Australia: Right to be forgotten in the internet era: who has it and does it apply in Australia?

In brief – Recent European Union decision may pave the way for new global norm

A recent decision of the Court of Justice of the European Union (ECJ) involving search engine Google has confirmed a right of individuals resident in the EU to remove from online access information about themselves which is inadequate, no longer relevant or excessive.

What is a right to be forgotten?

Have you, in the past, posted information online that you really shouldn't have? Or have others posted information about you that you would like to disappear?

Essentially, a "right to be forgotten" is an idea that individuals have a right to have information about themselves removed from online access.

Individual's right to control access to information about themselves vs. freedom of expression and sharing of information

In Australia and in other countries, legislatures and courts are evaluating whether a right to be forgotten should exist (and if so, the extent of its reach).

Application of a right to be forgotten creates tension between an individual's rights to control access to information about themselves and the public's rights to freedom of expression and access to public information, which promote public comment and the sharing of information.

There are also technological barriers to deleting information once published, particularly where it is published online: once information is published in any format it can be very difficult to delete all copies of it.

Recognition of the right to be forgotten in the European Union

The ECJ has held that in certain circumstances, links to publicly available information about a person must be deleted from search results. (See Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Consteja González, Court of Justice of the European Union, Case C-131/12.) The ruling only applies within the EU, but is relevant to all online publication of information (including on social media).

This case involved a private person (not a public figure or someone who had deliberately sought publicity) and the relevant information, although accurate when published, was argued to be misleading.

Right to remove online information that is inadequate or no longer relevant

The ECJ found that in the EU, individuals have a right to remove online information that is inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which it was processed and in light of the time that has elapsed.

In consequence, Google was ordered to remove links to the relevant information from its search results (even though the information remains available on the site of publication).

To comply with the ECJ's ruling, Google has created a process allowing any EU residents to submit personal information and proof of identity, identify the link(s) she or he wants deleted and give justification for the request.

Individual's rights to prevail over public right to access information?

The ECJ stated that an individual's rights to his or her personal information may override the interests of internet users in having access to someone's personal information (although that balance may shift and will particularly depend on the individual's role in public life).

In Argentina courts have ordered search engine operators to remove links to personal information (See, for example, Cámara Nacional de Apelaciones en lo Civil de la Capital Federal sala J [CNCiv.] [National Court of Civil Appeals of the Federal Capital section J], 31/8/2012, Krum, Andrea Paolo c. Yahoo de Argentina S.R.L. y otro s/daños y perjuicios, (132–33) (Arg.)).

Most of these decisions have been based on unique Argentinean copyright, privacy and data protection laws, however in time Argentina could also adopt an explicit right to be forgotten. We can expect to hear more from other countries as cases already filed move through their judicial systems.

How does the right to be forgotten apply in Australia?

The implementation of a right to be forgotten in the EU does not yet have any direct impact in Australia. However, Australian businesses with overseas operations, particularly in the EU, may well have to delete access to online information if a request is made in accordance with the ECJ ruling.

If other countries adopt similar positions to those taken in the EU and Argentina, Australian businesses may need to revise their practices further to conform.

Proposed revisions to Australian laws: "right to be deleted"

In its discussion paper Serious Invasions of Privacy in the Digital Era (DP 80), published in March 2014, the Australian Law Reform Commission (ALRC) proposed a new "right to be deleted", to allow individuals to compel organisations to delete or de-identify online information about them.

Submissions closed on 12 May and the ALRC is due to deliver final recommendations by 30 June 2014. The federal government will then determine whether those recommendations will be incorporated into the legislative agenda.

If implemented as set out in the discussion paper, the ALRC's proposal would not replicate the effect of the ECJ ruling. The discussion paper argues for a proposed right to be deleted that would apply only to information provided by the individual. The discussion paper does not propose enabling individuals to request deletion of personal information about them posted by third parties.

The discussion paper also proposes that such right could only be asserted by individuals against organisations subject to the Australian Privacy Principles. Small businesses are exempt from these principles.

Practical obstacles to effective enforcement

There are significant technological and practical limitations on effective implementation and enforcement of a right to be forgotten. For example, a search engine may simply revise its search process so certain links are not returned in search results, leaving the personal information at issue available online. Also deletion of personal information included in a public record or relating to multiple people may not be included in any such right to be forgotten.