Google was not interested in responding to his repeated requests for its assistance in removing these links.

There are two attributes of internet data that cause problems for victims like Henri: internet data are both permanent and easily accessible. Web pages are rarely deleted, and sometimes those that are deleted are nevertheless preserved by caching services like Google Cache and the Internet Archive. At the same time, search engines like Google and Bing make all of those data exceptionally easy to access.

It seemed that people like Henri would never be able to control incriminating information about their past circulating on the internet. However, in 2014 the European Union Court of Justice issued a surprising court order against Google. It demanded that the search engine company remove hyperlinks that connect search engine users to content that is “no longer necessary,” or “inadequate, irrelevant, or no longer relevant.” Exceptions are warranted if there is some “preponderance of public interest” at stake. Thus, if someone like Henri asks Google to remove these links to “irrelevant” and outdated material, the search engine company must oblige this request.

The European Court’s decision was based on the “right to be forgotten,” which was cited as a basic aspect of a person’s overall privacy rights. The legal authority of this right to be forgotten is found in the Data Protection Directive adopted by the European Parliament in 1995. The Directive established a comprehensive privacy framework in the European Union, requiring that data “controllers” respect the privacy rights of all “data subjects.”

52

53

54

C o p y r i g h t 2 0 2 0 . J o n e s & B a r t l e t t L e a r n i n g .

A l l r i g h t s r e s e r v e d . M a y n o t b e r e p r o d u c e d i n a n y f o r m w i t h o u t p e r m i s s i o n f r o m t h e p u b l i s h e r , e x c e p t f a i r u s e s p e r m i t t e d u n d e r U . S . o r a p p l i c a b l e c o p y r i g h t l a w .

EBSCO Publishing : eBook Collection (EBSCOhost) - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE AN: 2332284 ; Richard A. Spinello.; Cyberethics: Morality and Law in Cyberspace Account: riocomm.main.ehost

261

1.

2.

3.

Advocates of this right claim that individuals should be able to insist on the removal of old, irrelevant material that infringes on their basic privacy rights. Skeptics of this new legal development, on the other hand, expressed their unease about the burdens placed on search engine companies like Google. There was also concern that the deletion of these links for private interests could lead to “counterfeit histories.” What about the public’s right to know this information that is now filtered out thanks to an individual’s complaints about irrelevancy?

The EU’s decision establishes a new but more precarious boundary between privacy and free speech that clearly favors privacy. The decision is in keeping with Europe’s tradition of giving equal weight to privacy and free speech rights. In the United States, however, priority is generally given to free speech rights, and so it is probably unlikely that a version of the “right to be forgotten” will be codified in U.S. law.

Google agreed to comply with the European Court’s ruling but acknowledged the difficulties with implementation. Within a few months after the ruling, Google had received over 100,000 requests for the removal of links to “irrelevant” or “unnecessary information.” The EU’s order, however, applied only to European domains such as Google.fr or Google.co.uk—not to itself. Some privacy rights advocates claim that thisGoogle.com doesn’t go far enough and that the ruling should apply globally in order to fully protect the data rights of European citizens. There are other questions about how extensively to apply European privacy rules, such as whether or not publishers should be allowed to appeal Google’s decision to remove links to their content.

Questions Do you sympathize with the plight of someone like Henri? Do you agree that the right to be forgotten is an aspect of one’s overall right to personal privacy? Has the European Union recalibrated the balance between privacy and free speech too heavily in favor of privacy? Has Google gone far enough to protect this right from being deprived?

