Hacker News Reader

You make a good argument about why she has an interest in not being found/identified with this information. To be sure, there are good reasons why she would want to distance herself from this event in her life. By the way, that is the reason that many newspapers (e.g., the NYTimes)have policies against reporting the names of rape victims, precisely because of the stigmatic effects on the victim.

But why is her interest in privacy sufficient to create a right protected by the law? What about the conflicting interests--including existing legal rights--of others to learn about and to publish that information? What concerns me the most is the unimaginably fraught task of administrating these rights. The EU Court suggested a highly problematic standard: data that is "inadequate, irrelevant, or no longer relevant" must be deleted upon request. Who decides what is adequate and relevant? Relevant to whom, and for what? Adequate for what? Is relevance now the standard for what information can exist online? Who is the arbiter of relevance?

And how is this administered as a technical matter? Does Google delete the entire article, or just redact the sensitive information? What if there is other important information in that same article/site/page? Does the public now lose access to the entire article, which surely contains other useful information?

This policy seems extremely ill-advised.

> But why is her interest in privacy sufficient to create a right protected by the law?

No new right has been created.

The ruling clarifies the overlap between existing laws.

The right to privacy is already there as a fundamental right within EU law. The ruling is pretty clear that data processing must respect the fundamental rights and freedoms of a person, specifically including privacy.

The ruling states that whilst Google had the right to process the data at the point in time in which it did so, it no longer had the right at a later point in time.

The record of fact remains as a historical document, but the ruling is very narrow and says that the data processing of those facts (displaying of search results) may, at a later date, be in conflict with a persons fundamental rights. At such a point in time, the data processing isn't permitted.

As with most things regarding the EU, if you sit down and read it a lot of it is fairly dull, pragmatic and reasonable.

Fair enough, you're correct that no new right was created in the EU. I was reading your comment as defending the concept of it as a right, and so I took issue with the notion that it should be a right.

Reading the opinion does not allay my concerns about the meaning of this opinion and the scope of its consequences. It is only "pragmatic and reasonable" to the extent that you agree with the policy underlying the opinion, which I certainly do not.

Taken at face-value, it would seem that the EU is effectively denuding the internet of its power for disseminating knowledge quickly and cheaply, and thereby democratizing the processes of determining truth. The court has approved a pernicious form of content restrictions that will be based on the utterly toothless (not to mention absurdly subjective) standard of "relevance," and driven by individuals whose interests are contrary to the public interest in information.

Like I said before: relevance to what? The fact that this opinion is issued in a case where the party objected to a record of his previous foreclosure--a fact with undeniable relevance to, e.g., future lenders or business partners or anyone else who needs to know someone's credit history--indicates just how high the standard for relevance will be.

In my view, giving government (or any powerful corporation or individual) the power to curate the information available to citizens is one of the greatest threats to a vibrant, functioning democracy. We should be extremely wary of any efforts by the government to be the arbiter of truth, and while I don't know enough about the case or EU law to predict how this will work in practice (in fairness to the EU, they very well could administrate this with considerable restraint), I think we should be wary of this opinion as well.

I think when it comes down to it one has to determine which law trumps another.

In this case we have laws about privacy (human rights, foundation of democracy) vs laws about freedom of expression (press, transparency).

Where there is an overlap the top courts must determine which one is more important. In this case they determined that privacy is more important, in a way that didn't remove the factual record but limited data processing so that both things could be preserved and protected.

I do agree with that, even though I probably share the opinion everyone else seems to have that transparency and freedom of press is also really really important. But for me, I personally think without privacy you cannot have democracy, which in turn serves to protect openness. And that does mean that there is this conundrum built-in to democracy, as the very foundation is built on not being fully transparent and what if that's what the people are asking for.

When it comes to good laws, its not just about which values trump others in theory, but the real costs and side effects of the specific law trying to hold one above another.

The costs and abuse inherent in all humans being able to force privacy takedowns are beyond colossal. How on earth can a search company afford to provide human judgement for each request? If humans don't arbitrate requests, how is anyone going to know that material was removed for bad reasons?

I would worry that this law would create problems, but in my opinion it will be proven unenforceable. Seriously, what is Google supposed to do with 100,000,000 people's personal lists of takedown requests?

If anyone can see a way this could actually be done economically I would like to hear it.

>But why is her interest in privacy sufficient to create a right protected by the law? What about the conflicting interests--including existing legal rights--of others to learn about and to publish that information?

Because for thousands of years of civilization, the possibility of not being constantly publicly reminded of one's past, even if it was a crime he was found guilty of decades ago or some dumb or embarrasing thing he once said, was one of the most humane things.

We shouldn't abolish that freedom to be forgotten, just because machines enables us to abolish it. Technology should be a tool, like in optimistic sci-fi, not a master, like in dystopias.

I don't deny that the easy availability of mass amounts of information about people on the internet has serious, troubling privacy implications, has magnified the importance we ascribe to that information, and has made it more difficult to escape incidents in our past.

But this isn't a freedom with a long-standing history. Far from representing a break with history, this tradition--wherein reputations are sticky and inescapable--is consistent with how human societies lived for thousands of years. Until relatively recently (~100 years ago), the vast majority of people lived in the same town for their entire lives, and there was a collective remembrance of their character. Everybody knew everybody's business, and preserved it through gossip. At least partly out of necessity, our cultures evolved significant traditions of society-wide shaming; stealing an apple could be punished by public shaming in the stocks in the town square. Social acceptance and even livelihood was based on your character, and the punishment for even minor moral failures was severe.

