"I would like to be forgotten. What's so good about being remembered?"
(Isabella Rossellini)
On 13 April 2018, judgment was handed down by the High Court in the case of NT1 & NT2 v Google LLC [2018] EWHC 799 (QB), the first ‘right to be forgotten’ case to be heard in the English Courts.
Though primarily concerned with the removal of links to various sites, the Judgment (which is surprising in some respects), also serves as useful guidance of the Courts' continuing evolving approach to significant data protection issues that cross the spectrum of commercial enterprise. This is particularly considering the balance between the rights of data subjects and the public interest.
Background
Two claimants, to protect their identity known only as ‘NT1’ and ‘NT2’, brought separate claims against Google, seeking orders for the removal of search results linking their names to articles about their past criminal convictions. The Claimants also sought damages for the misuse of their private information and compensation under the Data Protection Act 1998 (the "DPA").
NP1
In the late 1990's NT1 had been sentenced to four years’ imprisonment for conspiracy to account falsely, his sentence ending in the early 21st century. He had also been accused of (though never tried) in relation to a separate conspiracy concerned with the same business. Others connected to the business had been convicted of those offences. Both his conviction, and the other allegations made against him was the subject of media interest, and Google made links available to various of such articles.
NT2
In the early 21st century NT2 was involved in what the judge described as "a controversial business that was the subject of public opposition over its environmental practices". He pleaded guilty to two counts of conspiracy in connection with the business, and received a short custodial sentence, serving six weeks in prison before being released on license. His sentence came to an end over 10 years ago.
Like NT1, his conduct had been the subject of media interest, and Google made links available to various relevant articles. More recent articles concerning NT2 and his past conduct had been published, including reports of interviews with NT2, which Google had again made links available to.
De-list requests
NT1 first requested Google to "de-list" six links to articles relating to him in June 2014. NT2 made his first request in April 2015, concerning 8 links. NT2 also later requested that the more recent articles concerning him be removed. By this time, both of their convictions had been "spent", meaning that they were entitled to be treated, for all purposes in law, as if they had not been convicted.
Following various exchanges, in which Google declined those de-listing requests, in October 2015 both NT1 and NT2 commenced proceedings.
The Law
Journalism
Mr Justice Warby rejected Google’s attempt to rely on the broad ‘journalism’ exemption in section 32 of the DPA as entitling them to maintain the links, concluding that Google processes third party content for commercial purposes and not just journalistic purposes, and because Google had failed to show it held a reasonable belief that publication would be in the public interest, both conditions necessary to rely on the exemption.
Google Spain
The Judge applied the precedent set by the European Court of Justice in Google Spain SL v Agencia Espanola de Proteccion de Datos Case C-131/12, ("Google Spain"), which first established a right to have information ‘delisted’ by internet search engines. Quoting that decision directly, Worby J explained that determining the requests required him to strike "a fair balance" between "the legitimate interest of internet users potentially interested in having access" to the information and "the data' subjects fundamental rights". Considering that balance, the Judge was clear that the scales must start off firmly equal.
The Judge set out a wide range of factors that it was necessary to consider in finding the balance. In this specific instance, that included guidelines provided by an EU wide Working Group concerning the application of Google Spain, which set out thirteen different elements to consider.
GDPR
The Judge noted the express "right of erasure" power granted to data subjects by the GDPR. However, he rejected submissions made by NT1 and NT2 that this power reflected the Google Spain decision and that he ought to be guided by that law, noting that it was not yet in effect and had not even been enacted at the commencement of these proceedings. Nonetheless, he was quick to recognise that the GDPR would likely govern any future "right to be forgotten" claims.
Findings
NT1
In respect of NT1, the Judge found that for certain of the linked articles, even though the headline may have been considered inaccurate, read as a whole they were "clear enough". Accordingly, applying the required criteria and conducting the necessary balance exercise,the case for delisting was not made out. He considered it particularly important that:
1) NT continues to play a limited role in public life;
2) the published information related to business crime as opposed to NT1’s private life; and
3) NT1 remains in business, and that the information served a purpose of “minimising the risk that he will continue to mislead”.
NT2
In stark contrast, Warby J found that NT2 had made out the case for delisted. He concluded that the relevant links had become "out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability”. In conduct the balancing exercise, he also noted:
1.) though still a public figure, NT2 was no longer involved in the same industry as before his conviction;
2.) his conviction related to an invasion of privacy offence rather than dishonesty; and
3.) there was evidence that the availability of the information was adversely affecting NT2’s family life.
Damages/Compensation
Despite their refusal to comply with the de-listing requests having been overturned, the Judge found that Google had taken care to comply with the relevant data protection requirements, and accordingly rejected the claim by both Claimants for compensation under the DPA. He also rejected the claim for misuse of private information.
Comments
The precise effect of the judgment its worthy of note – it doesn't require the relevant articles to be taken down, nor indeed for Google (or any other search providers) to remove all links to those articles. Rather, the prohibition was only on the articles to be listed in searches of NT2's name. The refusal to order damages or compensation is also notable, showing that the Courts will take care to consider and reflect steps taken to achieve compliance with relevant Data Protection requirements.
Given the relevance to the Judge's findings of the accuracy of the data, and the distinction drawn between NT1 and NT2, it also worth considering exactly what the Judgment remedies. As the Judge himself described it, it is not just a right to be "forgotten", but also "not to be remembered incorrectly". And that NT1 failed to succeed, despite the articles about him being substantially older, demonstrates that the required ingredients to remove links is far more than just the age of relevant articles.
Above all, the case demonstrates that the Court will determine ‘right to be forgotten', and post-GDPR "right to erasure" claims on their specific facts, that there is no absolute right for individuals to have search results removed or data deleted, and each case will be decided on its merits, each time on the basis of a careful balancing act between the public interest and the data subject's own rights. Even upon the implementation of the GDPR, it is clear that, in considering the rights of data-controllers, Courts (and likely regulators) will necessarily have to consider a broad range of factors.
Nevertheless, if it wasn't already, the power to insist on the removal of links is now firmly enshrined in English law. And in an era of consumer activism, and the imminent arrival of the right of erasure, it can be fairly anticipated that data-controllers will, before long, be faced with requests by data-subjects for data to be deleted and links removed. It will be vital for data-controllers to ensure that they have appropriate procedures in place to deal with such requests. A failure to do is likely to have significant monetary and reputation consequences.