Case Studies

Facebook’s “Unfriendly” Privacy Policies

55

56

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use

262

Facebook CEO, Marc Zuckerberg, couldn’t quite believe all the attention he was getting. Facebook was on the verge of its initial public offering (IPO), and it seemed that the media couldn’t get enough of this Cinderella story. Zuckerberg had created a primitive version of the social media application in his Harvard dorm room. Thanks to its immediate popularity, he commercialized this product and founded Facebook, a pioneer in social networking. There were 1.4 billion active users on Facebook and the company’s revenue exceeded $12 billion. As Zuckerberg traveled around the country to promote the IPO, the press followed him everywhere. The Facebook IPO took place on May 18, 2012, making many of its brash and talented managers instant millionaires by the end of 2014. Since the IPO, Facebook’s user base has expanded to 2.7 billion. It has also grown by making strategic acquisitions including WhatsApp and Instagram.

Most people at the social network company welcomed the publicity and attention surrounding the IPO. But over the years Facebook has attracted negative publicity and unwelcome attention for its controversial privacy policies. Facebook has had to deal with several embarrassing missteps as it struggles to reconcile user privacy with an open network. The company’s policies have been the object of scrutiny by the U.S. Federal Trade Commission, which has investigated a number of privacy-related complaints. Problems arise from Facebook’s business model: collect voluminous information about the user base so that advertisers can target Facebook users with more precision. This case reviews some of Facebook’s most contentious privacy policies and disputes.

Facebook first caught the attention of privacy advocates in 2007, when it implemented a technology known as the “News Feed.” This feature was designed to display in real time changes a person makes to her user profile on the home pages of all of her online friends. A Facebook user like Sally no longer had to visit the pages of all her friends to see updates since those updates were now automatically shared in a stream of data appearing on Sally’s homepage. To the surprise of the company, users initially balked at this innovation and Facebook had to abandon this default feature, but it has now become the “most valuable billboard on earth.”

57

58

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use

263

In that same year, Facebook launched an ill-fated venture known as the Beacon program, a new way to “socially distribute information.” Thanks to Beacon, advertisers and web merchants could track user purchases across the internet. A Facebook user’s purchase on a website (such as Amazon) was disclosed to his or her network of friends as soon as the purchase was made. This information was conveyed without the user’s knowledge or consent. The Facebook community protested the online tracking along with the immediate disclosure of these aspects of their personal history. As resistance mounted, Facebook abruptly ended the program.

In 2010, Facebook once again shocked many of its users by suddenly changing its privacy settings. In its early years, Facebook shared most profile fields only with friends and friends of friends. But the policy was modified so that information that was once private such as one’s profile picture, name, gender, address, professional networks, and so forth, became publicly available by default to everyone online. As one observer noted, Facebook changed the defaults to more efficiently monetize customer information and because the company “appreciated its power.” Facebook’s decision to make previously confidential information “publicly available” was reversed thanks to public protest, and users now have the capability to control access to most of their personal information.

Despite these and other problems, Zuckerberg insisted in 2010 that privacy was no longer a “social norm.” There was an expectation that people wanted to be more open about their lives and activities. Zuckerberg and other Facebook executives remained convinced that the social media company’s innovations were ahead of the convictions of its user base and not in opposition to them.

In order to expand its revenues the corporation decided to open its platform to outside developers. Programmers could build Facebook games, develop personality tests, or construct other apps. These programs were offered to users for free in exchange for information. For a few years the Facebook developer platform hosted several popular games including Farmville and Candy Crush. Facebook customers agreed to give these game developers access to their data in exchange for playing these games. However, there were no protections for the reuse of these data collected by the developers. Algorithms were extracting items such as users’ messages and photographs. One game developer used Facebook data to construct unauthorized profiles of children on its own website. Facebook had allowed for the sharing of its customer data without a system to prevent any abuses.

59

60

61

62

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use

260

Case Studies

Privacy and the Right to Be Forgotten

Henri was a well-known shopkeeper and café owner in a small town on the outskirts of Paris. He was thrust into a vortex of controversy in the summer of 2007 when he was falsely accused of sexual harassment by a disgruntled clerk under his employment. Henri was completely exonerated, but links to old, damaging articles in the local newspaper remained accessible through Google. That newspaper was particularly aggressive in its initial coverage of the events and did not give Henri the benefit of the doubt, despite his protestations of innocence. Years later, people still brought up the incident to him or his family, often with an accusatory tone. Henri wanted this portion of his past, full of these false allegations and innuendos, to be expunged. Since most people came across this reporting through their search of Google.fr, he had asked Google for its help in suppressing the links to these old stories. Google was not interested in responding to his repeated requests for its assistance in removing these links.

