Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.
We respect your Do Not Track preference.
The biggest thing in the privacy world just now seems to have exploded into the collective consciousness out of nowhere. For those of you with TLDR (Too Long Didn’t Read) syndrome, here’s the spoiler. The issue is not as clear cut as you might think. I’d like to hear a range of views about how we should approach this in New Zealand.
Since May 13, when the European Court of Justice ruled that Google in Spain should break links to an old newspaper story about the plaintiff, there has been much criticism, astonishment, suspicion, relief and applause, depending on which side of the fence (or the Atlantic) the commentator comes from.
In fact, the ideas discussed in the decision have their origins in pre-internet jurisprudence, and have never been far from the latest technological advances.
I’m not a big fan of the term “right to be forgotten” for a number of reasons. It is inaccurate, imprecise and impossible - these being the three main ones.
It means different things to different people. It can mean data portability, so that if you decide to leave (say) Facebook, you should be able to take your links and content with you, and have those deleted. It can mean the removal of content from public search. But it can never really mean an enforceable right to be forgotten.
Back in the 1980s, American courts recognised the concept of “practical obscurity”. This meant that while information might have been publicly available, such as being open for inspection at a courthouse somewhere, the passage of time and the physical and geographical obstacles to overcome for most people to gain access to the information guaranteed a degree of privacy in relation to that material.
A similar notion was behind the creation of a tort of privacy in New Zealand. In 1986, the High Court said in Tucker that privacy could “grow back” over what was previously publicly available information. In that case, a man seeking “crowdsourced” funding for a heart operation was found to have been convicted of sexual offences earlier in his life. He sued to prevent the disclosure of that information. He obtained an interim injunction, but was ultimately unsuccessful, because media outlets not affected by the interim order ran the story before his full case could be heard.
The Court nonetheless laid the foundation for the tort of breach of privacy, with the implication that it could exist even in relation to information that had previously been publicly available.
In 1999, Australia’s most eminent jurist, The Hon Michael Kirby AC CMG, reviewed advances in technology and, in his typically prescient way, foretold a future demand for “a right not to be indexed”. Google was not yet on the scene, so his point was illustrated by referring to older engines such as AltaVista.
Over the past few years, the European Union has been reviewing, redrafting and debating its 1995 Directive on Personal Data. Its current incarnation, which was before the European Parliament before the May elections, expressly refers to a right to be forgotten.
The European Court of Justice was able to deliver a “right not to be indexed” without the new directive being in place. It did so based on the principle of “relevance” which exists in the Spanish data protection law, as it does in New Zealand.
The ECJ case involved a Spanish national who complained to the Spanish Data Protection Authority that information about him published in a newspaper in 1998 was still available through a Google search on the internet. The information was that his house had been auctioned because he had social security debts. The information was accurate at the time and had been legitimately published. But he had resolved his social security debts so the information was now irrelevant and misleading. He wanted the newspaper to remove the information from its website, and wanted Google to remove or conceal the information so that it no longer appeared in search results. The ECJ ruled that Google had to stop linking to those stories, even though - and this is important - it made no ruling that the original media host sites had to take the stories off their web page.
The ECJ acknowledged the right to freedom of expression, and said that while the data subject’s rights generally override the rights of other internet users, in specific cases, the public interest may outweigh the data subject’s rights. It will depend, for instance, on the sensitivity of the personal information and the strength of the public interest.
Google accepted the ECJ decision and responded by making available a form for EU citizens to complete to request a breaking of links to material they consider to breach the relevance principle.
New Zealand
Could someone in New Zealand assert a right to have links removed from a Google search on their name? Our law differs in some key respects from European law. For example, we don’t have the concept of “data controller” or “data processor”, and there are a number of other differences.
The first hurdle would be territoriality. Google could be expected to argue that their search engine and the algorithms that compile and order results are not within New Zealand’s jurisdiction. The ECJ decision might offer some assistance to a litigant on that point, as might this June 13 decision of the Canadian Supreme Court which is a more influential source of jurisprudence to our courts.
Google has a .co.nz domain name registered in New Zealand. If you search for a mechanic or painter in your town, the ads that lead the search results will tell you pretty clearly that Google has a place of business here, and those points might provide the beginnings of an argument that Google should be subject to a range of domestic laws - from the Fair Trading Act, to the Copyright Act, to the upcoming Harmful Digital Communications Act. Should privacy be any different?
A number of other arguments would then ensue as to the liability (if any) that Google should have for content hosted on sites to which it is only providing a link to. What is the extent of Google’s obligation under the multi-qualified information privacy principle 8 in our Privacy Act?
An agency that holds personal information shall not use that information without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up to date, complete, relevant, and not misleading.
What is the onus if a New Zealand person asserts a right of correction (a term which is defined as including deletion) under information privacy principle 7?
