Guest Post: Another loss for Fortress Google

Michael Wigley is one of the tech-industry’s leading legal lights and has worked with TUANZ on any number of issues over the years. Here’s his view on the Google/EU privacy debate, cross posted with permission from Wigley+Company’s newsletter.

Google’s “Do no evil” mantra is being challenged ever more. It’s no surprise Google is increasingly on the losing end of court and regulatory action as it exercises its market power. Despite Google’s protestations that Europe has overstepped the mark last week, in an EU court decision requiring Google to remove certain personal information under data protection legislation, the European approach is sensible and forces Google to do what it and others should be doing anyway.

This is far from chilling freedom of speech. We summarise the European decision and show why it makes sense, and we suggest what might happen in New Zealand.  First though we talk about regulatory risk for those in a dominant position. Google gives the impression of adopting a siege approach in circumstances where increased regulatory focus is inevitable. For a time, that can work for firms with substantial market power. But often the better strategy is to proactively fend off regulatory intervention by doing more things in, and that appear to be in, consumers’ and competitors’ interests.

Google – siege or rapprochement?

Google Inc has a corporate structure that makes it difficult to be sued, with carefully set up separate subsidiary companies in countries, and difficult communication channels, as we’ve seen from our clients’ experiences. And it has continued to expand its commercial dominance by its strategies.

This can work well initially for those in dominant positions. It can be difficult to trim back dominant firms. But there comes a time when such an approach bounces back on dominant firms, and regulators and other stakeholders step in assertively, as is now happening to Google across a range of fronts.

 Google win is little comfort for Google, media and content carriers

Google’s competition law exposure shows how the decision making on what a dominant firm should do can be hard. The US regulator decided not to sue Google for abuse of dominant position.

But the European regulator would have none of that and it appears that it would sue, unless Google did a deal pulling back from particular dominant positions. In February 2014, the EU announced that it would proceed down the path of agreeing concessions by Google by way of commitments made by Google. What would have been the best strategic and tactical approach for Google? To push ever harder into dominance or to take some voluntary steps to pull back (possibly steps that have the look and feel of pulling back but don’t have much adverse impact on Google).

Hard calls, often made, we think, by firms which do not see the bigger picture as part of that myopic siege mentality that happens in dominant firms. For all we know, Google might have its balance for its internal purposes about right.

Another loss for fortress Google

We don’t know the full story. But one of the big internal challenges for dominant firms is to make the decisions having regard to the broader picture and the risks. Difficult to do from within the fortress.

The privacy case that Google has lost

In 1998, a newspaper had published details of a debt collection process against a Spanish man.

12 years later, he sought a direction that Google take down the link to the page in the newspaper. Google refused, and the Spanish courts asked the European Court of Justice to decide how the EU data protection directive should apply.

That court decided, that, even though the Google search engine only collects and indexes web site-sourced information, it is still “processing…  personal data” and so the directive applies.

US based Google Inc runs the search engine, not local Google subsidiaries such as Google Spain. Google argued it was outside the coverage of the EU directive as it was based outside Europe.

Google Inc was seeking to take advantage of its careful delineation between search engine services (Google Inc’s services) and local Google companies.

The Court didn’t accept that; based on the wording of the directive, the court was able to  say that Google Spain, in taking ads in Spain with those ending up on the Google search pages, was enough to constitute Google Spain as part of Google Inc for these purposes. To decide otherwise would have been contrary to the context and purpose of the directive.

The next issue for the court was what Google must do when someone requests that personal information is removed from the Google search results. The court said that this should be decided based on a fair balance between:

·         The legitimate interests of internet users in having access to the information; and

·         The person’s fundamental rights such as in relation to privacy and the protection of personal data.

As a general rule, said the court, the individual’s own rights override the interests of internet users. But this depends on the nature and sensitivity of the information, and the public’s interest (which is an interest that may vary according to the role played by the individual in public life). Notably, the court said that Google’s commercial interests alone do not justify interference with the individual’s data protection and privacy rights.

While information can, initially, legitimately be on the Google search results, over time, some information should no longer be there, said the court. It could have become inadequate, irrelevant, or excessive given the original purpose and the time that has elapsed. On request by the individual, Google must consider removing the information, by weighing up the position, having regard to factors such as whether the individual is prominent in public life (where it is less likely the information must be removed). If Google doesn’t remove the material, the regulating bodies can do so.

All that seems to be a sensible balance between competing rights. This is very far removed from a chilling effect on freedom of speech. Google’s arguments to that effect do not pass muster and privacy rights substantially outweigh those interests. In this case, for example, the information was 12 years old. Google not seeing that having such old information removed as reasonable is concerning and does not show sufficient regard for others. What if a Google search of your  name revealed debt recovery information about you 12 years ago, even though you have asked for it to be removed? Fair and appropriate?

