Two very different events took place in May 2014. As many will recall with great sadness, the Glasgow School of Art’s Mackintosh building, often considered Charles Rennie Mackintosh’s masterpiece, was severely damaged by fire when “a canister of expanding foam” used in close proximity to a hot projector, caused flammable gases to ignite. Since that time, conservation efforts have been ongoing to reopen the Mackintosh building in 2018.

Elsewhere in May 2014, the Google Spain case was being heard at the European Union Court of Justice.

The Right to be Forgotten (GDPR).

Case Summary

The ‘Right to be Forgotten’ (RTBF) was actualised by the Court of Justice of the European Union (CJEU) following its ruling in May 2014 in Google Inc. vs. Agencia Espanola de Proteccion de Datos (aka the Google Spain case). The court ruled that personal information about a Spanish citizen, Mario Costeja Gonzalez, relating to his home being repossessed in 1998 could be removed from search engine results and that any EU citizen could apply to search engines to request that certain links be removed where they are “inadequate, irrelevant, or no longer relevant”. This controversial ruling, has since become the key pillar, Article 17, of the EU’s General Data Protection Regulations (GDPR) set to become law automatically in every EU member state on 25^th May 2018 (Ruaraidh, 2016).

The ruling affects not only search engines but any organisation that hosts EU citizens’ information or does business in the EU. (Werfel, 2016). Google’s reaction to the ruling was to de-list search results from the domain extension the delisting request originated from (e.g. Google.de for Germany and Google.fr for France). However, the results could still easily be seen if you utilised a different domain extension; such as Google.com. As a result, France slapped a $112,000 fine on Google for its refusal to remove results outside of France. Consequently, Google now utilises geolocations to determine which country the searcher is searching from and de-lists all affected search results accordingly, regardless of domain extension; thereby “obeying the letter of the law, if not the spirit.”(Tarantola, 2016).

 

Importance of the Case:

The case has been described as a breakthrough in data protection leading to “a brave new world” (Ruaraidh, 2016) while, at the same time, trampling the ‘right to know’ and marking “the beginning of the end of the global internet, where everyone has access to the same information.” (Granick in Toobin, 2015)

I find the ‘Right to be Forgotten’ as a central pillar of the GDPR a really fascinating subject. The arguments on both sides are really pertinent ones for right now: the ‘right to be respected’ (Ruaraidh, 2016) or ‘right to privacy’ on the one hand versus freedom of information or ‘the right to know’ on the other. Not least because Toobin (2014)’s article in The New Yorker showed both the risks of having a ‘right to be forgotten’ which can be abused (e.g. a Croatian pianist asking for a bad review in the Washington Post to be de-listed) versus the case of the Catsouras family in the USA who were the subject of a chapter in Werner Herzog’s new movie ‘Lo and Behold: Reveries of the Connected world’(2016). The Catsouras case involves a family where their teenage daughter tragically died in a car crash. Mr. & Mrs. Catsouras, along with the daughter’s siblings, had a memory of their daughter that they held on to which was shattered when the police crime scene photographs, taken by the Californian Highway Patrol, somehow came into the public domain and went viral. Suddenly Mr. & Mrs. Catsouras were confronted with graphic images of their daughter’s body decapitated in the fatal accident. So far their attempts to get the pictures de-listed or removed from the internet have been thwarted because the US has no ‘right to be forgotten’ so the fact the GDPR includes it as its central pillar, Article 17, means that the father, Christos Catsouras has said the European Court of Justice ruling represented a “broader victory. “I cried when I read about that decision,” he told me. “What a great thing it would have been for someone in our position. That’s all I wanted. I would do anything to be able to go to Google and have it remove those links.”(Toobin, 2014).

Google processes 90% of searches in Europe (Fioretti, 2014) and has reviewed in excess of 1.5 million webpages, de-listing 40% of them across Europe (Lumsden 2016); effectively creating a library where book titles are removed from the searchable catalogue. The books are still there “but their existence would be unknown and therefore, their access made more difficult.“(Gratton, 2016).

Wikimedia understandably are not a fan of what the Right to be Forgotten means in practice:

“Accurate search results are vanishing in Europe with no public explanation, no real proof, no judicial review, and no appeals process… the result is an Internet riddled with memory holes – places where inconvenient information simply disappears.”(Tretikov in Fioretti, 2014).

While Google claim the CJEU ruling forces them into a role they are uncomfortable with i.e. deciding what is & is not included in their ‘card catalogue’ (Walker in Toobin, 2015); others maintain that Google’s role has always been more than passive intermediary; therefore “if you’re going to be in the business of search then you need to take on privacy obligations.” (Rutenberg in Toobin, 2015). Forcing private companies to become judge & jury on public searching can hardly be ideal however; especially when Google notifying affected sites can, ironically, increase public scrutiny through what’s been termed ‘the Streisand effect’.