Does the “purpose” element of the non-retention principle (principle 9) absolve search engines of the obligation to proactively purge old content? Should I issue a code of practice which spells out the respective rights of search engines and individuals?
I’m going to leave these questions until I am presented with an actual case to apply them to. There are many other authorities around the world grappling with the same difficulties.
Asia-Pacific
At a conference of Asia Pacific Privacy Authorities (APPA) in Seoul last week, New Zealand put the “right to be forgotten” case on the agenda for discussion. In advance of the conference, the Hong Kong Privacy Commissioner announced that he would be inviting delegates to make a joint approach to Google to offer their take-down service in our region. His suggestion had been met with some controversy at home. On the day I left, the South China Morning Post was seeking to elicit readers’ thoughts on the matter.
Several countries have been weighing up the issue. For example, Japan has conflicting decisions over the question of jurisdiction over Google’s global activities, and is awaiting clarification by its highest court. In Canada, the Ontario Information and Privacy Commissioner said the application of privacy rights in this situation was a threat to free expression on the internet.
Ultimately, given the rapid pace at which this issue is developing, we asked APPA’s Technology and Privacy Working Group to report back at the next APPA forum which will be in British Columbia in December.
Meanwhile, I am watching international developments closely. It may be that Parliament is the better forum to determine the appropriate balance between freedom of expression and the freedom to seek and impart information - both of which are guaranteed in the New Zealand Bill of Rights Act (NZBORA). Perhaps an international solution should be found? That may be optimistic given that reconciling American and European approaches to the issue might be akin to “squaring the circle”.
It may be that a case will come before me to determine before the issue comes to the Court or to Parliament. Someone might argue that Google should break a link to personal information that has been published online from a data breach, or that it is in breach of a Court suppression order. If I do have to determine such a case, in addition to weighing the various rights of privacy against the rights in the NZBORA, I will need to take into account the matters specified in s.14 of the Privacy Act. That means that, among other things, I have to have due regard to “the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way”.
Where do you think the balance should lie?
12 comments
Back
Comments
If Google "holds" any information at all, I imagine it would be some sort of contextual link in their database between a keyword and a webpage. Alternatively, Google might not have any such link and simply be using an algorithm that generates such a link dynamically (in which case the applicant might have some trouble).
Assuming it's the former, then the next question is whether the "relevance" test applies as between the contextual link and the person in question; or between the keyword and the webpage.
Posted by Andrew Easterbrook, 01/07/2014 2:24pm (3 years ago)
The Council of Europe Committee of Ministers made a Recommendation under the Convention on automated processing of personal data a few years ago that could be relevant in considering the issue: CM/Rec (2012) 3 on the protection of human rights with regard to search engines (4 April 2012)
In New Zealand, the Human Rights Review Tribunal case Haydock v Sheppard (Decision No 31/06, 11 August 2006) could perhaps be tangentially relevant here? The case concerned the meaning of "hold" where an agency subscribed to a Baynet facility, and there was unauthorised access via it to an individual's personal information on Baynet. It could be argued from the case that where an agency is merely a conduit (like Google?) to information held by another agency, the first agency does not "hold" that information (relevant to breaches of principles 5, 10, 11). The case could be criticised I think, but that is state of legal authority on the issue so far in NZ, such as it is: see my criticism at Privacy Law and Practice, PVA6.8(b), page 203,003f.
Posted by Paul Roth, 02/07/2014 12:35pm (3 years ago)
On the "right to be forgotten" issue generally, can't say I'm too enthralled with non accountable commercial entities being given a right to decide, on principles known only to themselves, whether or not information is censored. Or can one argue that that's what IPP 9 requires already?
Great to see the Commissioner taking a proactive lead on these issues. Thanks John.
Posted by Rick Shera, 03/07/2014 12:46pm (3 years ago)
Firstly, I’m not clear that there is a “right to be forgotten” in any meaningful sense. So long as my memory hasn’t gone to pieces, then I’m going to remember whatever I want, and nobody has the right to force me to forget stuff. So describing this as a right to be forgotten is really misdescribing it.
What it is is a right to ask someone to cease publishing something about me because it’s no longer convenient for me to have people know it. To some extent I’d be OK with a right to go to the original publisher and ask them to correct things that are no longer correct – i.e. that have been overtaken by time. So, for example, if there’s an allegation that you committed some crime, you should perhaps have a right to ask someone who is still publishing that (so they still have the article on the web) to add a correction or addendum that notes that you were found not guilty. But I don’t think that you have a right to ask them to take it down (unless it’s untrue or defamatory – existing rights you have), because it does form a history of what happened. By the same logic you can’t ask a library to get out a pair of scissors and excise articles you no longer like from their newspaper archives.
In the context of a search engine, I completely agree that the responsibility should not be Google’s. Sure, it’s convenient to have a central place to go to, but Google just index stuff that’s already there, they aren’t the publisher. It’s the publisher you should go to. Having Google remove it from their search results does not take it down from the web, and there are other search engines than Google - would you have to ask every individual search engine to remove it? Does that include the Chinese search engines? Does that include google.com and google.co.uk, or only google.co.nz? It seems to me that the only sensible response is to have recourse to the publisher.
