In NT1 and NT2 v
Google and the Information Commissioner [2018] EWHC 799 (QB), Warby J had
to consider claims concerning the right to be forgotten or what he said was
more accurately described as the right to have personal information ‘delisted’
or ‘de-indexed’ by the operators of internet search engines.
The full judgment can be downloaded from the link below, following the summary. The report on bailli.org can be found here. In the meantime, the
Judiciary of England and Wales have published a summary of the judgment which
is set out below (references therein (eg [3]-[4]) are to paragraphs of the
judgment). We will aim to bring you further analysis in the course of the next
week.
A number of reports of the case have headlined with ‘Google loses . . . ‘. That is a vast oversimplification. Indeed, Google won on one claim and lost on the other in a strict sense but even in the case it lost the judge considered that it had taken reasonable care and no damages were awarded. Google is probably quietly satisfied.
Official Summary of the Judgment
1. The Court gives judgment after the trial of two
claims based on the “right to be forgotten” or, more accurately, the right to
have personal information “delisted” or “deindexed” by the operators of
internet search engines (“ISEs”). The claims are made under data protection law
and the English law tort of misuse of private information. References in square
brackets are to paragraphs in the judgment.
2. The
claimants are two businessmen who were convicted of criminal offences many
years ago. They complain of search results returned by Google’s ISE, “Search”,
that feature links to third-party reports about the claimants’ convictions
which they say are inaccurate and/or old, irrelevant and of no public interest,
or otherwise an illegitimate interference with their rights [1]-[2].
3. The claimants are anonymised in this public
judgment, to avoid the claims being self-defeating, or leading to additional
publicity for the information in question. In each case there is a private
judgment containing details that could not be made public in case they identify
the claimants [3]-[4].
4. The judgment sets out “nutshell” summaries of
the facts of each claim and identifies the main issues as (1) whether the
claimant is entitled to have the links in question excluded from Google Search
results either (a) because one or more of them contain personal data relating
to him which are inaccurate, or (b) because for that and/or other reasons the
continued listing of those links by Google involves an unjustified interference
with the claimant’s data protection and/or privacy rights; and (2) if so,
whether the claimant is also entitled to compensation for continued listing
between the time of the delisting request and judgment. [6]-[9].
5. The judgment identifies and discusses in detail
the legal framework, which is “complex and has developed over time”, with many
legislative provisions dating back to before the internet and well before the
creation of ISEs. [10]-[50]. Among ten key elements of the legal framework [13]
are:-
·
the European Communities Act 1972, which made EU Directives directly applicable
in the UK, and required English Courts to apply decisions of the Court of
Justice of the EU (“CJEU”);
·
the Rehabilitation of Offenders Act 1974, which provides that some convictions
become “spent” after a specified period, after which the offender is to be
treated “for all purposes in law” as if he had not been convicted, but cannot
sue for defamation in respect of a report of his conviction or sentence unless
he proves malice (the convictions in these cases are “spent”);
·
The Data Protection Act 1998 (“DPA”), which implemented EU Directive 95/46 (“DP
Directive”), the purpose of which was to safeguard individuals’ fundamental rights
and freedoms, notably the right to privacy, within the EU;
·
The tort of misuse of private information, recognised by the House of Lords in
the 2004 decisions in Campbell v MGN Ltd and In re S (A Child);
·
The May 2014 decision of the CJEU in Google
Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) and another Case C-131/12 [2014] QB 1022
(“Google Spain”), in which the CJEU
interpreted the privacy rights enshrined in the DP Directive and the EU Charter
of Fundamental Rights as creating a qualified “right to be forgotten”; and
·
Article 17 of the General Data Protection Regulation (“GDPR”), which came into
force on 25 May 2016 and will have direct effect in Member States, including
the UK, from 25 May 2018.
6. The CJEU’s decision in Google Spain requires the Court to strike a fair balance between
fundamental rights and interests, of which freedom of expression and freedom of
information are two. The outcome may depend on the nature and sensitivity of
the processed data and on the interest of the public in having access to that
particular information. [37].
7. The Court observes [38] that:
… it
may be misleading to label the right asserted by these claimants as the “right
to be forgotten”. They are not asking to “be forgotten”. The first aspect of
their claims asserts a right not to be remembered inaccurately. Otherwise, they
are asking for accurate information about them to be “forgotten” in the narrow
sense of being removed from the search results returned by an ISE in response
to a search on the claimant’s name. No doubt a successful claim against Google
would be applied to and by other ISEs. But it does not follow that the
information at issue would have to be removed from the public record … And a
successful delisting request or order in respect of a specified URL will not
prevent Google returning search results containing that URL; it only means that
the URL must not be returned in response to a search on the claimant’s name.
The
NT1 case
8. The claim relates to three links returned by
Google, providing information about NT1’s conviction after a trial for
conspiracy to account falsely, and the sentence imposed, which was one of 4
years’ imprisonment.
9. The issues are re-stated in more detail [51]-[57],
and decided as follows:-
(1) The claim is not a defamation claim in
disguise, and hence an abuse of the Court’s process, as alleged by Google
[58]-[65].
(2) The claimant has failed to make out any
of the six complaints of inaccuracy he makes in respect of the three links of
which he complains: see [66]-[78] (facts), [79] (complaints), [80]-[87] (law),
[88]-[92] (evidence), [93]-[94] (assessment).