The final decision on this particular information is to be made by the Spanish courts but the big decision is that of the European Court of Justice. Google must now have systems to deal with requests. So must other providers.

What might happen in NZ?

The EU judgment was heavily dependent on interpretation of specific words in legislation, although context was key. The NZ regime derives also from OECD guidelines and the context is similar. The principles in our Act are capable of being applied in similar ways, save as to the international application of the Act.

It might also be argued that Google (and other website operators) have a proactive obligation to remove information past a use-by date: information that is no longer necessary to be retained for the purposes it was collected. That would extend beyond removal only on request. It may well be that news media exceptions will not be applicable to much of this information.

There are complexities and facts specific to each case so we don’t venture complete views.

How the Act and other privacy and confidentiality law applies to offshore companies raises its own set of issues. For example, s 4(3) of the Privacy Act might apply. Where information is held by a company “for the sole purpose of processing the information on behalf of another agency…. the information shall be deemed to be held by the agency on whose behalf that information ….is so processed.”

Companies like Google typically use caches and content distribution network services in NZ, often contracted out to companies like Akamai. If Google is doing something like this, that might overcome Google Inc’s careful separation away from NZ and its NZ related company, Google NZ. Google Inc might have to comply by this or other means. But that requires more detail. 

We have always been at war with Eastasia

The EU has told Google it must delete “inadequate, irrelevant or no longer relevant” data on request from individuals. The journalist in me just turned over in his grave.

Google, of course, doesn’t actually store this information – it simply finds it and makes it easy for others to find. Telling Google to screen results in this way is similar to asking the Post Office to make sure nobody sends me pictures of something I don’t like.

But assuming Google can tweak its algorithms to do this, or more likely hire staff whose sole job is to vet information upon request to remove links to such things, I would question why we would want it and whether Google is the right company to ask this of.

Let’s assume you, like me, did something silly back when you were a teen. I’m lucky – cameras weren’t invented back then, let alone digital cameras, let alone the internet, let alone… I’m one of the safe ones. My youthful stupidity can remain firmly in the past, and I wouldn’t be happy if it was dragged up today.

What if, instead of youthful exuberance, my past data is actually about that time I committed fraud, or ran a company into bankruptcy? It might be decades ago but next year, when I run for President of the World, that will be relevant, surely? Will Google be required to keep the forbidden data in case circumstances change?

And who gets to decide whether that information is “inadequate, irrelevant or no longer relevant”? Google shouldn’t – it’s not an editorial control agent, it’s a bunch of geeks who are very good at maths. It’s also a company hell bent on making money – does this same ruling apply to Bing? Making Google arbiter of your privacy is odd, to put it mildly.

Unfortunately, we do live in an age where all such things can be captured electronically and stored for decades to come. Fortunately, we also live in an age where all such things can be captured electronically and stored for decades to come. Big data is here, and we have to live with it, but telling Google to selectively forget some things displays a shocking lack of awareness about how the internet works, how privacy works and how the ability to research an issue shouldn’t be hampered by today’s moral codes.

The value of the internet

The internet is a powerful tool for business, yet for too long we’ve struggled to convince many people of this fact.

It’s all about pornography, stealing copyright material and playing games, they say.

I’m not joking about this – I’ve heard it from government ministers, leaders of business, academics and (most alarmingly) a retiring Telecom board member. Really.

Now, however, we can point to a report that is at the least impartial and well put together. Sure, we’ve had reports in the past of the economic benefits of broadband, but when they’re produced at the behest of companies like Ericsson or Alcatel, they tend to get tarred with the “of course you’d say that” brush.

Today’s release, “The value of internet services to New Zealand businesses” was commissioned by the Innovation Partnership, which consists of InternetNZ and Google among others, but is put together by the economists at Sapere, led by an old colleague of mine, Hayden Glass.

The upshot is, yes having broadband does increase your productivity, improve your bottom line and deliver on all the benefits we’ve talked about for years.

On the other hand, the report also highlights those sectors of the economy where broadband has not made much of a dent – most notably in the rural sector, where farms and farmers seem immune to the charms of having internet connectivity either because they don’t see the value or, more likely in my view, because they’ve never had it and don’t know what they’re missing out on.

A couple of years ago I spoke at a Federated Farmers Nelson branch AGM, and talked about the UFB and RBI proposals and how they’d impact on rural life.

At the tea break, one large burly farmer came over to tell me he saw no value in the internet at all. His wife overheard him, smacked him on the shoulder and called him names. We use the internet, she declared, when it works and we need more of it. The apprentices use it for their studies, the kids use it for theirs and we used it to get the seats to the Rugby World Cup. In fact, so poor was the connection that they nearly missed out because after choosing the seats on the handy online tool, the connection would time out and she’d have to re-book from scratch.

“We nearly missed out on the semi-final,” she told him and he was an instant convert. “We must have more of it,” he declared.