There are two attributes of internet data that cause problems for victims like Henri: internet data are both permanent and easily accessible. Web pages are rarely deleted, and sometimes those that are deleted are nevertheless preserved by caching services like Google Cache and the Internet Archive. At the same time, search engines like Google and Bing make all of those data exceptionally easy to access.

It seemed that people like Henri would never be able to control incriminating information about their past circulating on the internet. However, in 2014 the European Union Court of Justice issued a surprising court order against Google. It demanded that the search engine company remove hyperlinks that connect search engine users to content that is “no longer necessary,” or “inadequate, irrelevant, or no longer relevant.” Exceptions are warranted if there is some “preponderance of public interest” at stake. Thus, if someone like Henri asks Google to remove these links to “irrelevant” and outdated material, the search engine company must oblige this request.

The European Court’s decision was based on the “right to be forgotten,” which was cited as a basic aspect of a person’s overall privacy rights. The legal authority of this right to be forgotten is found in the Data Protection Directive adopted by the European Parliament in 1995. The Directive established a comprehensive privacy framework in the European Union, requiring that data “controllers” respect the privacy rights of all “data subjects.”

52

53

54

C o p y r i g h t 2 0 2 0 . J o n e s & B a r t l e t t L e a r n i n g .

A l l r i g h t s r e s e r v e d . M a y n o t b e r e p r o d u c e d i n a n y f o r m w i t h o u t p e r m i s s i o n f r o m t h e p u b l i s h e r , e x c e p t f a i r u s e s p e r m i t t e d u n d e r U . S . o r a p p l i c a b l e c o p y r i g h t l a w .

EBSCO Publishing : eBook Collection (EBSCOhost) - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE AN: 2332284 ; Richard A. Spinello.; Cyberethics: Morality and Law in Cyberspace Account: riocomm.main.ehost

261

1.

2.

3.

Advocates of this right claim that individuals should be able to insist on the removal of old, irrelevant material that infringes on their basic privacy rights. Skeptics of this new legal development, on the other hand, expressed their unease about the burdens placed on search engine companies like Google. There was also concern that the deletion of these links for private interests could lead to “counterfeit histories.” What about the public’s right to know this information that is now filtered out thanks to an individual’s complaints about irrelevancy?

The EU’s decision establishes a new but more precarious boundary between privacy and free speech that clearly favors privacy. The decision is in keeping with Europe’s tradition of giving equal weight to privacy and free speech rights. In the United States, however, priority is generally given to free speech rights, and so it is probably unlikely that a version of the “right to be forgotten” will be codified in U.S. law.

Google agreed to comply with the European Court’s ruling but acknowledged the difficulties with implementation. Within a few months after the ruling, Google had received over 100,000 requests for the removal of links to “irrelevant” or “unnecessary information.” The EU’s order, however, applied only to European domains such as Google.fr or Google.co.uk—not to itself. Some privacy rights advocates claim that thisGoogle.com doesn’t go far enough and that the ruling should apply globally in order to fully protect the data rights of European citizens. There are other questions about how extensively to apply European privacy rules, such as whether or not publishers should be allowed to appeal Google’s decision to remove links to their content.

Questions Do you sympathize with the plight of someone like Henri? Do you agree that the right to be forgotten is an aspect of one’s overall right to personal privacy? Has the European Union recalibrated the balance between privacy and free speech too heavily in favor of privacy? Has Google gone far enough to protect this right from being deprived?

