The much-anticipated decision in NT 1 & NT 2 v
Google LLC [2018] EWHC 799 (QB) was handed down on 13 April 2018. The joint
judgment in two separate claims against Google, is the first time the English
courts have had to rule on the application of the ‘right to be forgotten’
principle following the decision in Google Spain SL, Google Inc. v Agencia
Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (Case
C-131/12).
This article explores the decision and the ramifications on
future delisting requests to Google. The judgment necessarily had to deal with
a number of novel issues and discuss the legal approach to such claims.
The facts of the claims
The two trials took place sequentially in February and March
of this year, both before Mr Justice Warby and with the claimants sharing the
same legal team.
Both claimants were granted anonymity (as ‘NT1’ and ‘NT2’
respectively) so as to avoid undermining the purpose of their claims. Third
parties and businesses were also anonymised in the public judgment to try and
prevent jigsaw identification. Similarly, many of the dates given in the
judgment are vague. Even with these safeguards the 230-paragraph public
judgment is supplemented by a detailed private judgment in each case.
NT1
NT1 is a businessman. He had been involved in a
controversial property business in the late 1980s and early 1990s, when he was
in his thirties. In the late 1990s he was convicted of conspiracy to false
account, having transferred monies to offshore companies to cheat the revenue.
NT1 received a four-year custodial sentence, and was
released in the early 2000s. When the sentence was passed it was of such a
length that it would never have been deemed ‘spent’ for the purposes of the
Rehabilitation of Offenders Act (‘ROA’). However, it became spent following a
change in the law in March 2014 (which had retrospective effect). Notably had the
sentence been one day longer, the position would not have changed.
NT1 sought the delisting of three URLs from the search
results returned upon entry of his name into Google’s search engine. Two of the
URLs related to contemporaneous media reports of NT1’s conviction. The other
was a book extract which referred to the conviction.
NT2
NT2 is also a businessman. Around the turn of the century he
was involved in a business which had attracted public controversy for
environmental reasons. The business was targeted by individuals seeking to
disrupt it. NT2 took steps to identify those individuals; this included
sanctioning the use of unlawful phone and computer hacking. NT2 was convicted
for his part in this and received a six-month custodial sentence, of which he
served six weeks. His conviction had also become spent in March 2014 (but it
would have become spent in July 2014, even if the law had not changed). NT2 complained
of about 11 URLs, some being contemporaneous reports of his prosecution and
conviction, and some more recent.
In October 2015 both claimants sued Google for breach of the
Data Protection Act 1998 (‘DPA’) and the Misuse of Private Information owing to
Google’s refusal to ‘delist’ the URLs they had complained of. The Information
Commissioner (who has a statutory duty to review Google’s decisions following a
request by a data subject) was granted permission to intervene in the
proceedings.
The judge summarised the main issues in the case as
follows (at [9]):
‘(1) whether the claimant is entitled to have the links
in question excluded from Google Search results either (a) because one or more
of them contain personal data relating to him which are inaccurate, or (b)
because for that and/or other reasons the continued listing of those links by
Google involves an unjustified interference with the claimant’s data protection
and/or privacy rights; and (2) if so, whether the claimant is also entitled to
compensation for continued listing between the time of the delisting request
and judgment. Put another way, the first question is whether the record needs
correcting; the second question is whether the data protection or privacy
rights of these claimants extend to having shameful episodes in their personal
history eliminated from Google Search; thirdly, there is the question of
whether damages should be paid.’
The approach
Abuse of process
At the outset, Google sought to argue that the claims were
an abuse of the court’s process as they were attempts to circumvent the laws
and procedures of defamation law. This was somewhat surprising given the number
of previous judgments that have recognised the efficacy in choosing to sue
under the DPA instead of (or as well as) libel. As Warby J said at [61] ‘…As a
general rule, it is legitimate for a claimant to rely on any cause of action
that arises or may arise from a given set of facts. This is not ordinarily
considered to be an abuse just because one or more other causes of action might
arise or be pursued instead of, or in addition to, the claim that is relied on.’
The exemption
Again rather optimistically, Google attempted a second
knock-out blow by arguing that it could avail itself of the ‘journalistic
exemption’ under the DPA, s 32 because ‘the processing is undertaken with a
view to the publication by any person of any journalistic, literary or artistic
material’. Noting that Google’s search function was indiscriminate, Warby J
dealt with this robustly at [98]: ‘the concept is not so elastic that it can be
stretched to embrace every activity that has to do with conveying information
or opinions. To label all such activity as “journalism” would be to elide the
concept of journalism with that of communication’. Moreover, the other
constituent elements of the defence were not made out (at [102]): ‘There is no
evidence that anyone at Google ever gave consideration to the public interest
in continued publication of the URLs complained of, at any time before NT1
complained…it would still have to go on to show that it held a belief, that was
reasonable, that it would be incompatible with the special purposes for its
continued processing of the data to be carried out in compliance with the DPA.
There is no evidence of that at all. Google’s “right to be forgotten”
assessment process is not designed or adapted for that purpose. That may be
because it has not considered until recently that the journalism exemption
might be available to it. It certainly did not suggest this in the Google Spain
case’.
Assessing inaccuracy (the Fourth Data Protection Principle)
Warby J held that the correct approach to adopt when
determining whether data was inaccurate or misleading was similar to that
applied in the law of defamation. In other words, the alleged inaccuracy had to
be considered in context and not on an artificial microlevel. Moreover, a
single meaning was applied to the alleged inaccuracy. However, unlike
defamation, the burden of proof was on the claimant to prove that the ‘meaning’
was inaccurate. This is an important, and perhaps overlooked, issue for anyone
complaining about inaccurate data processing. It is simply not sufficient to
make bald assertions of inaccuracy.
