Right to be Forgotten - Right to Privacy in the Internet Age Abstract The first chapter of the diploma thesis aims to identify the threats to human privacy and forgetting that were brought on by the advancements in the field of information and communication technology in the recent decades. Both privacy and forgetting have important functions in the life of the individual, as well as on the societal level. The protection of those functions, whose analysis can be found in the second chapter of the diploma thesis, is one of the basic tasks of modern, liberal and democratic societies. Unless we want to leave the evolution of our civilization up to the technological developments and their often unforeseen (and unforeseeable) consequences, it is imperative that we systematically evaluate their impact on society. Such evaluations should then serve as bases for devising regulation (both legal and non- legal) that would eliminate or at least mitigate the identified societal threats. In the context of human privacy and forgetting, one of the outcomes of such an impact assessment and regulatory consideration is the right to be forgotten. This right can be seen as a legal instrument protecting the informational aspect of human privacy, or rather the informational self-determination of individuals, in the new reality...

Unlimited retention of personal information on the web may harm individuals: employers can find youthful indiscretions on social media, and incorrectly low credit scores may haunt individuals for a lifetime. Currently, Europe revives the "right to erasure" as a first step towards a forgetting web. Early technologies implementing oblivion suffer from vulnerabilities and narrowly assume that users require information to be erased after a pre-determined time. But little is known about users' actual oblivion needs. A first study shows that users desire control over disclosed personal information to reduce pre-disclosure privacy concerns, and to delete harmful information after disclosure. In the long run, users have a need for dissociating from obsolete information that represents their past identity. A second study analyses whether oblivion-enhancing technologies (OETs) currently deployed in online services satisfy users' needs. While not all services give users assurance that disclosed information can be erased again, most provide users with some active control. But to manage the increasing volume of personal information stored, users would also require "intelligent" support with oblivion. Intelligent agents that keep track of disclosed information long-term could automatically safeguard users from information relating to a past episode in life surfacing unexpectedly. (authors' abstract)

Submitted by Filipe dos Santos (fsantos@pucsp.br) on 2017-04-06T12:48:43Z No. of bitstreams: 1 Julia Gomes Pereira Maurmo.pdf: 2000890 bytes, checksum: 17aa3f13d871de6cf2c0758a98308db1 (MD5) / Made available in DSpace on 2017-04-06T12:48:43Z (GMT). No. of bitstreams: 1 Julia Gomes Pereira Maurmo.pdf: 2000890 bytes, checksum: 17aa3f13d871de6cf2c0758a98308db1 (MD5) Previous issue date: 2017-02-14 / The purpose of the present study is to cast a new light on the classic debate involving the apparent conflict between the right to be forgotten and the rights to freedom of expression and to memory, so that other elements can be considered when analyzing the concrete case. In addition to demonstrating the possibility of fulfilling all rights to their maximum extent possible, interdisciplinarity was used in order to evidence the importance of adding to the discussion the perspective of the indispensability of forgetting as a way of ensuring individual health and the dignified life of the citizens. Finally, decisions involving the “Candelária Massacre” and the “Aída Curi Case” were brought to discussion in order to demonstrate that, regarding the right to be forgotten, the inclusion of a perspective concerning health itself not only contributes to fairer decisions, but also provide more objective criteria to the implementation of such right / O presente estudo tem como objeto central lançar um novo olhar sobre a clássica discussão que envolve o aparente conflito entre o direito ao esquecimento e os direitos à liberdade de expressão e à memória, a fim de que outros elementos sejam considerados quando da análise do caso concreto. Para além de demonstrar a possibilidade de realização de todos os direitos envolvidos dentro de uma máxima medida possível, foi utilizado o recurso da interdisciplinaridade, a fim de se demonstrar a importância de se acrescentar à discussão a perspectiva da imprescindibilidade do esquecimento para assegurar a saúde individual e a vida digna dos cidadãos. Por fim, foram trazidas à colação recentes decisões envolvendo a “Chacina da Candelária” e o “Caso Aída Curi” com o intuito de se demonstrar que a inclusão do ponto de vista da saúde não apenas torna as decisões mais justas, como trazem critérios mais objetivos à aplicação deste direito