Case Studies

Facebook’s “Unfriendly” Privacy Policies

55

56

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use

262

Facebook CEO, Marc Zuckerberg, couldn’t quite believe all the attention he was getting. Facebook was on the verge of its initial public offering (IPO), and it seemed that the media couldn’t get enough of this Cinderella story. Zuckerberg had created a primitive version of the social media application in his Harvard dorm room. Thanks to its immediate popularity, he commercialized this product and founded Facebook, a pioneer in social networking. There were 1.4 billion active users on Facebook and the company’s revenue exceeded $12 billion. As Zuckerberg traveled around the country to promote the IPO, the press followed him everywhere. The Facebook IPO took place on May 18, 2012, making many of its brash and talented managers instant millionaires by the end of 2014. Since the IPO, Facebook’s user base has expanded to 2.7 billion. It has also grown by making strategic acquisitions including WhatsApp and Instagram.

Most people at the social network company welcomed the publicity and attention surrounding the IPO. But over the years Facebook has attracted negative publicity and unwelcome attention for its controversial privacy policies. Facebook has had to deal with several embarrassing missteps as it struggles to reconcile user privacy with an open network. The company’s policies have been the object of scrutiny by the U.S. Federal Trade Commission, which has investigated a number of privacy-related complaints. Problems arise from Facebook’s business model: collect voluminous information about the user base so that advertisers can target Facebook users with more precision. This case reviews some of Facebook’s most contentious privacy policies and disputes.

Facebook first caught the attention of privacy advocates in 2007, when it implemented a technology known as the “News Feed.” This feature was designed to display in real time changes a person makes to her user profile on the home pages of all of her online friends. A Facebook user like Sally no longer had to visit the pages of all her friends to see updates since those updates were now automatically shared in a stream of data appearing on Sally’s homepage. To the surprise of the company, users initially balked at this innovation and Facebook had to abandon this default feature, but it has now become the “most valuable billboard on earth.”

57

58

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use

263

In that same year, Facebook launched an ill-fated venture known as the Beacon program, a new way to “socially distribute information.” Thanks to Beacon, advertisers and web merchants could track user purchases across the internet. A Facebook user’s purchase on a website (such as Amazon) was disclosed to his or her network of friends as soon as the purchase was made. This information was conveyed without the user’s knowledge or consent. The Facebook community protested the online tracking along with the immediate disclosure of these aspects of their personal history. As resistance mounted, Facebook abruptly ended the program.

In 2010, Facebook once again shocked many of its users by suddenly changing its privacy settings. In its early years, Facebook shared most profile fields only with friends and friends of friends. But the policy was modified so that information that was once private such as one’s profile picture, name, gender, address, professional networks, and so forth, became publicly available by default to everyone online. As one observer noted, Facebook changed the defaults to more efficiently monetize customer information and because the company “appreciated its power.” Facebook’s decision to make previously confidential information “publicly available” was reversed thanks to public protest, and users now have the capability to control access to most of their personal information.

Despite these and other problems, Zuckerberg insisted in 2010 that privacy was no longer a “social norm.” There was an expectation that people wanted to be more open about their lives and activities. Zuckerberg and other Facebook executives remained convinced that the social media company’s innovations were ahead of the convictions of its user base and not in opposition to them.

In order to expand its revenues the corporation decided to open its platform to outside developers. Programmers could build Facebook games, develop personality tests, or construct other apps. These programs were offered to users for free in exchange for information. For a few years the Facebook developer platform hosted several popular games including Farmville and Candy Crush. Facebook customers agreed to give these game developers access to their data in exchange for playing these games. However, there were no protections for the reuse of these data collected by the developers. Algorithms were extracting items such as users’ messages and photographs. One game developer used Facebook data to construct unauthorized profiles of children on its own website. Facebook had allowed for the sharing of its customer data without a system to prevent any abuses.

59

60

61

62

EBSCOhost - printed on 9/22/2024 11:09 PM via RIO SALADO COMMUNITY COLLEGE. All use subject to https://www.ebsco.com/terms-of-use