Any digital bill of rights that doesn’t protect my rights to my own information is worthless.
Parent: if you s/driver's license/credit card & CVV visible/, does your position change? It's "just another picture of a thing."
As a practical example, I am skeptical that Todd Davis should be able to force Wired to take down his social security number[0]. I am also skeptical that people should be able to demand that HaveIBeenPwned remove their information from a database.
On social security numbers or IDs, I am definitely more open to discussing limits to the Right to Remember if they're very narrow and very rigidly defined, in the same way that I'm OK with exceptions to Freedom of Speech that are narrow and rigidly defined.
However, I want to posit that if infrastructure around identity verification is broken, we should focus on fixing the infrastructure, not curtailing rights as a band-aide. Identity theft is rampant because our identity metrics are horrible. Social security numbers are a joke. Credit card numbers are a joke; the only reason that system works is because banks are willing to reverse charges whenever identity theft happens. These are bad systems, but instead of forcing companies to fix them, we restrict user rights to make it easier to have some semblance of pseudo-security.
This same principle has come up in a few other places on this page, particularly with the Right to Filter, and whether that should allow a monopoly communication platform to circumvent the Right to Communicate. My take on that is similar: this sounds like an infrastructure problem. We wouldn't have an issue there if we didn't allow a private company to have a monopoly over communication online.
To me, it feels like people are attacking the wrong problem.
It's also important to remember that the Right to Be Forgotten is separate from GDPR. Where GDPR (arguably) is narrow and allows you to demand that a subset of companies delete specific PII, the Right to Be Forgotten is broad, and allows you to make demands regarding general information and your reputation.
I have some issues with GDPR as it's implemented today, and I won't go out of my way to endorse it, but I also won't take a strong stance that GDPR is incompatible with the Right to Remember. Readers can draw their own conclusions, but on GDPR, I'm neutral.
But I do take a hard stance on the Right to Be Forgotten. There's a difference between talking about edge-cases with IDs in a private, purely corporate database, and talking about deindexing news articles.
It a sane universe you simply share proof of your secret and we move on to discussing policies regarding data about you instead of data you have a direct interest in controlling.
I verified my ID for Freelancer.com once. They wanted a scan of your ID and a picture of you holding up the same ID and a random number they provided. A picture of your ID that someone got off a website is indistinguishable from a picture of a picture of your ID. A picture of you holding your ID is indistinguishable from a picture of you holding a picture of your ID. It could easily have been a deepfake.
I think this is a real problem and the right to communicate isn't stronger or deeper than the right to prevent illegal or provably harmful communications. (yes 'illegal' can become twisted, I'm limiting to just the painfully obvious things that everyone finds unacceptable (except would-be criminals))
(yes 'criminals' is frequently defined in terms of what's already illegal so I'm just making a fine mess here but while we're at it, let's appeal to the expectations of 'decent' people and then we just bounced it back to definition of 'decent' ad nauseum... ok I'm done)
I realize that the privacy community is diverse, and different people have different opinions on this. In general, I've tried to be vague enough with how I stated rights so that they could be applied to multiple different situations. I wanted there to be a little bit of leeway and ambiguity.
However, on this point in particular, I take a hard stance:
> Users have the right to share information with others, to share indexes of that information with others, and to tell other people that the information exists.
I explicitly mentioned indexes to respond to people who claim that forcing information to be de-indexed or removing it from search queries isn't the same as censoring that information. I respect people who believe that, but I think they're wrong.