Made available in DSpace on 2016-04-26T18:15:29Z (GMT). No. of bitstreams: 1 Mathias Yoneda Naganuma.pdf: 5162047 bytes, checksum: 31acc4daad8dec7b80b7476d699310fd (MD5) Previous issue date: 2015-12-14 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / The question of which part of the research asks if the Marco Civil da Internet (Law 12,965/14) is configured as an efficient regulatory law to meet the new demands that have emerged in the online life. Crimes have been committed, wounding individual fundamental rights and national sovereignty, although both are guaranteed in our Constitution. Conflicts and new power relations that emerged in the present Internet scenario are the subject of this research, whose objective is to propose a more democratic and fair Internet, built from the critical analysis of some points of the Marco Civil da Internet . The corpus is formed by the recent decision of the European Court of Justice, which recognized the right to be forgotten, and the bills on this topic which currently proceed through the Brazilian Congress. Assuming that Regulatory Laws of Internet adapted to the digital reality are needed to safeguard democracy, and without forgetting the cognitive changes taking place, produced by the hours and hours that we devote to the screens that surround us (Corpomídia Theory, KATZ and GREINER) We adopted as a methodology two research bases: a) data collection, to present the current Internet scenario in Brazil and b) literature review to analyze both the Marco Civil da Internet as the Right to Be Forgotten. In addition to KATZ and GREINER, the theoretical foundation also has LEONARDI, MAYER-SCHÖNBERGER and LESSIG / A questão da qual parte a pesquisa pergunta se o Marco Civil da Internet (Lei 12.965/14) configura-se como uma Lei reguladora eficiente para atender as novas demandas que surgiram na vida online. Crimes têm sido praticados, ferindo direitos fundamentais individuais e soberanias nacionais, apesar de ambos estarem garantidos em nossa Constituição Federal. Os conflitos e as novas relações de poder que emergiram no cenário atual da Internet constituem o objeto desta pesquisa, cujo objetivo é a proposição de uma Internet mais democrática e justa, construída a partir da análise crítica de alguns pontos do Marco Civil da Internet. O corpus é formado pela recente decisão da Corte Europeia de Justiça, que reconheceu o Direito de Ser Esquecido, e pelos projetos de lei sobre esse tópico que tramitam atualmente no Congresso brasileiro. Partindo da hipótese de que Leis Regulatórias da Internet adaptadas à realidade digital são necessárias para salvaguardar a democracia, e sem esquecer das transformações cognitivas em curso, produzidas pelas horas e horas que dedicamos às telas que nos cercam (Teoria Corpomídia, KATZ e GREINER), adotamos como metodologia dois vieses de investigação: a) levantamento de dados, para apresentar o cenário atual da Internet no Brasil e b) revisão bibliográfica, para analisarmos tanto o Marco Civil da Internet como o Direito de Ser Esquecido. Além de KATZ e GREINER, a fundamentação teórica conta também com LEONARDI, MAYER-SCHÖNBERGER e LESSIG

