Regulator take-down orders

Question 15–2 Should a regulator be empowered to order an organisation to remove private information about an individual, whether provided by that individual or a third party, from a website or online service controlled by that organisation where:

(a) the individual makes a request to the regulator to exercise its power;

(b) the individual has made a request to the organisation and the request has been rejected or has not been responded to within a reasonable time; and

(c) the regulator considers that the posting of the information constitutes a serious invasion of privacy, having regard to freedom of expression and other public interests?

15.30 The new Australian Privacy Principal in Proposal 15–2 does not include any right for an individual to have personal information deleted or de-identified when that information is provided by a third party. There may, however, be merit in introducing a take-down mechanism by which an individual could apply to have such information removed from websites and other online services. As noted above, the rapid removal of privacy information from public websites may help prevent an invasion of privacy. Although some online service providers may offer a system for complaining about a serious invasion of privacy, others may not.[28]

15.31 A regulator take-down system may provide a mechanism for limiting the impact or serious invasions of privacy. However, there is also a risk that such a system may have an undesirably chilling effect on online freedom of expression. The ALRC has therefore sought comment on the desirability of a take-down system, but has not proposed a take-down system at this stage. Comments are sought on:

  • whether any such take-down system is desirable;

  • which regulator or regulators should be empowered to issue take-down orders;

  • the circumstances in which a take-down order should be issued; and

  • any ways in which negative impacts on free expression could be minimised.

15.32 If the statutory cause of action for serious invasion of privacy is enacted, an individual who has suffered a serious invasion of privacy may apply to a court for an injunction requiring the removal of private information.

15.33 However, applying for an injunction may be expensive and time-consuming for the affected individual. A take-down system operated by a regulator would potentially be a cheaper and quicker alternative. It may also be a more accessible alternative where the affected individual is a young person. The OAIC and the ACMA may be well-suited to exercising a power to order take-downs.

15.34 The ALRC has suggested a model whereby a take-down order could be issued if three conditions are met. First, the regulator must receive a complaint from an individual. This would ensure that the regulator could not order a take-down of its own motion. Second, the individual must have attempted, without success, to have the material removed by the organisation which controls the website or online service. This would ensure that individuals had attempted to deal with the matter themselves before engaging the regulator. Third, the regulator must consider that the posting of the information constitutes a serious invasion of privacy, having regard to freedom of expression and other public interests. This would ensure that take-downs would only be ordered where an invasion was serious and where there was no countervailing interest in freedom of expression or public interest.

15.35 As noted above, the Department of Communications is currently engaged in an inquiry into Online Safety for Children. As part of that inquiry, the Department has proposed a Commissioner with the power to issue a notice requiring the removal of material that is likely to harm a child. Such a notice could, under the Department’s proposal, be directed to either the internet intermediary[29] or the individual who posted the material.