Legal update: media law - The right of erasure

Posts and pictures are stored by social media platforms indefinitely. Pictures showing amusing exploits of children or witty comments of teenagers may not seem so amusing or witty when the child or teenager becomes an adult.

One way in which this can bite is during the search for employment. It is no secret that, in looking to understand the individual behind the CV, employers often search social media sites. The embarrassing photo is located and the CV finds its way to the bin.

What then can an individual do to protect themselves against this type of incident? Privacy settings are important, but often these are not a sufficient guarantee that content will not be accessible. In particular, they do not assist where content about an individual is stored on the profile of a third party.

Can the law assist with the removal of the content from social media?  Well, yes. The subject of an unwanted post can use the law to complain and will often seek to remove the content by complaining to the individual poster or to the social media platform.

A complaint to the social media platform can be based on either its terms and conditions or more generally rely, where applicable, on the same laws which apply offline (data protection, copyright, privacy, harassment and defamation).

It is often possible to remove posts following a carefully worded request to the social media platform or the poster, but it is not always that simple. Different social media sites have different terms and conditions and not all respond quickly or consistently. Many social media sites have their headquarters outside England and Wales – and this can complicate matters. If a post is not removed and litigation is contemplated, it is essential to weigh up the damage which is being caused against the merits and costs of proceeding.

It appears likely that an additional legal right to request a social media platform to remove content will be available within the next year.

The Conservative party manifesto for the general election promised a new right for individuals ‘to require major social media platforms to delete information held about them at the age of 18’. The new right was referred to in the recent Queen’s speech and it is likely that it will be available to individuals within the next year.

Despite the lack of further information in the Conservative manifesto or detailed discussion around the pledge on the campaign trail, we already have some idea as to how the new right is likely to fit into the statutory framework.

In fact, the EU has been working on an update to data protection regulation for some time, which will take into account technological advances (the previous EU directive was implemented into UK law by the Data Protection Act 1998) and harmonise the regime across member states.  

Several years of negotiation between member states have resulted in the General Data Protection Regulation (GDPR) which was published in April 2016 and will come into force on 25 May 2018. The UK will still be a member of the EU at that date and, as confirmed by the UK government, the GDPR will apply to the UK until it leaves the EU.

The GDPR, as an EU regulation, will have direct effect in the law of member states. There are, however, a number of provisions which allow member states some discretion as to how they implement certain rights given by the GDPR. One area of discretion is how to implement article 17 – the ‘right of erasure’.

Article 17 of the GDPR builds on the much-publicised ‘right to be forgotten’ which established that EU citizens have the right to request that internet search engines (such as Google) remove links to certain search results that appear following a search of their name. Where the subject of a search result is a child or information relates to activities undertaken as a child, Google or the Information Commissioner’s Office are often minded to remove links to articles. When the GDPR comes into force, the right to make a similar request to any data controller (which will include social media platforms) will be codified.

The right of erasure, however, is not absolute. The GDPR outlines a number of reasons why a social media platform, for example, might justifiably refuse a request for ‘erasure’ from an individual. In most cases, it will fall to the platform to conduct a balancing exercise to decide whether the individual’s right to erasure outweighs the platform’s right to freedom of expression. This will not be straightforward and is likely to be the subject of detailed guidance and regular disputes.

Recital 65 to the GDPR indicates that, in circumstances where information relates to an individual as a child and later (at whatever age) that individual wants to remove such information, the social media platform will be encouraged to find that their right of erasure outweighs the platform’s right to freedom of expression.

It appears then that the Conservative party manifesto pledge fits nicely within the confines of article 17 of the GDPR. The devil, however, will be in the detail and the UK government needs to move quickly; there are complex issues to consider and they have less than a year to finalise the legislation. The practicalities alone will require detailed consideration and the UK government will have the difficult task of getting the social media platforms (many of which are based overseas) on board with their proposals. There may be a significant additional burden for social media platforms in administering requests and there is a risk that they will expose themselves to legal liability if they do not do so properly.

What then of the GDPR after the UK leaves the EU? The GDPR itself will fall away from the statue book, but it appears likely that the principles will be retained in domestic legislation. Whether trade with the EU is reduced or not following Brexit, a number of UK businesses will still wish to trade and transfer data to and from the EU. The EU stipulates that data transfers from a third-party country (which the UK will be) may only take place if the third-party country ensures an ‘adequate’ level of protection for personal data and transcription of the GDPR into UK law appears the likely result.

That said, the current uncertainty in UK politics means that an individual looking to use their GDPR ‘right of erasure’ might be best advised to have their ducks in a row and be ready to do so by May 2018. There is simply no guarantee as to how long the right will be available and it might be all important in securing that new job.

Hanna Basha is a partner and Nick Grant a solicitor within Payne Hicks Beach’s privacy and media law department