The New American Privacy

Article excerpt

TABLE OF CONTENTS

  I. INTRODUCTION AND THE "RIGHT TO BE FORGOTTEN" PROBLEM
 II. THE EU PROPOSED REGULATION
     A. Consent
     B. Transparency
     C. Right to be Forgotten
     D. International Data Transfers
     E. European Data Protection Board
     F. Sanctions
III. AMERICA'S TARNISHING ABSOLUTISM
     A. The Rule of Sullivan
     B. The Rule 0f Daily Mail
     C. New Rule of American Privacy
 IV. RECONSTRUCTING PRIVACY
  V. CONCLUSION

I. INTRODUCTION AND THE "RIGHT TO BE FORGOTTEN" PROBLEM

The European Union fired the first shot this year in what pundits are sizing up as a new front in the trans-Atlantic war over the right to privacy. A proposed regulation (1) is likely to become law in some form in the 27-member European Union, and it will supersede the 1995 Data Protection Directive (DPD). (2) The new regulation substantially increases burdens on data handlers, (3) enhancing reporting requirements, toughening the expectation of explicit personal consent to the use of personal data, and giving data subjects more control over their information through rights of revocation and, the flashpoint of intercontinental controversy, the "right to be forgotten." Most importantly, the regulation as proposed would sweep within its ambit for the first time foreign actors who do business in the European Union. Critics, especially in the United States, forewarn of inevitable collision between EU privacy and the U.S. First Amendment. (4)

The simple picture of irreconcilable conflict across the Atlantic conceals nuances on both sides. An observer of American constitutional law from a comparative perspective is impressed on the one hand by the free speech imperative of the First Amendment, of which the firm rule against prior restraint is a part. The imperative posits free speech as the presumptive winner when it comes into conflict with other interests, such as statutory prohibitions, or even with other constitutional rights. (5) To lose out, the free speech claim must be rebutted by countervailing interests, few of which can measure up. (6)

The observer is impressed on the other hand by the weak development in American constitutional law of rights of personality, including reputation and privacy. Lacking the full constitutional gravitas of free speech, these "rights" fare poorly when they run up against the American free speech imperative.

Throw into the mix the American affection for laissez faire economic regulation, and the conflict between privacy in Europe and free speech in the United States starts to come into focus. Even supposing that U.S. lawmakers were inclined to regulate the commercial information marketplace, rules that preclude the dissemination of lawfully obtained, truthful information run headlong into the free speech imperative and the rule against prior restraints. The controverted commercial speech doctrine offers some room for an information-regulatory regime in the United States, subject to an intermediate constitutional scrutiny. But the EU system is not confined to the commercial context.

The "right to be forgotten" is one small part of the proposed EU regulation, (7) but it exposes the crux of the problem. Under the proposal, a person may demand the removal of personal information from data processing and dissemination. (8) Prohibiting the subsequent dissemination of truthful information, lawfully obtained, defies the American free speech imperative. Worse from the American perspective, the rebutting privacy claim is not necessarily even an interest of constitutional magnitude. Any reasonably identifying information triggers the EU regulatory framework, (9) because the broader right of personality animates the regulation, not the narrower American conception of privacy in the intimate or "highly offensive." (10)

A recent European case against Google is illustrative. (11) Alfacs Vacances, S.L., operates a campground in Spain at which a horrific propane-truck accident in 1978 incinerated 160 persons and gravely wounded 300 more. …