Forget it! High Court clarifies guidance on 'right to be forgotten'.

CJEU in Google Spain SL v Agencia Espanola de Proteccion de Datos Case C-131-12 [2014] QB 1022 established a ‘right to be forgotten’ for individuals against search engines. In NT1 and NT2 v Google LLC (The Information Commissioner intervening) [2018] EWHC 799 QB the court considered whether this should be extended to remove links to reports of an individual’s criminal convictions.

 

These two cases involved businessmen convicted of conspiracy. They wanted to have reports of these crimes removed. Both convictions occurred over ten years ago and were spent. NT1 was convicted of conspiracy to commit false accounting and tax evasion, while NT2 pleaded guilty to conspiracy to tap phones and hack computers belonging to environmental activists that had made threats against him and his business.

 

The arguments

 

Convictions are, in principle, a matter of public record. However, a number of recent cases have established that a ‘spent’ conviction (under the definition in the Rehabilitation of Offenders Act 1974) can be treated as part of an individual’s private life, once enough time has passed.

 

In both cases the businessmen made applications to the court to order Google to remove links from searches on their names, that would point to reports of these convictions. They did this under ss. 10 and 14 of the Data Protection Act 1998 (the “DPA”) stating that they felt the information available (via these a links) was inaccurate and/or likely to cause damage and distress. They also sought compensation under section 13 of the DPA.

 

Google’s response was centred around the journalism exemption in s.32(1) of the DPA, amongst other matters.

 

The judgment raised a number of general principles, in relation to data privacy

 

First, concerning search providers: The judgment stated that search providers are not normally able to rely on the journalism exception in s.32(1) of the DPA. This is because they, not only process third party content, but do so for BOTH journalistic purposes and commercial purposes. Section s.32(1) also requires them to establish a reasonable belief that publication is in the public interest. Search providers, the judgment found, are therefore in a different position to media organisations. Connected to this, the DPA allows search providers to process information relating to a conviction on the basis that it “has been made public as a result of steps deliberately taken by the data subject” (Schedule 3, Condition 5) in committing the offence.

 

Second, about grounds for a claim: if you wish to challenge the accuracy of data held about yourself, you can choose whether to claim for defamation, data protection breaches, misuse of private information, or a combination of the three. If your motivation is to protect your privacy (rather than, for example, correcting information) the judgement found that it is not an abuse of process to choose to pursue a data protection or privacy claim, rather than a defamation claim.

 

Finally, about the GDPR and applying the first case of ‘Google Spain’: The General Data Protection Regulation (GDPR) should not be used to help interpret the judgement found in Google Spain (or any other legal principles applying to events before 25th May 2018). The judgment stated, instead, that, in applying Google Spain, the court should consider the following questions:

  • Does the search result relate to an individual, and does the search result come up against a search on the data subject’s name?

  • Does the data subject play a role in public life? Is the data subject a public figure?

  • Is the data subject a minor?

  • Are the data accurate?

  • Are the data relevant and not excessive? For instance, do the data relate to the working life of the data subject, do they constitute hate speech, slander, libel or similar offences against the complainant, and is it clear whether the data reflect a personal opinion or are verified fact?

  • Is the information sensitive within the meaning of Article 8 of the Data Protection Directive?

  • Are the data up to date, and are they being made available for longer than is necessary for the purpose of the processing?

  • Is the data processing causing prejudice or a disproportionately negative privacy impact?

  • Does the search result link to information that puts the data subject at risk?

  • In what context was the information published? For instance, was it voluntarily made public by the data subject or could the data subject reasonably have known that it would be made public?

  • Was the original content published in the context of journalistic purposes?

  • Does the publisher of the data have a legal power or obligation to make the data publicly available?

  • Do the data relate to a criminal offence?

 

The judgment: NT1

 

In this case the judge concluded that NT1 continued to play a limited role in public life. He found that NT1 had been convicted of a business crime, not a matter of a private nature, and, importantly, had shown no remorse. He had continued in business and, as a result, the judge found that the information surrounding his conviction was relevant to the assessment of his honesty by members of the public. The judge found no evidence of damage to his business as a result of the information about his conviction.

 

In considering his personal life, the judge found no evidence of material interference with his right to respect for family life, and any that there was, was justified by and proportionate to the right of the public to receive the information.

 

The judge did not find that any of the information was inaccurate. NT1’s claim failed.

 

The judgment: NT2

 

In this case the judge found one of the linked articles to include inaccurate information and ordered that link to be removed from future searches on the claimant’s name. No other links to inaccurate information were found.

 

The judge noted, once again, that NT2 also remained a public figure, but was noted for no longer being involved in the same industry as before his conviction. There was no basis to think that he would repeat his wrongdoing or presented a risk to consumers, customers or investors.

 

Furthermore the nature of his conviction was in relation to an invasion of privacy, not dishonesty. He had acted in a belief that he was defending his business against people responsible for trespass, criminal damage, and death threats. He had shown remorse and pleaded guilty. He had not made false claims regarding his reputation or integrity.  

 

As a result the judge found that the information regarding his conviction had therefore become irrelevant.

 

More importantly, the judge also found evidence that the availability of such information was having a profound adverse impact on his family, including his school-age children. He also provided credible detail regarding damage to his business.

 

The judge found it appropriate to order the links to be removed from search results on his name. Linked to this, however, the judge did find that Google had shown a commitment to complying with the relevant data protection requirements and had taken reasonable care to do so. Therefore, no damages were payable.

 

A twist in the tale

 

One final part to the judgment was of particular interest. The judge stressed the decision did not prevent Google from returning any of the links in searches, as long as they do not specify the claimant’s name. The judge also reminded the claimants that it, furthermore, did not automatically follow that they could require the original article publishers to take them down, as a result of this finding.


For more information about this and any other related matters, please contact us today.