The GDPR will certainly toughen the penalties for non-compliance of these privacy obligations. Previously, £500,000 was the maximum penalty in the UK for breaching privacy rules. Now organisations will be penalised 4% of their turnover, or twenty million Euros, whichever is greater (Davidson, 2016). Organisations, therefore, will need to know & understand the data they hold on individuals in much stricter way. For some, this is a triumph, heralding a new ‘right to be respected’ (Ruaraidh, 2016). Others see it as Balkanizing the internet; resulting in a race to the bottom to see which country’s laws can apply the most pressure on Google (Zittrain in Toobin, 2015).

 

Implications

The debate over freedom of information vs. the right to privacy will continue to be a source of heated debate. While IM professionals should be very wary of Right To Be Forgotten compromising a record’s integrity & trustworthiness, tighter data protection protocols for UK organisations are likely to become the norm from here on.

Advice from the Information Commisioner’s Office, and independent legal firms, is to start planning your approach to GDPR compliance now (Rustici, 2016). The 2018 deadline is not far away for an institution the size of Edinburgh University to get prepared for with 37,510 students (2015/2016 Student Factsheet) and 13,818 staff (Sept. 2016 HR factsheet). While Brexit creates great uncertainty on the UK’s adherence to EU laws, the likelihood is that, regardless of Brexit, UK Higher Education Institutions will still have to comply with the GDPR. (Rustici, 2016)

Google could, post Brexit, lobby the British court not to adhere to RTBF in the UK however the ICO are advocating the terms of the Data Protection Act (1998) be extended as a way of ensuring UK organisations adopt a stricter data protection strategy more in line with GDPR (Lambe, 2016). While research is currently exempted by the GDPR, Edinburgh University would appear to still be bound to it in that it processes personal data of EU subjects. Therefore, the university will have to ensure it puts a plan in place ensuring a culture of ‘privacy by design’. (McCall, 2016).

This means implementing the ICO’s 12 steps including: designating a Data Protection Office; reviewing rules governing data erasure & portability; getting I.T. to map out & review the data processes throughout the university and how data is shared with 3^rd parties; liaising with HR to raise awareness of data protection throughout the university. Reviews of data protection policies and how consent is given & recorded. Data breach protocols will have to be tightened up and any breach must be reported to the ICO within 72 hours. Subject Access Requests will no longer be charged for and must be responded to within a month.

Ultimately, the university may need to ensure it is far more familiar with its data processes & its data protection strategies than it is at present. This may mean that they will better understand the value of the data that it does keep but it is likely that, in seeking to avoid liability, they will err on the side of increased erasure of data rather than less; resulting in ‘premature forgetting’ (Sartor, 2016). The balancing act remains a delicate one but it is something for ‘custodians of the record‘ to prepare for in their increasingly pivotal role.

“If the record is to mean anything, now and in the future, it has to have integrity, intactness, trustworthiness, and that can’t be the case if individual people have the opportunity or right or authority to pick and choose and prune and primp the way they are portrayed.” (Joseph Janes, 2016, American Libraries)

Meanwhile…. at the Glasgow School of Art Archives

While organisations around the UK prepare for the GDPR coming in 2018, the Glasgow School of Art archives had to move following the Mackintosh fire to take up residence in their new temporary home of The Whisky Bond site until the Mackintosh building reopens in 2018.

The World War One Roll of Honour Project

Thankfully, the Glasgow School of Art’s WW1 Roll of Honour survived the fire.

GSofA’s First World War Roll of Honour was designed and made by former GSA student Dorothy Doddrell in 1925 to commemorate the efforts of GSA staff, students and governors who served in WW1.

With the support of the Centenary Memorials Restoration Fund, it also underwent conservation in 2014.

The memorial is now temporarily on display in GSofA’s Reid Building where it will remain until it can be reinstated in the Mackintosh Building following the completion of restoration work to the building.

The Roll of Honour takes the form of an illuminated parchment in paint and gold leaf set within a substantial copper and wood framed triptych.

Unlike most war memorials, the Roll of Honour records the names and regiments not only of those who died, but also of over 400 GSA staff, students and governors who served in the war.

A recently discovered advertisement placed in the Glasgow Herald on 1 November, 1920 shows that the School of Art required the support of the wider public (or at least the readership of the Glasgow Herald) in collating the necessary information in order to deliver a suitable memorial.

Researching the names on the WW1 Roll of Honour

• In 2015 a research project, supported by a Scottish Council on Archives’ and Heritage Lottery Fund Skills for the Future traineeship, sought to explore and document the stories behind the names recorded on the Roll of Honour.
• A team of volunteers is now continuing with this research, using original material from GSA’s rich archives and collections to create biographies of those staff and students who feature on the memorial. The resulting biographies have and will continue to be made available on the Archives and Collections online catalogue: www.gsa.ac.uk/archives.