Submitted by Filipe dos Santos (fsantos@pucsp.br) on 2018-03-19T12:20:47Z No. of bitstreams: 1 Juarez Sanfelice Dias.pdf: 1361508 bytes, checksum: 1d70d94c5d61f5eca988f2a85be8e2d9 (MD5) / Made available in DSpace on 2018-03-19T12:20:47Z (GMT). No. of bitstreams: 1 Juarez Sanfelice Dias.pdf: 1361508 bytes, checksum: 1d70d94c5d61f5eca988f2a85be8e2d9 (MD5) Previous issue date: 2018-02-20 / The objective of this work is to study the existing conflict between memory and oblivion, with the aim of seeking the foundation for the existence of a right to be forgotten. Therefore, a multidisciplinary study will be done, starting from psychoanalysis, religion, philosophy and history, as well as the conflict will be analyzed from a broad meaning of law, which does not abandon the State law as the protagonist, but sees the other structural spaces of capitalist societies. We will depart from the approach and response by the State law to the conflicts to, at the end, seek an interaction with other existent right forms, especially the systemic right, the community's right and domestic's right, aiming a balance between memory and oblivion that presents effectiveness with emancipation / O objetivo do presente trabalho é estudar o conflito existente entre a memória e o esquecimento, com o intuito de buscar o fundamento para a existência de um direito ao esquecimento. Para tanto, será feito um estudo multidisciplinar, a partir da psicanálise, religião, filosofia e história, bem como será analisado o conflito a partir de uma acepção ampla de direito, que não abandona o direito estatal como protagonista, mas enxerga os demais espaços estruturais das sociedades capitalistas. Partiremos da abordagem e resposta dada pelo direito estatal aos conflitos ocorridos para, ao final, buscar uma interação com as demais formas de direito existentes, especialmente o direito sistêmico, o direito da comunidade e o direito doméstico, objetivando um equilíbrio entre memória e esquecimento que apresente efetividade com emancipação

Rätten att bli bortglömd uppstod under 2014 i.o.m. EU-domstolens avgörande, Costeja mot Google. Rättigheten i Europaparlamentets och rådets förordning (EU) 2016/679 av den 27 april 2016 om skydd för fysiska personer med avseende på behandling av personuppgifter och om det fria flödet av sådana uppgifter (GDPR) blev under 2018 lag i samtliga 28 EU-länder. En av de viktigaste förändringarna via GDPR är den breda definitionen av personuppgifter. Under GDPR kan alla data som identifierar en person betraktas som personuppgifter. Biometriska data, genetiska data och data som rör enskildas kulturella eller ekonomiska aspekter ligger nu inom lagens område. Rätten att bli bortglömd stadgas i art. 17 GDPR och har medfört nya spelregler angående den enskildas integritet på internet. Syftet med GDPR är huvudsakligen att stärka individers befintliga rättigheter och se till att enskilda får mer kontroll över sina personuppgifter, men också att harmonisera EU:s regler om skydd av personuppgifter och därmed skapa affärsmöjligheter och främja innovation. GDPR är en besvärlig och svårtolkad uppsättning av bestämmelser att tillämpa. Ur den registrerades perspektiv är det viktigt att behandlingen sker korrekt från första början. Den stödjande och rådgivande rollen hos datainspektionen är således av stort värde, då kränkningar sällan kan läkas i efterhand. Det åligger den personuppgiftsansvariga att, i varje enskilt fall när den registrerade utövar rättigheten att bli bortglömd, bedöma om personuppgiften ska raderas eller inte. Personuppgiftsansvariga företag har dock ett eget intresse att begränsa tillämpningsområdet angående rättigheten, då sökresultatens träffsäkerhet minskar när rättigheten tillämpas. Det kan härav frågas om det verkligen är förmånligt att personuppgiftsansvariga företag utgör den s.k. första ”instansen” eftersom dessa organisationer kan anses vara partiska. Ett effektivt rättsmedel, i enlighet med art. 47 i rättighetsstadgan, utgör en vital del av att säkerställa att rätten att bli bortglöm. Detta arbete granskar och ifrågasätter om ett s.k. effektivt rättsmedel föreligger i Sverige.  Bestämmelser om riksdagens överlåtelse av beslutanderätt inom EU-samarbetet stadgas i svensk grundlag. Enligt grundlagen kan riksdagen inom ramen för samarbetet överlåta beslutanderätt som inte rör principer för statsskicket. Det är ostridigt att svenska offentlighetsprincipen utgör en av principerna för det svenska statsskicket. Det är även ostridigt att Sverige som medlem i EU fullt ut ska följa EU-rätten. Yttrandefriheten och den personliga integriteten är grundlagsskyddade rättigheter och kan ibland utgöra varandras motsatser. Yttrandefriheten skyddar våra demokratiska rättigheter att få yttra oss och ta del av information, medan rätten till personlig integritet skyddar oss från att inte förekomma i sammanhang där vi inte vill delta. GDPR stadgar att rätten till radering inte får strida emot bestämmelser om tryck- och yttrandefrihet. Detta arbete reder ut förhållandet mellan rätten att bli bortglömd och grundlagarna angående yttrande- och informationsfrihet samt offentlighetsprincipen.  