(Digital Rights) – Understanding the ambit of the ‘right to be forgotten’ and considering its potential application in Malaysia.

Like a ‘NeverEnding Story’, the digital age presents never ending novel challenges and opportunities for the economy, everyone and (perhaps) everything. Rapidly evolving technologies thrust the concept of digital rights into the spotlight. Digital rights, a term barely having any traction a few decades ago, now features as a central matter of day to day living and corporate affairs, to name a few.

?

At the heart of the concept of digital rights is the internet's global nature/characteristic, which blurs traditional (legal) boundaries, creating a jumble of jurisdictional complexities. The concept of privacy, for instance, confronts the realities of digital footprints, which transcend national borders.

?

On that note, getting straight into it, the Court of Justice of the European Union (EU) in the case of Google Spain SL, Google Inc. v Agencia Espa?ola de Protección de Datos, Mario Costeja González (2014) had held that an Internet search engine operator is responsible for the processing that it carries out of personal information which appears on web pages published by third parties.

?

At that time, the ruling was seen as significant/major. The concept has since been labelled as the ‘right to be forgotten’ (RTBF) or the ‘right to erasure’. The concept has also since been incorporated/codified in the EU’s General Data Protection Regulation (GDPR).

?

What is the ‘Right to Be Forgotten’?

?

We will use EU as a point of reference (in breaking down the concept) as they are the catalysts of the concept, before making assessment of the position in Malaysia.

The 'right' is detailed in Recitals 65 and 66 and Article 17 of the GDPR. It states that individuals have the right to request the deletion of personal data concerning them without unnecessary delay, and organisations have a duty to comply promptly. It is necessary to verify the identity of the person asking for data deletion to ensure they are the subject of the data.

?

This right intersects with the right to access personal data (Article 15 GDPR). Having control over one's data is essential, especially when consent for processing is withdrawn, errors in the data are significant, or the data is deemed unnecessary. However, this right is not absolute, balancing concerns about rewriting ‘history’ with the importance of data erasure. ?

?

When Does It Apply?

?

Personal data can be erased if:

?

• It's no longer needed for its initial purpose.
• The individual withdraws consent, which was the basis for data processing.
• The individual objects to data processing based on legitimate interests, and there's no overriding reason for the organization to continue processing.
• The data is used for direct marketing, and the individual objects.
• The data was processed unlawfully.
• Legal obligations require its erasure.
• The data concerns a child used for information society services.

?

There are (however) instances where an organisation's need to process data may supersede the right to be forgotten, i.e. when there are countervailing issues in relation to freedom of expression, legal obligations, public interest tasks, public health, medical purposes, research, legal claims, to name a few. Organisations might charge a "reasonable fee" or refuse a request if it's baseless or excessive.

?

While the GDPR generally poses a substantial compliance challenge for organisations, given the need to manage and track personal data storage and processing, it does not outline a specific format for erasure requests. They can be made verbally or in writing to any organisation member, not necessarily a designated contact. A request is valid even without specific/explicit mentioning of GDPR articles.

?

This can be challenging for organisations, as any employee might receive a myriad of (purportedly) valid verbal request, with the need to ascertain veracity/genuineness of all such requests. Understanding the intricacies of the right to be forgotten is therefore crucial. Each request must be considered on a case-by-case basis, reflecting the balance between individual rights and the organisation’s responsibilities under the GDPR.

?

What is the position in Malaysia?

?

The Malaysian legal framework currently does not recognise RTBF. There is ongoing discussion about whether the RTBF should be adopted in Malaysia, especially considering the current state of privacy laws and the position of RTBF in other countries.

?

Indeed, the implementation of RTBF in Malaysia is likely to some extent enhance orderly conduct in the corporate ecosystem, by ensuring better protection of personal data. It could help individuals exercise greater control over their personal information online, thereby permeating/strengthening the concept of individual privacy and data protection, a pressing need given the rapid digital/technological advancements, and the magnitude of its application to the day-to-day living.

?

Yet, adopting such a right also involves considering the balance between individual privacy and other interests, such as freedom of expression and the right to information. A comprehensive legal framework that can effectively address these concerns while protecting individual rights would need to be put in place. The potential nuances and implications of such a move would be as follows: -

?

i. Privacy vs. Public Interest:

Implementing RTBF in Malaysia necessitates a delicate balance between individual privacy rights and the public interest. This balance is crucial where freedom of expression and the right to information are also highly valued, for e.g. vis-à-vis the state of corruption of the country. The European model, while a good reference, may require significant adaptation to fit Malaysia's unique socio-legal context.

?

ii. Legal and Regulatory Framework:

Malaysia's current legal framework, primarily the Personal Data Protection Act 2010, does not recognise RTBF. Integrating RTBF would require a comprehensive review and amendment of existing laws. This process must ensure that RTBF does not contradict other legal principles or create loopholes that could be exploited.

?

iii. Technological and Implementation Challenges:

The practical implementation of RTBF poses significant technological challenges, particularly in ensuring the complete and effective removal of data from digital platforms. This requires sophisticated data management strategies and could impose substantial burdens on small and medium enterprises (SMEs) as well as larger corporations.

?

iv. Economic Impact:

While RTBF could enhance consumer trust and thus benefit the digital economy, it could also lead to increased recurring operational costs for businesses. These costs stem from the need to establish and maintain robust data deletion and management systems. This impact needs to be carefully weighed.

?

v. International Comparisons and Adaptations:

Examining how RTBF has been implemented in the EU and other jurisdictions can provide valuable lessons for Malaysia. Conversely, any adoption of RTBF must be tailored to respect Malaysia's specific legal, cultural, and societal norms.

?

vi. Safeguarding Against Abuse:

A key concern is preventing the misuse of RTBF to suppress legitimate public discourse, rewrite history, or evade accountability. Safeguards must be put in place to ensure that RTBF is not abused by individuals or entities seeking to hide information that is of legitimate public interest.

?

vii. Public Awareness and Legal Education:

Public education about RTBF and its implications is crucial. This includes educating stakeholders about their rights and responsibilities under a new RTBF framework. Legal professionals in Malaysia would also require to keep abreast to navigate these new legal waters effectively.

?

The response to the challenges posed by the digital age has been diverse across the globe. While the European Union has pioneered with comprehensive regulations like the GDPR, other regions have adopted varied approaches. The United States, for example, has a more sector-specific approach to data protection. Analysing these diverse legal frameworks offers valuable insights into the effectiveness of different regulatory strategies in managing digital age challenges.

?

To that end, the adoption of RTBF in Malaysia presents a dense interplay of legal, technological, economic, and ethical considerations. It promises enhanced privacy protections but also raises substantial challenges and concerns. A mindful approach, deeply informed by local context and international experiences, will be essential for its successful integration into Malaysian law. For enquiries please contact: [email protected].