Posted by PaulL, 03/07/2014 12:49pm (3 years ago)
I am going to put myself out there as someone who this issue is very, very relevant to and would probably seek to make use of if it was easy to do so. However, I have decided against any legal action sometime ago and maybe my example will be of some use to others/something to consider.
In 2012 I made a very insulting/inappropriate leading question to New Zealands "#1 Blogger" who came across my Facebook feed who I at that time severely disliked. You can google my name if you want to see it (first result!). It was severely inappropriate but he proceeded to 'rip me out' in a huge and permanent fashion with his google presence. He tagged my name with photos and crude insults on his blog and portrayed that I was some sort of the worst troll on the internet for the kind of thing I had said to him. For an intense day this focused his followers to bring me as an object of hatred, to be shunned and so on and I was portrayed as some sort of constant general troll or pathological narcissist. He and his followers openly mocked how much harder it would be for me to get a job because of my newly minted "Google CV".
I accept responsibility for what I said and apologized about it sincerely. At the time I event made a payment to the Mental Health Foundation. This encouraged him to make a further blog-post instead of responding to me privately or indirectly and I just realised there was no rational way to proceed or make amends at that point that might have him untag my "google name" and it would only make it worse. I came to realise that any actual or attempted good deed would not go unpunished. If I were to make a "right to be forgotten" request I fear it would practically just end up being a streisand effect.
It basically boils down to this for me-
I don't have any expectation of censoring anything or making people forget. I wouldn't care or mind if my employer or anyone else came to know about any of this in due course and I am happy to talk about it. What I said was stupid/hurtful stuff regardless who it was aimed at and I needed to realised that it wasn't a good thing to do/its not justified against anybody.
The thing that really gets me is that its the FIRST thing that people might find out about me. I don't want to dwell on it but first impressions like that we know for a scientific fact matter a lot. The truth is also that incident at that time caused me a great deal of stress. Writing this all out probably counts against me being believed but I am most of the time completely over it with some humour and perspective but if I am having a bad day I can get drawn right back to thinking about it and my google name is a reminder.
So there. All I would want is the info moved to the 2nd or 3rd page. Keep the blog post up. Keep it up for whoever wants to learn about me. I just think its manifestly unfair it will have to be the first search result forever- not because of the content- but because of the click-influence of the person involved.
Posted by Beau Murrah, 03/07/2014 1:05pm (3 years ago)
In terms of the current situation I think maybe a good solution would be for google to be *very upfront* about the fact that the information has been removed. As far as I know they are going to put a discrete message saying "Links may have been removed" or something, but perhaps a louder message, like the ones which pop up when you try to google torrents would be a good start ("Links removed due to DMCA takedown request due to copyright violation" or whatever).
Of course there are always going to be other search engines out there which you'll still be able to view the indexed information at - Yahoo, DuckDuckGo, Yacy etc etc. In practice won't it be nigh impossible for any individual person to remove links to the relevant material everywhere? And the original website is still going to be online after all the cerfuffle...
Posted by Harry Chapman, 03/07/2014 3:04pm (3 years ago)
If the law as it stands can not reasonable ask the source site to take down the information than there should not be a law to exclude the same information information. We also have no expectation that we could walk up to another person and compel them to forget us.
Destroying the Internet's indices is equivalent to going into a library and removing its catalogues, or banning the selling of newspapers.
This isn't the action of a civil society, it's the action of a society that secretly wants to burn books, remove the freedom of the press and of free speech, and force schools to only teach what is "right".
Posted by R Singers, 03/07/2014 4:42pm (3 years ago)
I should have realised that Judge Harvey would already have some sage reflections on the matter! http://theitcountreyjustice.wordpress.com/2014/05/22/back-to-the-future-google-spain-and-the-restoration-of-partial-and-practical-obscurity/
Also, the comments over at KiwiBlog warrant a look http://www.kiwiblog.co.nz/2014/07/should_nz_have_a_right_to_be_forgotten.html#comments
Posted by John Edwards, 03/07/2014 5:35pm (3 years ago)
This would seem to be the next step, along with a general ban on linking to certain types of data.
Back in the 1980s there was no Internet and even as late as 1995, journals of public record had generally not been digitised and linked to from search engines. Referring to laws from the pre-Internet era doesn't seem meaningful in the context of 2014, but hey, that didn't stop our elected members of Parliament from amending the Copyright Act with some loony, privacy-hostile clauses so...
Posted by Juha, 04/07/2014 12:07pm (3 years ago)
Posted by Peter Jenkins, 04/07/2014 12:58pm (3 years ago)
1 2 next »
No one has commented on this page yet.
RSS for comments on this page RSS for all comments