Michael Wigley is one of the tech-industry’s leading legal lights and has worked with TUANZ on any number of issues over the years. Here’s his view on the Google/EU privacy debate, cross posted with permission from Wigley+Company’s newsletter.
Google’s “Do no evil” mantra is being challenged ever more. It’s no surprise Google is increasingly on the losing end of court and regulatory action as it exercises its market power. Despite Google’s protestations that Europe has overstepped the mark last week, in an EU court decision requiring Google to remove certain personal information under data protection legislation, the European approach is sensible and forces Google to do what it and others should be doing anyway.
This is far from chilling freedom of speech. We summarise the European decision and show why it makes sense, and we suggest what might happen in New Zealand. First though we talk about regulatory risk for those in a dominant position. Google gives the impression of adopting a siege approach in circumstances where increased regulatory focus is inevitable. For a time, that can work for firms with substantial market power. But often the better strategy is to proactively fend off regulatory intervention by doing more things in, and that appear to be in, consumers’ and competitors’ interests.
Google – siege or rapprochement?
Google Inc has a corporate structure that makes it difficult to be sued, with carefully set up separate subsidiary companies in countries, and difficult communication channels, as we’ve seen from our clients’ experiences. And it has continued to expand its commercial dominance by its strategies.
This can work well initially for those in dominant positions. It can be difficult to trim back dominant firms. But there comes a time when such an approach bounces back on dominant firms, and regulators and other stakeholders step in assertively, as is now happening to Google across a range of fronts.
Google win is little comfort for Google, media and content carriers
Google’s competition law exposure shows how the decision making on what a dominant firm should do can be hard. The US regulator decided not to sue Google for abuse of dominant position.
But the European regulator would have none of that and it appears that it would sue, unless Google did a deal pulling back from particular dominant positions. In February 2014, the EU announced that it would proceed down the path of agreeing concessions by Google by way of commitments made by Google. What would have been the best strategic and tactical approach for Google? To push ever harder into dominance or to take some voluntary steps to pull back (possibly steps that have the look and feel of pulling back but don’t have much adverse impact on Google).
Hard calls, often made, we think, by firms which do not see the bigger picture as part of that myopic siege mentality that happens in dominant firms. For all we know, Google might have its balance for its internal purposes about right.
Another loss for fortress Google
We don’t know the full story. But one of the big internal challenges for dominant firms is to make the decisions having regard to the broader picture and the risks. Difficult to do from within the fortress.
The privacy case that Google has lost
In 1998, a newspaper had published details of a debt collection process against a Spanish man.
12 years later, he sought a direction that Google take down the link to the page in the newspaper. Google refused, and the Spanish courts asked the European Court of Justice to decide how the EU data protection directive should apply.
That court decided, that, even though the Google search engine only collects and indexes web site-sourced information, it is still “processing… personal data” and so the directive applies.
US based Google Inc runs the search engine, not local Google subsidiaries such as Google Spain. Google argued it was outside the coverage of the EU directive as it was based outside Europe.
Google Inc was seeking to take advantage of its careful delineation between search engine services (Google Inc’s services) and local Google companies.
The Court didn’t accept that; based on the wording of the directive, the court was able to say that Google Spain, in taking ads in Spain with those ending up on the Google search pages, was enough to constitute Google Spain as part of Google Inc for these purposes. To decide otherwise would have been contrary to the context and purpose of the directive.
The next issue for the court was what Google must do when someone requests that personal information is removed from the Google search results. The court said that this should be decided based on a fair balance between:
· The legitimate interests of internet users in having access to the information; and
· The person’s fundamental rights such as in relation to privacy and the protection of personal data.
As a general rule, said the court, the individual’s own rights override the interests of internet users. But this depends on the nature and sensitivity of the information, and the public’s interest (which is an interest that may vary according to the role played by the individual in public life). Notably, the court said that Google’s commercial interests alone do not justify interference with the individual’s data protection and privacy rights.
While information can, initially, legitimately be on the Google search results, over time, some information should no longer be there, said the court. It could have become inadequate, irrelevant, or excessive given the original purpose and the time that has elapsed. On request by the individual, Google must consider removing the information, by weighing up the position, having regard to factors such as whether the individual is prominent in public life (where it is less likely the information must be removed). If Google doesn’t remove the material, the regulating bodies can do so.
All that seems to be a sensible balance between competing rights. This is very far removed from a chilling effect on freedom of speech. Google’s arguments to that effect do not pass muster and privacy rights substantially outweigh those interests. In this case, for example, the information was 12 years old. Google not seeing that having such old information removed as reasonable is concerning and does not show sufficient regard for others. What if a Google search of your name revealed debt recovery information about you 12 years ago, even though you have asked for it to be removed? Fair and appropriate?
The final decision on this particular information is to be made by the Spanish courts but the big decision is that of the European Court of Justice. Google must now have systems to deal with requests. So must other providers.
What might happen in NZ?
The EU judgment was heavily dependent on interpretation of specific words in legislation, although context was key. The NZ regime derives also from OECD guidelines and the context is similar. The principles in our Act are capable of being applied in similar ways, save as to the international application of the Act.
It might also be argued that Google (and other website operators) have a proactive obligation to remove information past a use-by date: information that is no longer necessary to be retained for the purposes it was collected. That would extend beyond removal only on request. It may well be that news media exceptions will not be applicable to much of this information.
There are complexities and facts specific to each case so we don’t venture complete views.
How the Act and other privacy and confidentiality law applies to offshore companies raises its own set of issues. For example, s 4(3) of the Privacy Act might apply. Where information is held by a company “for the sole purpose of processing the information on behalf of another agency…. the information shall be deemed to be held by the agency on whose behalf that information ….is so processed.”
Companies like Google typically use caches and content distribution network services in NZ, often contracted out to companies like Akamai. If Google is doing something like this, that might overcome Google Inc’s careful separation away from NZ and its NZ related company, Google NZ. Google Inc might have to comply by this or other means. But that requires more detail.