How it worked

• The investigation process begins with scouring the GSA’s student registers for any recorded instances relating to a listed name which may give an indication of the years they studied at the GSA, the classes they attended, which teachers they had, where they lived, what job they performed and so on.
• Consulting a number of other sources: census records, birth certificates, death certificates, marriage records, medal cards, regiment histories, photographs as well as any notable artworks or architectural designs bearing their name.

I was a volunteer on the WW1 Roll of Honour project.

William Lindsay Renwick was one name on the roll of honour that I researched among many others: a University of Glasgow graduate, he undertook bookbinding classes at the Glasgow School of Art before becoming a professor of English Literature at Durham University and Edinburgh University where he was the founder of the School of Scottish Studies. William Lindsay Renwick fought at the Battle of Loos during World War One where he felt ‘like a ghost, an old ghost, sceptical and disillusioned.’”

Professor William Lindsay Renwick is commemorated on The Glasgow School of Art’s First World War Roll of Honour.

The research I undertook changed the way I viewed war memorials. It shouldn’t have but it did. I realised the name on the Roll of Honour was just one part and there was much more to be said: places lived in; jobs undertaken & where; family members; wives; children; the subjects they studied; their notable artworks; their achievements; the regiments they served in; the battles they fought in; the lives cut short and those lived afterwards; where they married; what they did; how they died. Uncovering the life story behind each name was detective work of the most rewarding kind.

As part of last week’s Samhuinn Wikipedia editathon to honour the dead, we created 16 new articles to remember notable lives & contributions; one of which was on William Lindsay Renwick who founded the School of Scottish Studies. Hence, while the debate about the Right to be Forgotten is an important one, it has to be balanced against the importance of remembering. And that’s where Wikipedia can play a vital role in ensuring digital provenance where the record is trustworthy, reliable and remembered.

• Read about the names on the Glasgow School of Art’s WW1 Roll of Honour here.
• Find out more about the Glasgow School of Art’s WW1 Roll of Honour here.
• Read a timeline of the University of Edinburgh at Our History.
• Read the University of Edinburgh Roll of honour here.

Eugene Bourdon exhibition 5th November to 4th December 2016

From 5^th Nov – 4^th Dec the Glasgow School of Art Archives and Collections are actually holding an exhibition in GSA’s Reid Building of the work of GSA’s first professor of architecture Eugene Bourdon (see here for more info: http://gsapress.blogspot.co.uk/2016/07/the-gsa-to-mark-centenary-of-his-death.html). To accompany the exhibition the A&C team will be providing a series of lunchtime talks (dates to be confirmed), one of which will be about Eugene Bourdon (who died at the battle of the Somme) which you would be more than welcome to attend.

