By: Andrea Gallinucci-Martinez, JD, LLM
Published: October 17, 2018
Abstract
In this article, I argue that the preferred way to shape an American right to be forgotten is to grant users the control of their online personal data via expressed contractual obligations included in the terms of use and conditions of internet service providers. To pave the road to that assessment, I first discuss the evolution of the right to be forgotten in Europe, the competing values behind its creation, and the current scope and limits of the right. Then, I analyze whether a 2017 bill introduced in the New York State Assembly that expressly mirrors the European right to be forgotten can survive First Amendment constitutional muster. After having concluded that the bill would not pass the constitutional test, I examine whether and to what extent considering the right to be forgotten as an implied contractual obligation between users and service providers represents a viable theory for shaping an American version of the European right to be forgotten. Finally, in light of the recent Cambridge Analytica scandal and the entry into force of the General Data Protection Regulation, I argue that it is time to rethink online privacy in terms of expressed contractual obligations.