Is the EU forgetting Freedom of Expression? The EU General Data Protection Regulation

Is the EU forgetting Freedom of Expression? The EU General Data Protection Regulation - Digital

The EU General Data Protection regulation (GDPR) will replace the current patchwork of 28 different data protection laws in EU. However, as its adoption draws near, concerns remain around its implications for freedom of expression, particularly in its approach to the right to erasure (“the right to be forgotten”).

For this reason, ARTICLE 19 and the Electronic Frontier Foundation (EFF) have written a joint statement addressing EU policy makers, and provided a joint comment on the content removal processes defined under Article 17 of the GDPR.

Article 17 GDPR provides for a ‘right of erasure’ for data subjects. In the wake of the Google Spain v Costeja case, EU institutions have seemingly gone much further than the judgment itself and provided for a notice-and-takedown regime which is incompatible with the Manila Principles and fails to include even the limited protections available under the E-Commerce Directive.

In short, ARTICLE 19 and EFF argue that the GDPR’s content restriction regime fails to strike the appropriate balance between the rights to data protection and freedom of expression, ignoring the right to freedom of expression of content providers.

In particular:

  • It provides for a new system, in which it is very easy to get content taken down, but very hard to identify or correct wrongful removals.
  • It introduces an important shift: from the presumption that online expression is permitted until proven otherwise, to the presumption that any challenger is right, and content is thus to be removed. This is dangerous because intermediaries receive many groundless requests. It is also well documented that intermediaries have a tendency to avoid risk and transaction costs by simply removing content which has been subject to complaint.
  • There is no provision for mandatory notification of the writers or publishers of the articles at issue, preventing them from appealing the decision of the intermediary to erase their content.

ARTICLE 19 and EFF fully support the strong protection of personal information. However, the GDPR in its current form lacks basic safeguards that would at least allow the case for freedom of expression to be made. There is still time however for amendments to be introduced: EU policymakers should seize this opportunity, before it is too late.