The right to erasure: Comparative perspectives on an emerging privacy right

A European turn?

Unheard of until a few years ago, the right to erasure, or right to be forgotten, is now a familiar concept in much of the legal world. The concept grew out of a May 2014 ruling by the Court of Justice of the European Union (CJEU). In Google Spain SL v Agencia Espanola de Proteccion de Datos ⁶ (Google Spain) the CJEU held that, in certain circumstances, search engine operators must, upon request, remove links that result from searches of an individual’s name where those results are ‘inadequate, irrelevant or no longer relevant, or excessive’. The Court sought to implement the European Union (EU) 1995 Data Directive, specifically its ‘data minimisation’ principle, which required that the processing of personal data be limited strictly to the purpose/s for which it had been collected. ⁷

In May 2018, the EU’s General Data Protection Regulation (GDPR) came into effect establishing, among many other reforms, a ‘right to erasure’ (art 17). ⁸ Often described as a codification of the right to be forgotten, the right to erasure significantly expands it. Most importantly it may be invoked against any data controller – not merely a search engine. A data subject is not limited to seeking the removal of search engine links but may also seek removal of the data itself: a Facebook post, a photograph on Instagram or an article on a newspaper’s website. ⁹

In its final report, the ACCC sets out a recommendation that ‘broadly aligns with the principles outlined in Article 17 of the GDPR’. ¹⁰ It proposes that reforms are made to Australia’s Privacy Act to:

[r]equire APP entities to erase the personal information of a consumer without undue delay on receiving a request from the consumer, unless the retention of information is necessary for the performance of a contract to which the consumer is a party, is required under law, or is otherwise necessary for an overriding public interest reason. ¹¹

A consumer’s rights are strengthened by accompanying proposals, including a direct right of action against APP entities for interferences under the Act. ¹⁴ Further, penalties for interferences are increased to mirror penalties for breaches of the Australian consumer law. ¹⁵ Taken together, the proposal is significant, potentially providing Australians with an enforceable data protection right, which would protect privacy and give individuals a greater capacity to intervene in the data economy.

Digital privacy versus freedom of expression

Since the CJEU’s decision in 2014, the right to be forgotten has been applied in various forms in Argentina, Belgium, Brazil, Canada, Denmark, Finland, Germany, Ireland, Italy, Japan, Romania, Taiwan, Turkey, the United Kingdom and the United States (California). ¹⁶ The strength that each jurisdiction has afforded to the right tends to correlate with the extent to which it is willing to prioritise privacy against competing rights such as freedom of expression or the right to property. ¹⁷ In Europe, where privacy is a fundamental right, the right enjoys strong protection. In the United States, where free speech tends to trump the protection of privacy, the right to be forgotten has not gained much traction, except through limited statutory recognition in California. ¹⁸

The right to be forgotten has not had much support in Australia. When the ALRC examined the concept in 2014, legal experts mostly came out against it. Many were concerned that it would be misused to ‘clean up’ the public information online at the expense of free expression. ¹⁹ Today, consensus may be shifting. Legislators are far more conscious of the dangers of the data economy, including how the Internet giants (mis)handle user data. ²⁰ On the other side, freedom of expression online has become a more difficult ideal to defend. In the shadow of Twitter trolls, fake news and live streamed violence, regulators around the world are turning against unmitigated openness online. ²¹ By providing individuals with a way to re-assert their privacy online, an Australian right to erasure may be a part of that change.

Yet regulation of the Internet is notoriously difficult. Since the Google Spain decision, the scope of the right to be forgotten has expanded well beyond its original form. Legal actions asserting the right have been brought against media outlets and have led to the removal or anonymisation of unflattering news articles online.

In October 2015, the Spanish Supreme Court held that the Spanish newspaper El Pais was required to render inaccessible a news article it had published in 1985, naming two individuals convicted of drug trafficking offences. The newspaper argued that the article remained accurate and truthful. Nonetheless, the Court ordered it to implement technical measures to render the content inaccessible. ²²

Courts in Germany have ruled in a similar manner, imposing obligations directly on newspapers to render certain articles inaccessible. ²³ Most recently in November 2019, the German Federal Constitutional Court confirmed that media outlets can be required to prevent search engines returning information which they have previously reported on, including about serious criminal offences. German newspaper Der Spiegel had reported on a double murder committed in 1981 and digitised those articles in 1999. After completing his sentence, the individual convicted of the crime and named in the articles sought to have them removed or anonymised. The Constitutional Court confirmed the availability of the remedy, and the case will now return to the federal courts. ²⁴