(3) Google cannot rely on the so-called
“journalism exemption” in s 32 of the DPA. It has not processed these data for
journalistic purposes, or alternatively not only for those purposes. Moreover,
it has not adduced any evidence that it held a belief that compliance with the
provision of the DPA, from which it seeks exemption, would be incompatible with
such a purpose [95]-[102].
(4) The balancing process which Google
Spain requires is not a stand-alone exercise, separate from the question of
compliance with the DPA. Nor is it to be carried out in accordance with the
GDPR, which is not yet in force. Nor is it one to be addressed as part of the
Court’s decision on remedies. It is an integral part of the process of deciding
whether Google’s activities have been and are being carried out in accordance
with its duties under the DPA. The Court agrees with the parties that this
exercise should be carried out with reference to guideline criteria established
by a Working Party established under Article 29 of the DP Directive.
[103]-[105].
(5) The processing in this case complies
with DPA Schedule 3 condition 5 [110]- [113]. The question of whether the
processing complies with the other requirements of the DPA collapses into the
application of the Google Spain balancing test, and is not separate or
distinguishable from it. [114]-[115].
(6) NT1 has failed to make out his claim
for delisting pursuant to Google Spain: [118]- [130] (further facts),
[131]-[135] (some further issues of principle), [136]-[169] (application of law
to facts). Consideration of the Working Party criteria leads the Court to these
key conclusions, at [170]:
Around the turn of the century, NT1 was a
public figure with a limited role in public life. His role has changed such
that he now plays only a limited role in public life, as a businessman not
dealing with consumers. That said, he still plays such a role. The crime and
punishment information is not information of a private nature. It was
information about business crime, its prosecution, and its punishment. It was
and is essentially public in its character. NT1 did not enjoy any reasonable
expectation of privacy in respect of the information at the time of his
prosecution, conviction and sentence. My conclusion is that he is not entitled
to have it delisted now. It has not been shown to be inaccurate in any material
way. It relates to his business life, not his personal life. It is sensitive
information, and he has identified some legitimate grounds for delisting it.
But he has failed to produce any compelling evidence in support of those
grounds. Much of the harm complained of is business-related, and some of it
pre-dates the time when he can legitimately complain of Google’s processing of
the information. His Article 8 private life rights are now engaged, but do not
attract any great weight. The information originally appeared in the context of
crime and court reporting in the national media, which was a natural and
foreseeable result of the claimant’s own criminal behaviour. The information is
historic, and the domestic law of rehabilitation is engaged. But that is only
so at the margins. The sentence on this claimant was of such a length that at
the time he had no reasonable expectation that his conviction would ever be
spent. The law has changed, but if the sentence had been any longer, the
conviction would still not be spent. It would have been longer but for personal
mitigation that has no bearing on culpability. His business career since
leaving prison made the information relevant in the past to the assessment of
his honesty by members of the public. The information retains sufficient
relevance today. He has not accepted his guilt, has misled the public and this
Court, and shows no remorse over any of these matters. He remains in business,
and the information serves the purpose of minimising the risk that he will
continue to mislead, as he has in the past. Delisting would not erase the
information from the record altogether, but it would make it much harder to
find. The case for delisting is not made out.
10. The claim for misuse of private information also
fails [171]-[172], and there can be no question of compensation or damages.
[173].
The NT2 case
11. NT2 complains of links to 11 source
publications. He makes one inaccuracy complaint, which relates to an item in a
national newspaper of relatively recent date. The Court assesses this claimant
as an honest and generally reliable witness, whose evidence is accepted on most
of the points of dispute. [176]. The Court:
(1) dismisses Google’s argument that the
claim is an abuse of process [177];
(2) outlines the facts relevant to the data
protection claims [178]-[184], noting that the convictions in this case were
for conspiracy to carry out surveillance, and the sentence one of 6 months’
imprisonment;
(3) upholds the inaccuracy complaint,
finding that the national newspaper item is misleading as to the nature and
extent of the claimant’s criminality, and falsely suggests that he made
criminal proceeds from it with which, with the aid of a financial firm, he
dealt dishonestly and sought to shield from creditors [186]- [190];
(4) adopts in this case the conclusions
reached in NT1 about the journalism exemption and the way in which to apply
Google Spain [193]; and
(5) applying the legal principles
identified when dealing with the case of NT1, upholds NT2’s Google Spain delisting claim: see [194]
(law), [195]-[200] (further facts), [201]-[207] (assessment of relevance),
[208]-[222](consideration of the Working Party criteria). In this case, the
conviction was not one involving dishonesty, and it was based on a plea of
guilty. The Court reaches these key conclusions, at [223]:
The crime and punishment information has
become out of date, irrelevant and of no sufficient legitimate interest to
users of Google Search to justify its continued availability, so that an
appropriate delisting order should be made. The conviction was always going to
become spent, and it did so in March 2014, though it would have done so in July
of that year anyway. NT2 has frankly acknowledged his guilt, and expressed
genuine remorse. There is no evidence of any risk of repetition. His current
business activities are in a field quite different from that in which he was
operating at the time. His past offending is of little if any relevance to
anybody’s assessment of his suitability to engage in relevant business activity
now, or in the future. There is no real need for anybody to be warned about
that activity.
(6) The same result follows in the tort of
misuse of private information. No compensation is awarded because Google has
established the defence under s 13(3) of the DPA, that it took reasonable care.
Nor are damages for misuse awarded. But a delisting order will be made.
