The biggest thing in the privacy world just now seems to have exploded into the collective consciousness out of nowhere. For those of you with TLDR (Too Long Didn’t Read) syndrome, here’s the spoiler. The issue is not as clear cut as you might think. I’d like to hear a range of views about how we should approach this in New Zealand.

Since May 13, when the European Court of Justice ruled that Google in Spain should break links to an old newspaper story about the plaintiff, there has been much criticism, astonishment, suspicion, relief and applause, depending on which side of the fence (or the Atlantic) the commentator comes from.

In fact, the ideas discussed in the decision have their origins in pre-internet jurisprudence, and have never been far from the latest technological advances.

I’m not a big fan of the term “right to be forgotten” for a number of reasons. It is inaccurate, imprecise and impossible - these being the three main ones.

It means different things to different people. It can mean data portability, so that if you decide to leave (say) Facebook, you should be able to take your links and content with you, and have those deleted. It can mean the removal of content from public search. But it can never really mean an enforceable right to be forgotten.

Back in the 1980s, American courts recognised the concept of “practical obscurity”. This meant that while information might have been publicly available, such as being open for inspection at a courthouse somewhere, the passage of time and the physical and geographical obstacles to overcome for most people to gain access to the information guaranteed a degree of privacy in relation to that material.

A similar notion was behind the creation of a tort of privacy in New Zealand. In 1986, the High Court said in Tucker that privacy could “grow back” over what was previously publicly available information. In that case, a man seeking “crowdsourced” funding for a heart operation was found to have been convicted of sexual offences earlier in his life. He sued to prevent the disclosure of that information. He obtained an interim injunction, but was ultimately unsuccessful, because media outlets not affected by the interim order ran the story before his full case could be heard.

The Court nonetheless laid the foundation for the tort of breach of privacy, with the implication that it could exist even in relation to information that had previously been publicly available.

In 1999, Australia’s most eminent jurist, The Hon Michael Kirby AC CMG, reviewed advances in technology and, in his typically prescient way, foretold a future demand for “a right not to be indexed”. Google was not yet on the scene, so his point was illustrated by referring to older engines such as AltaVista.

Over the past few years, the European Union has been reviewing, redrafting and debating its 1995 Directive on Personal Data. Its current incarnation, which was before the European Parliament before the May elections, expressly refers to a right to be forgotten.

The European Court of Justice was able to deliver a “right not to be indexed” without the new directive being in place. It did so based on the principle of “relevance” which exists in the Spanish data protection law, as it does in New Zealand.

The ECJ case involved a Spanish national who complained to the Spanish Data Protection Authority that information about him published in a newspaper in 1998 was still available through a Google search on the internet. The information was that his house had been auctioned because he had social security debts. The information was accurate at the time and had been legitimately published. But he had resolved his social security debts so the information was now irrelevant and misleading. He wanted the newspaper to remove the information from its website, and wanted Google to remove or conceal the information so that it no longer appeared in search results. The ECJ ruled that Google had to stop linking to those stories, even though - and this is important - it made no ruling that the original media host sites had to take the stories off their web page.

The ECJ acknowledged the right to freedom of expression, and said that while the data subject’s rights generally override the rights of other internet users, in specific cases, the public interest may outweigh the data subject’s rights. It will depend, for instance, on the sensitivity of the personal information and the strength of the public interest.

Google accepted the ECJ decision and responded by making available a form for EU citizens to complete to request a breaking of links to material they consider to breach the relevance principle.

New Zealand

Could someone in New Zealand assert a right to have links removed from a Google search on their name? Our law differs in some key respects from European law. For example, we don’t have the concept of “data controller” or “data processor”, and there are a number of other differences.

The first hurdle would be territoriality. Google could be expected to argue that their search engine and the algorithms that compile and order results are not within New Zealand’s jurisdiction. The ECJ decision might offer some assistance to a litigant on that point, as might this June 13 decision of the Canadian Supreme Court which is a more influential source of jurisprudence to our courts.

Google has a .co.nz domain name registered in New Zealand. If you search for a mechanic or painter in your town, the ads that lead the search results will tell you pretty clearly that Google has a place of business here, and those points might provide the beginnings of an argument that Google should be subject to a range of domestic laws - from the Fair Trading Act, to the Copyright Act, to the upcoming Harmful Digital Communications Act. Should privacy be any different?

A number of other arguments would then ensue as to the liability (if any) that Google should have for content hosted on sites to which it is only providing a link to. What is the extent of Google’s obligation under the multi-qualified information privacy principle 8 in our Privacy Act?

An agency that holds personal information shall not use that information without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up to date, complete, relevant, and not misleading.

What is the onus if a New Zealand person asserts a right of correction (a term which is defined as including deletion) under information privacy principle 7?

Does the “purpose” element of the non-retention principle (principle 9) absolve search engines of the obligation to proactively purge old content? Should I issue a code of practice which spells out the respective rights of search engines and individuals?

I’m going to leave these questions until I am presented with an actual case to apply them to. There are many other authorities around the world grappling with the same difficulties.

Asia-Pacific

At a conference of Asia Pacific Privacy Authorities (APPA) in Seoul last week, New Zealand put the “right to be forgotten” case on the agenda for discussion. In advance of the conference, the Hong Kong Privacy Commissioner announced that he would be inviting delegates to make a joint approach to Google to offer their take-down service in our region. His suggestion had been met with some controversy at home. On the day I left, the South China Morning Post was seeking to elicit readers’ thoughts on the matter.

Several countries have been weighing up the issue. For example, Japan has conflicting decisions over the question of jurisdiction over Google’s global activities, and is awaiting clarification by its highest court. In Canada, the Ontario Information and Privacy Commissioner said the application of privacy rights in this situation was a threat to free expression on the internet.

Ultimately, given the rapid pace at which this issue is developing, we asked APPA’s Technology and Privacy Working Group to report back at the next APPA forum which will be in British Columbia in December.

Meanwhile, I am watching international developments closely. It may be that Parliament is the better forum to determine the appropriate balance between freedom of expression and the freedom to seek and impart information - both of which are guaranteed in the New Zealand Bill of Rights Act (NZBORA). Perhaps an international solution should be found? That may be optimistic given that reconciling American and European approaches to the issue might be akin to “squaring the circle”.

It may be that a case will come before me to determine before the issue comes to the Court or to Parliament. Someone might argue that Google should break a link to personal information that has been published online from a data breach, or that it is in breach of a Court suppression order. If I do have to determine such a case, in addition to weighing the various rights of privacy against the rights in the NZBORA, I will need to take into account the matters specified in s.14 of the Privacy Act. That means that, among other things, I have to have due regard to “the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way”.

Where do you think the balance should lie?

Google, Asia Pacific Privacy Authorities (APPA), IPP9 - retention, IPP7 - correction, IPP8 - accuracy