GDPR gäller för alla organisationer, överallt i hela världen som behandlar personuppgifterna för EU-medborgare. En fråga som har uppstått är hur långt räckvidden rätten till radering sträcker sig. Det finns en oro att rätten bara är värt någonting om den gäller universellt. Annars blir den enskildas förflutna lätt synlig, trots att hen utnyttjat rätten till radering, för amerikanska kollegor eller till och med av en EU-medborgare som kan förfalska sin IP-adress till ett land (en domän) utanför EU. En viktig aspekt som detta arbete analyserar är således om andra länder utanför EU har gjort någon form av inkorporering angående rättigheten eller om åtminstone samhället har ansett att rätten att bli bortglömd borde föras in i deras rättsordning. / The right to be forgotten was established in EU law in 2014 through the ruling of the European Court of Justice, Costeja v. Google. The right to be forgotten, expressed in article 17 GDPR, instantly became law in all 28 EU countries in 2018. One of the most important changes introduced through GDPR is the wider definition of personal data. Under GDPR any data that identifies a person may be considered personal data. Biometric data, genetic data, and data relating to individuals’ cultural or economic aspects are now within the scope of the law. The purpose of GDPR is primarily to strengthen the existing rights of individuals and to ensure that individuals gain more control over their personal data, but also to harmonize EU privacy rules and thereby create business opportunities and promote innovation.  GDPR’s provisions are difficult to interpret and apply. From the perspective of the registrant it is important that the treatment is done correctly from the beginning. The supportive and advisory role of the Swedish Data Protection Authority is of great importance since violations can rarely be healed afterwards. It is the responsibility of the data controllers for personal data in each case, when the registered person exercises its right to be forgotten, to determine if the personal data is to be deleted or not. Data controllers, as are companies, have their own interest in limiting the scope of the right to be forgotten, as the search results accuracy decreases when the right applies. Is it really beneficial to have companies as data controllers to constitute a so-called first “instance” when these organizations can be considered biased? An effective remedy is a vital part as ensuring that the right to be forgotten works. This work is a study of the so-called effective remedies in Sweden.  According to the Swedish Constitution the parliament may within the framework of the cooperation, transfer decision-making rights that do not relate to state institutions principles. It is unequivocal that the Swedish principle of public access to official records is one of the principles of Swedish state affairs, but it is also unequivocal that Sweden as a member of the EU must fully comply with EU law. Freedom of expression and personal integrity are constitutional rights and can sometimes constitute each other's opposites. Freedom of expression protects our democratic right to express ourselves and share information, while the right to personal privacy protects us from appearing in context where we don’t want to participate. GDPR recommends that the right to erasure should not violate rules on freedom of expression. This thesis clarifies the relationship between the right to be forgotten and the principles of freedom of opinion and information in Swedish law, as well as the publicity principle.  GDPR applies to all organizations, all over the world, which process personal data for EU citizens. A question that has arisen is how far the scope of the right to erasure extends. There is a concern that the right is only worth anything if it applies universally. Otherwise, the individual's past becomes easily visible, prone to using the right to delete, for American colleagues or even by a EU citizen who can forge his IP address to a country (a domain) outside the EU. An important aspect that this thesis analyzes is whether other countries outside the EU have made any kind of incorporation of the right to be forgotten or if society at least has considered if the right to be forgotten should be incorporated in their legal order.