Courts in Belgium have gone even further. In 2016, Belgium’s Court of Cassation ordered the Le Soir newspaper to anonymise the online version of an article it had published in 1994. The article reported a drunk driving incident that had resulted in two deaths and named the driver responsible. Ultimately, the Court held that the right to be forgotten and associated privacy rights enshrined in the European Convention on Human Rights allowed a person previously convicted of a crime to object to elements of their criminal past being disclosed to the public. This also justified the corresponding limitation on the newspaper’s right to freedom of expression. It ordered that the man’s name be replaced with the letter ‘X’. ²⁵

A tricky balance

The European decisions demonstrate the impact that the right to be forgotten may have on how the media and other online publishers make content available online. This impact is significant: the Internet is now our primary source of news and information. Media archives in particular have become an essential tool of historical research and modern reporting, enabling journalists and the public to easily locate, access and gather information. ²⁶ Without appropriate safeguards, there is a danger that information in the public interest could be erased from public record unbeknownst to those who might later come looking for it. This danger is acute in Australia, where freedom of expression is not a free-standing right and the ‘media archive’ is not protected concept. ²⁷

In Europe, freedom of expression (and, by implication, press freedom and access to information) is a protected right – of equal importance to the right to privacy. ²⁸ Europe’s approach to data protection is firmly grounded in this human rights framework. As a privacy right, a data protection mechanism, such as the right to be forgotten, is protected but must be balanced against other protected rights – relevantly, freedom of expression. The de-listing or removal of data will only be appropriate where it is considered a proportionate infringement on free expression.

The European Court of Human Rights (ECtHR) has long stressed the need for national authorities to strike ‘a fair balance’ between privacy and expression where the two conflict. In Von Hannover v Germany (No 2), ²⁹ the Grand Chamber identified relevant criteria for achieving that balance. Where the media’s rights are implicated, the value of reporting matters in the public interest will be a decisive factor. ³⁰

The ECtHR is yet to consider and apply this caselaw in the context of the right to be forgotten but may well do so soon. Biancardi v Italy (communicated January 2020) concerns an order by an Italian court requiring a newspaper to remove an article published online in 2008. ³¹ The article concerned a violent brawl between two brothers during which one brother stabbed the other with a fish knife. In 2013, an Italian court ordered the newspaper to delete the article, finding that it was no longer in the public interest. The newspaper appealed the order, without success. ³² In its application to the ECtHR, it now contends that the domestic courts failed to properly consider its free expression rights vis-à-vis the brothers’ privacy. The Court’s judgment will provide useful guidance on the competing considerations at play and the weight to be given to each.

The difficulty of balancing the competing concerns in this context however is demonstrated well in a 2018 judgment of the High Court of England and Wales. NT1 and NT2 v Google and the Information Commissioner, ³³ which is credited as the first ‘right to be forgotten’ judgment in any common law jurisdiction. ³⁴ While largely confined to its facts, it offers a tentative first step towards clarifying the criteria for removal in a common law context. ³⁵

The claimants, anonymised to NT1 and NT2, sought orders that Google remove search results concerning each of their prior criminal convictions on the basis that they were no longer relevant. Both convictions were now spent in law. Justice Warby ordered Google to delist search results relating to the conviction of one claimant (NT2) but not the other (NT1). In doing so, his Honour relied heavily on a subjective assessment of each claimant’s credibility and remorse, as well as the fact that NT1’s current business interests made his past conviction more relevant. It followed that erasure was appropriate for one claimant, but not for the other. ³⁶ While the judgment is largely confined to its facts, that is precisely the point: it demonstrates that balancing the competing rights and interests involved in a right to be forgotten case requires case-by-case analysis and will turn on the particular fact patterns involved.

In its proposal, the ACCC makes clear that erasure is not absolute and must be resisted where information is ‘necessary for an overriding public interest reason’. ³⁷ Yet, as the European cases indicate, striking that balance is not a simple exercise. Australian courts do not routinely engage with the kind of balancing exercises which are common in the European context. As one commentator noted, were the right to be forgotten to be implemented in Australia, ‘[a] whole new body of law would need to be developed to determine when and in what circumstances one right should prevail over the other’. ³⁸