I submit that reputations were only escapable in a meaningful way for maybe the past 75-100 years, when our cultures (at least, industrialized cultures) became increasingly mobile: people left home to pursue education on the other side of the country, to begin careers and new lives in new cities without a trace of their old lives and reputations. This ability to escape your past and reinvent yourself was a brief aberration. The size of our communities exploded in the last 15 years as the internet expanded, and it seems not that different from when we lived in teeny communities and everyone knew our business.

There isn't and never has been a statute of limitations for dumb and embarrassing things. Whether to create one now is a normative question, and regardless of how you come down on that, I just don't think you can justify robust privacy protections--particularly at the expense of transparency--based on supposed historical respect for privacy.

>But this isn't a freedom with a long-standing history. Far from representing a break with history, this tradition--wherein reputations are sticky and inescapable--is consistent with how human societies lived for thousands of years.

I'm not so sure about that. For thousands of years you could go to another village, city or country and escape your past completely. With technology like Google this is not possible. And people you didn't know didn't have any way to know your face, unlike now with photographs and videos available.

OTOH, yes, in some small village your reputation stayed with you. But:

a) That reputation was built on mostly serious stuff people would remember about you -- perhaps an adultery, that you were a drinker, that your father was a thief etc. They didn't have a permanent record of every BS you said or done, e.g stuff you casually said when you were 14 or some misguided act you did at some obscure place at 23.

b) That reputation was mostly based on heresay. Not hard evidence, like photos, videos, profiles, etc. It was softer, and much less encompassing. And people not directly present when you did something, only heard about it from others, with less important stuff just getting forgotten naturally.

c) People could (and did all the time) change residence to escape an ill reputation.

Unfortunately freedoms actually come with costs in the real world, which is why freedoms are never absolute.

Who pays for the immense amount of arbitration necessary to allow a billion internet citizens to file takedown requests while not essentially giving every politician, criminal and bozo the right to erase information they don't like about themselves?

Unfortunately it is (sometimes) difficult to force technology to comply to our arbitrary social norms. See a lot of the examples of special cases and complications in this thread. A better example is the attempts to enforce copyright law on the internet.

I don't disagree with you, I'm saying it's rarely as simple as just banning X, once technology makes X possible.

yes but an emplyer can still find that information. it still exists. the record is either public information or not. there's no middle ground. a record being "public but must be made really difficult to find" is completely illogical. and a scene from hitchikers guide to the galaxy

These two things are not illogical.

The record can exist and it might be a breach of someone's fundamental right to privacy to make that record available via data processing.

The ruling did not state that the record will not cease to exist or would not be accessible, but that data processing of the information could be a breach of the person's right to privacy.

Another example: Let's say Bob actually only did commit a very minor crime. In the EU the ability to rehabilitate is protected by law. Only certain government departments have the right to access certain classes of crimes on a criminal record after n years.

If you were to make a database of court judgements (nearly all of which are a public record of fact), and make available Bob's criminal record after n years had passed. You would definitely be in breach of the law.

This has existed in law for a long time and isn't completely illogical.

Read the ruling, it acknowledges records of fact and states that the right to process those records doesn't trump the fundamental rights.

It's why they're called fundamental rights and data processing isn't on that list of fundamental rights.

What a library that keeps physical copies or microfiche of newspapers reporting the crime. Do they have to cut out the articles? If not, what about any indices - do they have to find and remove references to Bob from any physical indices? Or only ones that are computerized?

The ruling was very clear, read it. The ruling clarified "data processing" of the records, not the existence of the records.

Google, as a search engine, performs data processing. That it holds the record wasn't touched by the ruling, but the press has mentioned "removed" when actually it is "don't data process" which has the effect of ensuring the record doesn't appear on a results page, but does not actually remove the record from existence.

Right, but as content is computerized, just about anything is data processing.

Wikipedia says that the definition of processing according to the directive is: "any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;"

Indexing is obvious. A library's internal index system does data processing. If it indexes it's own collection, it would appear to be subject to this ruling, so that a person could demand that they are removed from the library's index systems, while still remaining in the archive.

What about machine translation? That seems like retrieval and adaption. Do all generic translators have to have provisions for privacy?

Browsers do retrieval to render pages. Do browsers need a list of verboten web pages that they refuse to render?

The law expects people to apply reason and judgement, not seek technical obfuscation.

Another example: in Sweden I can walk into the tax office and find out how much someone earns. I just need to ask. But I can't bulk download this information. That isn't available. This prevents easy and obvious abuse, but invites investigative journalism for example, but requires some effort.

what if the investigator is investigating astory involving salaries?

He can do the footwook and find out anything he wants. But it takes effort, and the effort is a mechanism that prevents abuse of the system.

>a record being "public but must be made really difficult to find" is completely illogical.

Actually it makes perfect sense. Making it difficult adds a barrier. You don't have to make it impossible to prevent something from happening. Sure, you might not stop the most determined people, but you'll stop millions of cases by just making it harder.

It's not black or white -- as a lot of security people use to think for similar things like "security by obscurity" etc. Most of the time your adversary is not some highly capable entity, but just common folks who'd give up at the first barrier.

What's about Bob? Should employer be able to Google Bob?

Yes and no.

In the EU, Bob is dealt with by various laws that cover the rehabilitation of offenders.

A petty crime is essentially wiped from public record after some period of time, and a major crime isn't.

Bob's rights depends on what he is convicted of, if he is convicted at all. And in the case of a sex-crime or violent crime, then there are further laws that cover that.

It depends what Bob did, and importantly whether he was convicted of it.

The ruling doesn't conflict with existing law, it clarifies and extends existing law.

Not exactly correct. If bob is accused of rape then he can be named as an alleged rapist. If he is acquitted of the charges and you Google his name you will still see the rape charges story and perhaps the "acquitted" story is buried or just not in the first few pages of results. Worse still if charges are dropped then all you will really find on Google is the fact he was arrested for rape.