Submitted by Geandra Rodrigues (geandrar@gmail.com) on 2018-05-15T13:52:08Z No. of bitstreams: 1 marinagiovanettilililucena.pdf: 1075894 bytes, checksum: 3095e19a8568ebeb33d65173d0713962 (MD5) / Approved for entry into archive by Adriana Oliveira (adriana.oliveira@ufjf.edu.br) on 2018-05-22T15:10:23Z (GMT) No. of bitstreams: 1 marinagiovanettilililucena.pdf: 1075894 bytes, checksum: 3095e19a8568ebeb33d65173d0713962 (MD5) / Approved for entry into archive by Adriana Oliveira (adriana.oliveira@ufjf.edu.br) on 2018-05-22T15:11:09Z (GMT) No. of bitstreams: 1 marinagiovanettilililucena.pdf: 1075894 bytes, checksum: 3095e19a8568ebeb33d65173d0713962 (MD5) / Made available in DSpace on 2018-05-22T15:11:09Z (GMT). No. of bitstreams: 1 marinagiovanettilililucena.pdf: 1075894 bytes, checksum: 3095e19a8568ebeb33d65173d0713962 (MD5) Previous issue date: 2018-03-28 / CAPES - Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / Na contemporaneidade, os indivíduos estão inseridos na sociedade da comunicação, caracterizada pelo enorme fluxo de informações disponibilizadas e transmitidas pelo mundo inteiro, sem barreiras temporais ou territoriais. O desenvolvimento da internet propiciou a formação de redes de dados mais amplas e acessíveis. Nesse contexto, é comum a utilização de dados pertencentes ao passado do indivíduo, o qual muitas vezes já está, por ele, superado. O assunto do presente trabalho abarca instituto apto a proteger a pessoa humana e o seu livre desenvolvimento na sociedade atual, qual seja, o direito ao esquecimento. A questão cerne é se essa rede de dados pode armazenar informações em um espaço de tempo indefinido e, também, se esses dados podem ser republicados a qualquer tempo. O direito ao esquecimento visa coibir a veiculação de informações pretéritas, que digam respeito a questões privadas da pessoa, a partir de alguns critérios. Este trabalho investigou como o direito ao esquecimento vem sendo disciplinado no Brasil. Analisou-se o conceito em tela de acordo com os fundamentos jurídicos brasileiros contemporâneos, conceituando-o com base na doutrina e jurisprudência pátrias. Foram analisados os critérios normalmente utilizados para propiciar sua aplicação, bem como sugeridos outros que sejam aptos a justificar a sua aplicação nos casos concretos. O estabelecimento de critérios se mostra de extrema relevância para permitir a aplicação justa e equilibrada desse direito, sem prejudicar a liberdade de expressão ou a memória nacional. / Nowadays individuals are embedded in the communication society, which is characterized by the enormous flow of information made available and transmitted worldwide, without temporal or territorial barriers. The development of the Internet has fostered the formation of broader and more accessible data networks. In this context, the use of old data from an individual’s past is not unusual, a past which is often overcome. The aim of this paper encompasses an institute capable of protecting the human person and their free development in today's society, namely, the right to be forgotten. The question to be posed is whether this data network can store information over an indefinite period of time and whether that data can be republished at any time. This right is aimed at preventing the disclosure of past information that concerns a person's private affairs, in the presence of certain criteria. The purpose of this work is to investigate how the right to be forgotten has been regulated in Brazil. Therefore, it will be analyzed according to the present Brazilian legal grounds for its protection. Then it will be conceptualized based on the country’s doctrine and jurisprudence. The commonly used criteria to provide its enforcement will also be analyzed, as well as others that may be used to justify its enforcement in specific cases. Setting criteria is extremely relevant to allow a fair and balanced enforcement of this right, without harm to freedom of expression or national memory.

Thesis title The right to be forgotten in the context of a modern concept of personal data protection in the EU and the USA Abstract The main topic of the thesis is the analysis of the right to be forgotten and its place in today's digital world and information society. In particular, the author discusses a different approach to the protection of personal data in Europe and in the United States of America within the context of the conflict between right to privacy and freedom of expression and right to free access to information. The author describes different conceptions of significance of these rights and different value ladder in connection in their mutual assessment. Based on outlining the different approaches to aforementioned rights, the author examines the inclusion of the right to be forgotten within the two legal cultures and consequently examines different forms of the right to be forgotten. Such forms are introduced in the context of privacy rights in the European union and presented in the was, how the legislation has been developing as the privacy laws evolved. Author closely examines the case-law of the Court of Justice of the European Union which is focused on right to be forgotten. Attention is also paid to the practical implementation of the right to be forgotten in accordance with the...

