'The Right to be Forgotten' and its Unintended Consequences to Intelligence Gathering

Abstract

Social media has dramatically changed how we interact and communicate with one another. The reliance on social media has also sparked many international debates revolving around privacy. We have seen the enactment of the comprehensive privacy law in the European Union, the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) in the United States—both enacted in 2018. In the GDPR, Article 17 known as the “Right to Be Forgotten” (RTBF) principle allows for data subjects to request that their information be removed from online service providers like social media companies. In recent years, cases from the Court of Justice for the European Union have expanded these RTBF principles through three major cases: Google LLC v. Commission nationale de l’informatique et des libertes (CNIL), GC v. Commission nationale de l’informatique et des libertes (CNIL), and Glawischnig-Piesczek v. Facebook. This Article argues that the RTBF model will present unintended consequences to Open Source Intelligence (OSINT) by mandating online service providers to delete more data than necessary based on the pressures placed on these online service providers by the recent Court of Justice for the European Union (CJEU) cases. This will lead to problems in the Intelligence Community when obtaining open source intelligence especially when scrubbing social media information. This RTBF system will make it easier for terrorist groups, terrorist sympathizers or any other associated individuals to hide behind a process by which they can easily delete data that was not so easily removable before RTBF. Lastly, this Article proposes legal, procedural, and oversight solutions to address the issues caused by RTBF and OSINT.