References

1. Arthur, Charles (2014-05-14). “Explaining the ‘right to be forgotten’ – the newest cultural shibboleth”. The Guardian. ISSN0261-3077. Retrieved 2016-10-29.
2. Bartolini, Cesare; Siry, Lawrence (2016-04-01). “The right to be forgotten in the light of the consent of the data subject”. Computer Law & Security Review. 32 (2): 218–237. doi:1016/j.clsr.2016.01.005.
3. Bygrave, Lee A. (2014-12-01). “A Right to Be Forgotten?”. Commun. ACM. 58 (1): 35–37. doi:1145/2688491. ISSN0001-0782.
4. “Right to be forgotten”. Wikipedia. 2016-10-27.
5. Janes, Joseph. “Forget Me Not”. American Libraries Magazine. 2016-05-31. Retrieved 2016-10-29.
6. Davidson, Colette (2016-04-15). “How Europe’s new privacy rules affect entire digital economy”. Christian Science Monitor. ISSN0882-7729. Retrieved 2016-10-29.
7. Dent, S. (2016). France fines Google for breaking ‘right to be forgotten’ law. Retrieved 2016-10-29.
8. Fioretti, Julia (2014).“Wikipedia fights back against Europe’s “right to be forgotten””. Reuters. 2016-08-06. Retrieved 2016-10-29.
9. Engineering, NYU Tandon School of. “NYU Researchers Find Weak Spots in Europe’s “Right to be Forgotten” Data Privacy Law”. www.prnewswire.com. Retrieved 2016-10-29.
10. “Forget.me”. Forget.me. Retrieved 2016-10-29.
11. Gollins, Tim (2016-07-02). “The ethics of memory in a digital age: interrogating the right to be forgotten”. Archives and Records. 37 (2): 255–257. doi:1080/23257962.2016.1220293. ISSN2325-7962.
12. Gratton, E. (2016, May 10). ‘Right to be forgotten’ wrong for canada. National Post Retrieved from http://search.proquest.com.ezproxy.is.ed.ac.uk/docview/1787892489?accountid=10673
13. Kerr, J. (2016). What Is Search Engine: The Simple Question the Court of Justice of the European Union Forgot to Ask and What It Means for the Future of the Right to Be Forgotten. Chicago Journal of International Law 17(1), 217-243.
14. Lambe, John (2016). “Data Protection and Brexit: The implications for UK businesses – Hillyer McKeown”. Hillyer McKeown. 2016-07-05. Retrieved 2016-10-30.
15. Lambert, Paul (2014). International Handbook of Social Media Laws: Chapter 1 Introduction and Right to Be Forgotten. Practicallaw.com. Retrieved 2016-10-29.
16. Lardinois, Frederic. “Google now uses geolocation to hide ‘right to be forgotten’ links from its search results”. TechCrunch. Retrieved 2016-10-29.
17. Lecher, Colin (2016-03-04). “Google will apply the ‘right to be forgotten’ to all EU searches next week”. The Verge. Retrieved 2016-10-29.
18. org (2016).“The new EU General Data Protection Regulation: why it worries universities & researchers – LERU : League of European Research Universities”. www.leru.org. Retrieved 2016-10-30.
19. Lloyd, I. G. (2008) Information Technology Law.5^th Oxford University Press: Oxford.
20. Lunden, Ingrid. “Google files appeal in France opposing an order to apply Right to be Forgotten globally”. TechCrunch. Retrieved 2016-10-29.
21. MacCarthy, M., 2016. Don’t let the rhetoric fool you: The U.S. and the EU share common ground on privacy. com.
22. McCall, Rebecca (2016). “Will you be ready for the General Data Protection Regulation?”. Association of Heads of University Administration. 2016-05-31. Retrieved 2016-10-30.
23. McSmith, Andy (2016). “15 EU laws we will miss in post-Brexit Britain”. The Independent. 2016-06-25. Retrieved 2016-10-30.
24. Myers, Cayce (2016-04-24). “Digital Immortality vs. “The Right to be Forgotten”: A Comparison of U.S. and E.U. Laws Concerning Social Media Privacy”. Romanian Journal of Communication and Public Relations. 16 (3): 47–60. doi:21018/rjcpr.2014.3.175. ISSN2344-5440.
25. Robertson, Adi (2015-11-25). “Google ‘right to be forgotten’ requests keep piling up”. The Verge. Retrieved 2016-10-29.
26. Robinson, D. (2016, Feb 12). Google extends ‘right to be forgotten’ EU-wide. Financial Times Retrieved from http://search.proquest.com.ezproxy.is.ed.ac.uk/docview/1772628888?accountid=10673
27. Ruaraidh, Thomas, (2016). New rules boost data privacy rights. Financial Adviser.
28. Rustici, Chiara (2016). “Don’t think that Brexit will save you from the EU data protection rules”. ComputerWeekly. Retrieved 2016-10-29.
29. Rustici, Chiara (2016). “Start getting ready for Europe’s new data protection regulation today”. Help Net Security. 2016-02-26. Retrieved 2016-10-30.
30. Sartor, Giovanni (2016-03-01). “The right to be forgotten: balancing interests in the flux of time”. International Journal of Law and Information Technology. 24 (1): 72–98. doi:1093/ijlit/eav017. ISSN0967-0769.
31. Schindler, Ellis (2016). “Will the Right To Be Forgotten be just a memory? | Himsworths Legal Consultancy”. www.himsworthslegal.com. Retrieved 2016-10-30.
32. Tarantola, Andrew (2016).“Google changes how it scrubs ‘right to be forgotten’ people”. Engadget. Retrieved 2016-10-29.
33. Information Commissioner’s Office (2016). (“The right to erasure (the right to be forgotten)”. ico.org.uk. 2016-07-07. Retrieved 2016-10-30.
34. Toobin, Jeffrey (2014). “Google and the Right to Be Forgotten”. The New Yorker. Retrieved 2016-10-29.
35. Werfel, E (2016). ‘What Organizations Must Know About the ‘Right to be Forgotten’, Information Management Journal, 50, 2, pp. 30-32, Business Source Alumni Edition, EBSCOhost, viewed 29 October 2016.
36. Williams, Rhiannon (2015). “Telegraph stories affected by EU ‘right to be forgotten'”. Telegraph.co.uk. Retrieved 2016-10-29.
37. Youm, Kyu Ho; Park, Ahran (2016-06-01). “The “Right to Be Forgotten” in European Union Law Data Protection Balanced With Free Speech?”. Journalism & Mass Communication Quarterly. 93 (2): 273–295. doi:1177/1077699016628824. ISSN1077-6990.
38. Young, Mary (2016). ‘The risks of deleting history’. Solicitorsjournal.com. Retrieved 2016-10-29.