Ctrl Z: The Right to Be Forgotten

Abstract

Ctrl+Z: The Right to Be Forgotten, by Jones, Meg Leta is reviewed.

Review of Jones, Meg Leta. 2018. Ctrl+Z: The Right to Be Forgotten. New York: New York University Press. 256 pp. US$18.00. Paperback. ISBN: 9781479876747.

What does forgiveness look like online, and when does file preservation prevent it? There are philosophical and social answers that might satisfy us, but Meg Leta Jones uses a comparative study of US and EU legal cultures in Ctrl+Z: The Right to Be Forgotten to outline a possible answer. Through this monograph, Jones complicates the popular notion of the "right to be forgotten' and shows how that right might be established in countries like the US. For readers of Surveillance & Society, it is worth mentioning that the topic of surveillance comes up mostly tangentially: Jones is more concerned with how a right to be forgotten works in an information society than detailing the surveillance mechanisms that undergird such a

society. Jones starts with the function that the societal forgetting of information, intentional or not, has in judicial systems. Often the promised rehabilitation of criminal offenders depends on society and their communities agreeing to forgive them, and forgiveness is itself the center in theories of restorative justice. It often, however, requires some forgetfulness from those who forgive. And theories of privacy intersect with "digital redemption" as well. As Jones puts it, in a liberal society, digital redemption is a restoration of privacy, where privacy is part of a person's personal autonomy. But this relationship between forgiving and forgetting is at odds in a society that records by default, and a right to be forgotten could be one solution (13). A right to be forgotten could ensure that people can pick up their social lives again or rectify unjust damages to online reputation or social

standing. Jones traces the modem origin of the European right to be forgotten to the 1966 International Covenant on Civil and Political Rights' and the 1980 Organisation for Economic Co-operation and Development's guidelines for data deletion based on data subjects' wishes, the expiration of the data's use, or court orders for deletion. Writing before the EU General Data Protection Regulation (GDPR) came into effect in 2018, Jones examines the proposed regulation. To follow the GDPR, each EU member nation had to implement their interpretation of the regulation based in the local legal culture. For example, in Germany, the right to be forgotten is part of a right to personality that guarantees people control over their public representation and only allows privacy to be infringed in newsworthy cases. The French droit á ľoubli was set in early cases about photograph dissemination and expanded in the twentieth century from its basis in tort common law into a recognized

right. While Jones couldn't analyze the GDPR's fallout, she describes the 1995 directive it is based on. She out how the ambitious ruling followed a takedown system like the US's Digital Millennium Copyright Act, which inadvertently entrusted a lot of power into company hands. While companies had to comply with takedown requests, the right to be forgotten is of such legal ambiguity that internal company policy became the de facto policy for citizens exercising their right. In most cases, people using the right to be forgotten can remove links to content but not the content itself, so the right has more in common with methods of information obfuscation than obstruction.

The US, by comparison, is more concerned with freedom of expression. Rights to privacy are usually protection against government intrusion, not private entities, and privacy is not connected to "dignity" or "personality" as it is in EU laws. And where privacy rights are found in common law statutes, they don't have constitutional force. All of this means that, so long as the information people want removed from the internet is true, or once was, it is often preserved as either protected expression or in the public interest. Ctrl+Z is not a historical book, so Jones doesn't give a full account of all the legal precedents when making these legal comparisons. Additionally, she doesn't follow countries' legal changes chronologically, which is sometimes confusing. Ctrl+Z is still, however, a useful overview of the relevant EU and US legal cultures.

The tensions within those differing legal cultures comes into relief in the two central chapters on the implications of privacy and information stewardship for the right to be forgotten. Jones quickly shows how current implementations of the right to be forgotten do not perfectly overlap with privacy concerns. For example, the takedown request system of the GDPR often concerns information that "has been properly disclosed but has become or remained problematic" (81). Similarly, both US and EU legal systems seem to treat digital information as if it will be perpetually available. Jones goes to great lengths to demonstrate that, due to the physical infrastructure of the internet, the rapid turnover of hosted websites, and link rot, researchers can't assume that information widely distributed on first publication will be available after even just five or ten years.

Jones is sceptical of the current responses to the problems of online reputation: legal regulation, personal responsibilization, and changing cultural norms. Cases of legal regulation are still so ambiguous, and research like Helen Nissenbaum's has shown that requiring individuals to manage information about themselves is an impossible task. Jones uses the examples of cyberbullying and nonconsensual pornography to show where activists and nonprofits have made a real difference in cultural norms of online reputation, but she believes norms are changing too slowly to have good effect. Jones' hope is for all models of a right to be forgotten to accurately reflect the "cycle of life" of internet information.

Most online information is preserved either through institutional or individual interest; all the rest is up to chance. The high discoverability but short life span of internet information does mirror that of newspapers (an article published yesterday is easy to find now, but harder to find as time passes), but the sporadic preservation of users and URLs makes it hard to know what will still be easy to find in five or ten years. (Jones makes a good comparison to the information ethics of archiving and archeology [112].) That information becomes decontextualized and less useful as a description of the world, although it's hard to know how it will decay.

Unpleasant facts stored on the internet might still represent someone's behavior or be relevant to current decisions, but it's hard to tell ahead of time, which can have unforeseen consequences: "Easy discoverability of expired information for immediate and remote information users can be harmful to all parties, because it generally does not support information stewardship. The harms to the subject as well as to the immediate and remote users created by expired information are rarely justified under a life-cycle approach" (135). In this way, Jones argues that a right to be forgotten is a kind of necessity since injunctions against acts of expression are so discouraged, even in European courts: it's more likely that people would need a post hoc remedy for the problems of information.

Although she views it favorably, Jones doesn't see the right to be forgotten as a "universal solution to a universal problem" (22) of reputation. Throughout Ctrl+Z, Jones argues that a harmonized international legal framework is undesirable. While technical protocols are a tempting model, they can't work for rights in practice. Jones describes privacy as a universal urge that needs culturally specific regulation (19). In this way, Ctrl+Z shows how something that looks like a novel problem posed by a new technology does not actually completely evade legal precedent and how existing legal cultures can be adapted to accommodate technological change. Jones states that her goal is to complicate the right to be forgotten, which she does through her well-woven legal comparisons and juxtapositions of theories from information science, science and technology studies, and media studies.

Still, Ctrl+Z doesn't adopt a single theoretical framework, which makes it hard to tell when Jones is making normative recommendations herself or fleshing out how a particular theory would view the right to be forgotten. The book will most likely be useful for US researchers or those who study countries with constitutional primacy for freedom of expression: Jones' recommendations, where they appear, are tailored for legal systems that have not yet developed a consistent right to be forgotten. More generally, her call for recognizing the relationship between forgetting and forgiving is a welcome one.