Current moves into a heavily digitalized era has led to a phase where our privacy is being eroded as we hand over our personal data to organizations and their systems. At the same time, the applicable laws to give security to the individuals have failed to incorporate these legal developments. However, in April 2016 the European Union proposed a change to a new regulation called the General Data Protection Regulation (GDPR). The GDPR will be implemented and start to apply in May 2018, thus the main purpose of this study was to investigate how organizations can adapt to changing regulations on how personal data should be stored and managed, and what the key tension points are within specifically closed IT-systems. The goal of the GDPR and this study on its feature implementation is to guarantee the EU citizens their right to privacy. Through an exploratory case study involving an in-depth analysis of two closed IT-systems this study develops a broader understanding on how organizations should adapt their daily businesses in order to be fully compliant with the new bylaws. This study identifies four critical issues which are used to discuss how the new bylaws could affect the EU citizens’ privacy. To accomplish this and open up for further investigation within the field of data privacy laws - four different propositions to modifications were suggested. / Den aktuella övergången till en omfattande digitaliserad tid har lett till en fas där vår integritet går förlorad då vi överlämnar vår personliga information till organisationer och deras system. Samtidigt har de tillämpade datalagarna med syfte att skydda individen misslyckats med att införliva denna utveckling. Därför har den Europeiska Unionen i april 2016 föreslagit en förändring till en ny reglering som får namnet Dataskyddsförordningen. Dataskyddsförordningen kommer blir implementerad och börja gälla i maj 2018 och därav var huvudsyftet med den här studien att undersöka hur organisationer bör anpassa sig till de nya riktlinjerna för hur personlig information bör lagras och hanteras samt vilka spänningspunkterna är för slutna IT-system. Målet med Dataskyddsförordningen och vad den här studien beaktade i dess kommande utförande är att garantera EU-medborgare rätten till sin integritet. Genom att utföra en undersökande fallstudie innehållandes en djupgående analys av två slutna IT-system har den här studien bidragit med en bredare förståelse för hur organisationer bör anpassa sina dagliga verksamhet för att vara helt medgörliga med Dataskyddsförordningen. Studien har identifierat fyra kritiska problem som har legat till grund för att diskutera hur den nya förordningen kommer påverka EU-medborgarnas rätt till sin integritet. För att göra det möjligt samt öppna upp för framtida undersökningar inom ramen för dataskyddslagar föreslogs fyra förslag på generella förändringar.

Tekniken utvecklas ständigt och utvecklingen har bland annat lett till att det idag kan lagras och bearbetas mycket större mängder data än förr, vilket innebär att även behandlingen av personuppgifter är mer omfattande än tidigare. Den tekniska utvecklingen tillsammans med dess nya fenomen och förfaranden ställer krav på en förnyad lagstiftning. Inom EU nåddes under hösten 2015 en överenskommelse om en ny dataskyddslagstiftning vilken har resulterat i en dataskyddsreform innehållande två rättsakter: en förordning och ett direktiv. Förordning- en trädde ikraft den 24 maj 2016 och ska tillämpas från och med den 25 maj 2018. Uppsatsen kommer att behandla huruvida personuppgiftsskyddet vid internetanvändning för enskilda internetanvändare kommer att förändras genom införandet av den nya förordningens artikel 17. Artikeln lagstadgar en rätt till radering (”rätten att bli bortglömd”), och motsva- rande rättigheter finns i gällande rätt i 28 § personuppgiftslagen, i vilken möjligheten till rät- telse stadgas. Syftet med artikeln är att stärka internetanvändarnas kontroll över sina person- uppgifter. Genom införandet av artikel 17 i den allmänna dataskyddsförordningen kommer den enskilde internetanvändarens rätt att få uppgifter undanröjda att tillgängliggöras och förstärkas, genom lägre krav på tillämplighet i jämförelse med 28 § personuppgiftslagen. Möjligheterna till att erhålla fullständig information om vilka personuppgifter som kan påverka internetanvändaren är dessvärre nästintill obefintliga, varför dennes faktiska kontroll inte försäkras genom artikel 17. Trots att den enskilde internetananvändarens kontroll över sina personuppgifter förstärks, kommer syftet med artikel 17 inte nödvändigtvis säkerställas i praktiken genom införandet av den allmänna dataskyddsförordningen.