> The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.
> It's all up whether you are willing to accept that as a fundamental right or not.
As a fundamental right, doesn't that mean that the government needs to abide by it as well? Can an EU resident demand that their image be removed from all footage collected by public surveillance cameras, for example?
> Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.
I think the idea that someone can own facts about anything is bound to cause some amount of confusion or even cognitive dissonance.
At what point does one's right to be forgotten supersede another's right to remember?
If Alice knows something about Bob because of their personal interactions, as he asks her to forget about it, but she still remembers it, is she violating Bob's right to be forgotten? How about if she had written it down in a journal? Does she need to erase what she wrote? What if her journal was stored electronically? In any of these cases is she allowed to tell another person? What if she already told another person before Bob told her to forget about it?
More concretely, suppose Bob visits Alice's house, and then a couple of weeks later tells Alice that she must forget that he visited. If she ignores his request is she violating Bob's rights?
Now suppose Bob is visiting Alice's website, which records his IP address in a log file. Bob asks to be removed from the log, and again Alice ignores his request.
I think for many technically minded people there seems like an awfully smooth gradient between these last two scenarios, and so classifying one as reasonable and the other as a violation of human rights can be surprising. Precisely where is the line drawn that makes one scenario reasonable, while the other is completely unacceptable?