Google’s “Do no evil” mantra is being  challenged ever more. It’s no surprise Google  is increasingly on the losing end of court and  regulatory action as it exercises its market  power. Despite Google’s protestations that  Europe has overstepped the mark last week,  in an EU court decision requiring Google to  remove certain personal information under  data protection legislation, the European  approach is sensible and forces Google to do  what it and others should be doing anyway.  This is far from chilling freedom of speech.

We summarise the European decision and show why it makes sense, and we suggest what might  happen in New Zealand.

First though we talk about regulatory risk for those in a dominant position. Google gives the  impression of adopting a siege approach in circumstances where increased regulatory focus is  inevitable. For a time, that can work for firms with substantial market power. But often the better  strategy is to proactively fend off regulatory intervention by doing more things in, and that appear to  be in, consumers’ and competitors’ interests.

Google – siege or rapprochement?

Google Inc has a corporate structure that  makes it difficult to be sued, with carefully set  up separate subsidiary companies in countries,  and difficult communication channels, as we’ve  seen from our clients’ experiences. And it has  continued to expand its commercial dominance  by its strategies.

This can work well initially for those in  dominant positions. It can be difficult to trim  back dominant firms. But there comes a  time when such an approach bounces back  on dominant firms, and regulators and other  stakeholders step in assertively, as is now  happening to Google across a range of fronts.  See for example our articles:

Google’s competition law exposure shows how  the decision making on what a dominant firm  should do can be hard. The US regulator decided  not to sue Google for abuse of dominant position.  But the European regulator would have none  of that and it appears that it would sue, unless  Google did a deal pulling back from particular  dominant positions. In February 2014, the EU  announced that it would proceed down the path  of agreeing concessions by Google by way of  commitments made by Google.

What would have been the best strategic and  tactical approach for Google? To push ever  harder into dominance or to take some voluntary  steps to pull back (possibly steps that have the  look and feel of pulling back but don’t have much  adverse impact on Google).

Hard calls, often made, we think, by firms which  do not see the bigger picture as part of that  myopic siege mentality that happens in dominant  firms. For all we know, Google might have its  balance for its internal purposes about right.

We don’t know the full story. But one of the  big internal challenges for dominant firms is to  make the decisions having regard to the broader  picture and the risks. Difficult to do from within  the fortress.

The privacy case that Google has lost

In 1998, a newspaper had published details of a  debt collection process against a Spanish man.  12 years later, he sought a direction that Google  take down the link to the page in the newspaper.  Google refused, and the Spanish courts asked the  European Court of Justice to decide how the EU  data protection directive should apply.

That court decided, that, even though the Google  search engine only collects and indexes web  site-sourced information, it is still “processing... personal data” and so the directive applies.

US based Google Inc runs the search engine, not  local Google subsidiaries such as Google Spain.  Google argued it was outside the coverage of  the EU directive as it was based outside Europe.  Google Inc was seeking to take advantage of  its careful delineation between search engine  services (Google Inc’s services) and local Google  companies.

The Court didn’t accept that; based on the  wording of the directive, the court was able to  say that Google Spain, in taking ads in Spain with  those ending up on the Google search pages,  was enough to constitute Google Spain as part  of Google Inc for these purposes. To decide  otherwise would have been contrary to the  context and purpose of the directive.

The next issue for the court was what Google  must do when someone requests that personal  information is removed from the Google search  results.

The court said that this should be decided based  on a fair balance between:

  • The legitimate interests of internet users in  having access to the information; and
  • The person’s fundamental rights such as  in relation to privacy and the protection of  personal data.

As a general rule, said the court, the individual’s  own rights override the interests of internet  users. But this depends on the nature and  sensitivity of the information, and the public’s  interest (which is an interest that may vary  according to the role played by the individual in  public life).

Notably, the court said that Google’s  commercial interests alone do not justify  interference with the individual’s data  protection and privacy rights.

While information can, initially, legitimately be  on the Google search results, over time, some  information should no longer be there, said  the court. It could have become inadequate,  irrelevant, or excessive given the original  purpose and the time that has elapsed. On  request by the individual, Google must consider  removing the information, by weighing up  the position, having regard to factors such as  whether the individual is prominent in public  life (where it is less likely the information must  be removed). If Google doesn’t remove the  material, the regulating bodies can do so.

All that seems to be a sensible balance  between competing rights. This is very far  removed from a chilling effect on freedom of  speech. Google’s arguments to that effect do  not pass muster and privacy rights substantially  outweigh those interests. In this case, for  example, the information was 12 years old.

Google not seeing that having such old  information removed as reasonable is  concerning and does not show sufficient regard  for others. What if a Google search of your  name revealed debt recovery information  about you 12 years ago, even though you  have asked for it to be removed? Fair and  appropriate?

The final decision on this particular information  is to be made by the Spanish courts but the  big decision is that of the European Court of  Justice. Google must now have systems to deal  with requests. So must other providers.

What might happen in NZ?

The EU judgment was heavily dependent on  interpretation of specific words in legislation,  although context was key. The NZ regime  derives also from OECD guidelines and the  context is similar. The principles in our Act are  capable of being applied in similar ways, save as  to the international application of the Act.

It might also be argued that Google (and other  website operators) have a proactive obligation  to remove information past a use-by date:  information that is no longer necessary to be  retained for the purposes it was collected. That  would extend beyond removal only on request.  It may well be that news media exceptions will  not be applicable to much of this information.4

There are complexities and facts specific to each  case so we don’t venture complete views.

How the Act and other privacy and  confidentiality law applies to offshore  companies raises its own set of issues. For  example, s 4(3) of the Privacy Act might apply.  Where information is held by a company “for  the sole purpose of processing the information on  behalf of another agency.... the information shall  be deemed to be held by the agency on whose  behalf that information ….is so processed.”

Companies like Google typically use caches and  content distribution network services in NZ,  often contracted out to companies like Akamai.  If Google is doing something like this, that might  overcome Google Inc’s careful separation away  from NZ and its NZ related company, Google  NZ. Google Inc might have to comply by this or  other means. But that requires more detail.