Defamation principles cannot be easily transposed to protect media freedom and expression in this context. Australia’s defamation laws are some of the toughest in the common law world and often work against media outlets and free expression. They have been credited with preventing the kind of #MeToo reporting witnessed overseas by chilling disclosures and publication. ³⁹ Unlike the UK, Canada and New Zealand, Australia does not recognise a broad-based public interest defence to defamation, which might protect public interest speech. The statutory defences under the national, uniform defamation laws have not been successful in protecting public interest speech. Similarly, the narrower protection of political speech has been described as ‘strikingly unsuccessful’ – frequently pleaded but rarely successful. ⁴⁰

If a right to erasure is to be taken forward in Australia, robust mechanisms must be established to ensure that public interest speech is protected. Legislatures will need to provide specific guidance regarding the circumstances in which information is ‘necessary for an overriding public interest reason’ and ensure an appropriate balance is struck between digital privacy on the one hand and free expression on the other. That guidance must recognise that the public interest value of information may change over time. Information not considered significant may acquire significance, where a person later becomes a public figure or simply from the perspective of academic or historical research. As the German Federal Constitutional Court highlighted in its most recent judgment on the topic, the right of a free press to report on matters of public interest does not expire with the mere passage of time. ⁴¹

The potentially chilling effects on journalism should not be overlooked. Cases like Biancardi demonstrate how the policy can affect the media and the online archive. The decisions outlined above were made in jurisdictions where free expression, the free press, and access to information are expressly protected far more robustly than they are in Australia.

If stronger protections are developed, they must apply broadly. Today, bloggers, Twitter activists and citizen journalists all play an active part in the dissemination of news and information and should also be protected from improper erasure. Yet as it stands, only media organisations acting ‘in the course of journalism’ are exempt from Australia’s Privacy Act. ⁴² Safeguards should apply to reflect the range of actors who perform a journalistic function but are not conventional journalists. This would also mirror the European approach, where courts look to the ‘public watchdog’ role performed by a person rather than any official journalistic accreditation. ⁴³

The role of APP entities

These considerations become more urgent when we remember that it is primarily private entities, acting on commercial interests, which would determine erasure requests. The ACCC envisages consumers would make requests directly to an APP entity – in line with Europe’s approach where the vast majority of requests never reach a court at all. ⁴⁴

Yet deciding whether erasure is appropriate or should be resisted for an ‘overriding public interest reason’ is a legalistic undertaking. As NT1 and NT2 demonstrates, it requires complex facts to be considered against evolving law and competing interests to be weighed against one another. There is no reason to expect that private companies will engage in that process pursuant to the public interest. They are far more likely to be guided by their own commercial interests and err towards erasing material to avoid legal challenges and monetary damages. This is particularly the case in Australia, where there are no obvious legal consequences for infringing public interest speech by acceding to illegitimate erasure requests.

If the proposal is taken forward, companies’ decision-making processes must be transparent, and courts should review particular cases. In Europe, national data protection authorities and interested parties have challenged particular outcomes and these interventions have resulted in useful clarification of the limits of the right itself. ⁴⁵

Further, commercial incentives should be carefully considered. While the GDPR nominally establishes ‘freedom of expression’ as a defence to an erasure request, ⁴⁶ in does not actually incentivise companies to protect it. Upon receiving a request, a data controller must act ‘without undue delay’, which in general means ‘within one month of receipt of the … request’. ⁴⁷ Coupled with significant fines for non-compliance, this tilts the balance in favour of erasure and against expression. ⁴⁸ Further, neither the GDPR nor the earlier 1995 Directive grant notice or an opportunity to be heard to website publishers or speakers whose speech is being erased or delisted either before or after a decision is made. Resolving erasure requests without hearing from one side risks lopsided consideration of the merits of privacy over free expression. Strengthening due process protections to those whose speech is affected may facilitate more effective decision-making. ⁴⁹

Human rights versus data rights

The ACCC’s reformist attitude should be commended, however ensuring that the right to erasure is exercised in the public interest requires more careful reform. As the European case law makes clear, ‘erasure’ is a malleable concept, which implicates a range of competing rights and interests.

It is not evident that we will achieve that reform through a framework of consumer protection. The ACCC’s inquiry focussed overwhelmingly on the impact of the digital platforms on competition in the media and advertising markets. The ‘right’ that it recommends accords with that framework: affording protection to individuals as data consumers not as political citizens deserving of rights. Such a narrow lens inevitably fails to grapple with broader political consequences of reform. At the very least, privacy reforms must proceed in tandem with equivalent speech protections. More broadly, we would be better served situating data protection not within consumer law, but in a rights framework capable of recognising and balancing the competing interests at play. Failure to take a more comprehensive approach will see data privacy protected at the expense of other interests, and courts and legislators left to fashion fixes as best they can.