Of course, there’s more to farming’s need for broadband than tickets to the rugby. Irrigation schemes, weather reports, milk yield reports, ongoing education and training opportunities, GPS mapping, health inspections (both people and animals), animal ID tags and so on all rely on better connectivity and on farmers willing to use this new kit.

Every percentage gain in productivity we can deliver in rural New Zealand will have a huge impact on our overall GDP and if that was the only measure, we’d be strongly urging rural New Zealand to get online as fast as they can, but of course it’s not. There’s also the social need – rural society’s cohesion relies on good communications far more so than in the city where we’re face to face on a daily basis.

This is a fight that should shape the next election – finally we have the ammunition we need to direct policy makers in the right direction.

There’s plenty more in the report as well, so do take the time to have a look through it. Well done to all concerned with its production. It’s something we can all use in our ongoing debate about connectivity.

Strawman: How to save the New Zealand economy

Put aside the idea that it’s Kim Dotcom who wants to build a
new cable connecting New Zealand with the outside world for a moment and think
about what we’re really talking about here.

Firstly, we’re talking about building a data centre. Nothing
unusual in that – we have many dotted around New Zealand, some large enough to
register on the international scale of such things. Between Orcon, Vocus
Communications and Weta FX’s donation of the New Zealand Supercomputer Centre,
we have several.

But this would be orders of magnitude larger – something that
would either power Dotcom’s new service or cope with the demands placed
on Google, for example. It needs to be robust, it needs to be multiply
redundant and it needs power. Lots of power. Green power. Fortunately we have
that and even better, the Tiwai aluminium smelter is apparently going to be
coming available soon and it requires 610MW to function. That’s 14% of the
national output, which makes for a scary conversation with government whenever
the smelter’s owners talk about packing up and leaving.

Google’s combined data centres use 260MW as best I can
which leaves us in a very good position to take over production of the whole
lot and do it entirely by green means. That’s quite important to a company like
Google, but don’t forget Facebook, Apple, Twitter (those tweets don’t weigh
much but by golly there are a lot of them) and all the rest. In fact this piece
in GigaOM nails it quite nicely  so have a look at why North Carolina is the place these guys base their mega
centres. Hint: power’s cheap there – cheap but dirty (61% of their electricity
is from coal, 31% from nuclear).

How cheap? They pay between 5c and 6c per kilowatt hour,
which is a really good price.

According to Brian Fallow in the Herald  Tiwai smelter pays 5c per kilowatt hour also, but don’t forget that’s New
Zealand money, not US money, so let’s call it 4c per kilowatt hour in American.

Clearly that’s a good price, plus it’s almost all green
which means a big gold sticker for any data centre using New Zealand.

So we’ve got electricity covered, if Kim gets his submarine fibre
built we tick off another huge problem. There’s not much we can do about the
latency between here and the US, so let’s ignore that thorny issue for now. We’re
conveniently located a long way from everyone so let’s move along.

There’s the issue of land which as we know is hideously
expensive in New Zealand. Unless it’s somewhere like Tiwai Point in which case
it’s not. I think we can tick that box off, particularly if you consider the US
pricing as your benchmark.

That leaves us with two major stumbling blocks. Firstly, the
staffing situation.

We need to produce enough graduates (or import enough
graduates) to staff this kind of monstrous facility and at the moment we’re not
doing that. We don’t have any push to get secondary school students into the
industry and we don’t have any long term plan to stop this incessant churning
out of management students and encourage kids into the world of ICT.

Without these kids coming through at all levels, we’re just
not going to get a data haven off the ground.

Because that’s what we’re talking about here – turning New
Zealand into a data haven where anyone can store data safe in the knowledge
that we treat bits as bits and that’s that. Nobody is going to trust us to look
after their data if we’re willing to send in the Armed Offenders Squad in a
chopper-fuelled moment of madness on the say so of some foreign national. It’s
just not viable.

The final problem then, is the legal situation.

We would need to become the neutral ground, the data
Switzerland if we’re to gain their trust. Publicly adhered to rules regarding
data collection and retention. Privacy built in, access only under the
strictest conditions.

But think of the upside – the PM talked about New Zealand becoming
a financial hub and while I get where he was coming from, that’s old school
stuff. Let’s become the home to all things data related instead. It turns our
long-time weaknesses (distance to market, isolation, relatively small size)
into strengths. Plus we’re New Zealand! Nobody’s going to invade us, we’re too
far away and too friendly.

Latency aside, what’s the downside of getting this done? If
we build the capacity we can attract a first mover in and if we have one, we
can attract more.

Customers from banks to insurance companies to individuals
to governments to movie studios (yes, you luddites, you) could make use of our
clean power, our isolation, our cheap land and our fantastic environment to
secure their precious bits and we would get a steady, reliable source of
revenue for the country that’s sustainable in all meanings of the word.

Have I missed anything? Why won’t this work? Is anyone
thinking about this?