Australia: Making Google forget - where to next?

IN BRIEF

The Court of Justice of the European Union (CJEU) recently held that Google must, if an individual requests, remove or block personal data from search results against the individual's name. Is there an equivalent right of deletion in Australia and are there plans for reform?

INTRODUCTION

The 13 May 2014 CJEU decision required Google to remove links to two 16-year old newspaper articles from its search results for Mr Costeja Gonzàlez, a Spanish national and resident. The articles referenced attachment proceedings against Mr Gonzàlez for the recovery of social security debts which had been resolved for many years.

Mr Gonzàlez lodged a complaint against the newspaper and Google, with the Spanish data protection agency in 2010. The complaint against the newspaper was dismissed as they had lawfully published the articles. The agency held that Google must remove the personal data from its search results notwithstanding that the newspaper did not have to remove the articles from its website. Google appealed to the Spanish High Court, which in turn referred questions to the CJEU to be determined.

LAW

There were a number of issues referred to the CJEU for determination including whether the right to rectification/erasure/blocking of personal data under Article 12 (b) of European Directive 95/46 (Directive) or the right to object to processing of personal data under Article 14 of the Directive require a search engine, on request by a data subject, to remove or block from its search results a data subject's personal data indexed from a third party website, even though that third party is not under an obligation to remove the personal data from their website.

DECISION

The CJEU held that the Directive required Google to remove the links to the newspaper articles in question from its search results for Mr Gonzàlez, even though the newspaper did not have to remove the articles from its website. The CJEU considered the 'important role played by the internet and search engines in modern society' and acknowledged that search engine results against an individual's name offer a 'structured overview of the information' available on that individual over the internet, allowing the searcher to 'establish a more or less detailed profile of the individual'.

The court considered that it is not only in circumstances of a data controller's non-compliance with the Directive or where an individual is prejudiced, that an individual may request rectification/erasure/blocking. An individual may also request rectification/erasure/blocking at any other time on compelling legitimate grounds relating to the individual's particular situation. The CJEU considered that in a case such as this, that would involve balancing the individual's legitimate interests against internet users' interests in being able to access that personal data in search results. However, the court found that, having regard to the rights to protection of private life and personal information under Articles 7 and 8, respectively, of the Charter of Fundamental Rights of the European Union, the legitimate interests of a data subject to exercise their right to request erasure 'will, as a rule, override the economic interests of the search engine operator as well as the interest of the general public.'

In response to the CJEU decision Google has launched a webform whereby European citizens can request removal of links, which is accessible here.

WILL AUSTRALIA 'FORGET' YOU?

There is currently no right under the Australian Privacy Act 1988 (Cth) (Privacy Act) for individuals to request an entity to delete their personal information. Individuals do have a right to request an entity to correct personal information held about them and the entity must take reasonable steps to do so. Entities must also destroy or de-identify personal information that is no longer required for any purpose for which the personal information may be used under the Australian Privacy Principles (APPs).

A recent Australian Law Reform Commission (ALRC) discussion paper has recommended a new APP which would give individuals the right to request destruction or de-identification. While the ALRC has also proposed a statutory cause of action for serious invasions of privacy, there remains no Australian equivalent to the European fundamental right to privacy.

The ALRC's final report to the Attorney-General is due this month. It remains to be seen whether the proposed new APP will be introduced. However, if it is introduced, it is unlikely it will have the 'teeth' of the European right to be forgotten in the absence of a fundamental right to privacy in Australia.

For further information please contact:

Susan Walsh, Senior Associate
Phone: +61 2 9233 5544
Email: sjw@swaab.com.au

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.