With NT2, a complaint that a URL exaggerated the extent of
the claimant’s criminality was accepted (the article wrongly imputed the motive
of the crime was financial gain). With NT1 the judge was unimpressed with the
claimant’s attempt to particularise and evidence inaccuracy. Indeed, he was
generally unimpressed with the claimant’s evidence and reliability, to the extent
that he felt it appropriate to make positive findings of wrongdoings beyond NT1’s
conviction.
First Data Protection Principle (fairness/lawfulness)
It was suggested by the Information Commissioner’s Office
(‘ICO’) that it might be necessary for the Court to disapply the provision of
the First Data Protection Principle which requires a condition in sch 3 to the
DPA to be met before there can be any lawful processing of sensitive personal
data (which includes allegations of criminality and reporting of criminal
proceedings). This was because, if none of the conditions applied, all such
data processing (ie returning search results about any criminal
proceedings/allegations) would automatically be unlawful. However, such an
approach would have potentially been problematic as, unlike in Vidal-Hall v
Google [2015]
EWCA 311 (where the Court of Appeal disapplied the DPA, s 13(2)), there was
no real discrepancy between the EU parent legislation (Directive 95/46/EC/the
Data Protection Directive) and the domestic legislation. In the event, the
judge found that condition 5 of sch 3 was met: the information had been made
public as a result of steps deliberately taken by the data subject. Warby J
held that a consequence of the open justice system is that in committing a
criminal offence (even one committed in private), one is deliberately taking
steps to make information about that offence public.
Additionally, in order for any personal data to be
processed, one of the conditions in sch 2 to the DPA must be met. The most
widely-drawn condition in sch 2 is condition 6(1) which, in essence, allows
data processing where it is necessary in pursuance of legitimate interests by
the data controller or by third parties to whom the data is disclosed. Processing
for such ‘legitimate interests’ is prevented only where it is unwarranted by
virtue of prejudice caused to the rights, freedoms, or legitimate interests of
the data subject. The judge was in no doubt that Google had a legitimate
interest in processing personal data in pursuit of its business as a search
engine operator, and that third parties (ie the general public) have a
legitimate interest in being able to receive information from Google (as well
as other search engines). The question was whether, in these cases, such
processing was ‘necessary’, in pursuance of those legitimate interests, or ‘unwarranted’,
considering any prejudice caused to NT1 and NT2. The test here was essentially
the same as the Article 8 v Article 10 [right to a private life v right to
freedom of expression] ‘ultimate balancing test’ applied in privacy cases, and
part of the balancing process mandated by Google Spain. The judge noted that
the starting point was that neither had precedence and that any inference to
the contrary drawn from Google Spain was misunderstood, such comments simply
being descriptive (of the likely scenario in the majority of cases involving
historic engine results), rather than legally prescriptive.
Google Spain and the Second, Third and Fifth Data Protection
Principles
Warby J held that the remaining data protection principles (not
to process data other than for a specified legal process, to ensure personal
data is adequate, relevant and not excessive and not to retain data longer than
is necessary) were all conveniently subsumed/collapsed into the Google Spain/Article
8 balancing exercise.
The Article 29 Working Party’s Criteria
The judge adopted the Article 29 Working Party’s 13-point checklist
for factors that should be considered by data protection authorities (such as
the ICO) when deciding whether search results should be delisted. The headline
questions for each factor are:
- Does the search result relate to a natural person – i.e. an
individual? And does the search result come up against a search on the data
subject’s name? - Does the data subject play a role in public life? Is the
data subject a public figure? - Is the data subject a minor?
- Is the data accurate?
- Is the data relevant and not excessive? Does the data relate
to the working life of the data subject? The overall purpose of these criteria
is to assess whether the information contained in a search result is relevant
or not according to the interest of the general public in having access to the
information. Relevance is also closely related to the data’s age. Depending on
the facts of the case, does the search result link to information which
allegedly constitutes hate speech/slander/libel or similar offences in the area
of expression against the complainant? Is it clear that the data reflect an
individual’s personal opinion or does it appear to be verified fact? - Is the information sensitive within the meaning of Article 8
of the Directive 95/46/EC [Section 2 of the DPA]? - Is the data up to date? Is the data being made available for
longer than is necessary for the purpose of the processing? - Is the data processing causing prejudice to the data
subject? Does the data have a disproportionately negative privacy impact on the
data subject? - Does the search result link to information that puts the
data subject at risk? - In what context was the information published? a. Was the
content voluntarily made public by the data subject? b. Was the content
intended to be made public? Could the data subject have reasonably known that
the content would be made public? - Was the original content published in the context of
journalistic purposes? - Does the publisher of the data have a legal power – or a
legal obligation – to make the personal data publicly available? - Does the data relate to a criminal offence?
Full details of the guidelines can be found here.
The judge considered each question for both claimants, some
of which obviously overlapped with issues to be considered under the First and
Fourth Data Protection Principles. In both instances, he found factor 13 to be
the most important issue, quoting the commentary (at [161):
‘As a rule, [data protection authorities] are more likely to
consider the de-listing of search results relating to relatively minor offences
that happened a long time ago, whilst being less likely to consider the
de-listing of results relating to more serious ones that happened more
recently. However, these issues call for careful consideration and will be
handled on a case-by-case basis.’
Warby J carried out a detailed analysis of the nature of the
offending of NT1 and NT2, the surrounding circumstances, events since the
offences took place, and the claimants’ attitude to their convictions. This was
in turn linked to the question of whether the claimant was ‘rehabilitated’.
Rehabilitation of Offenders Act 1974 (‘ROA’)
Those with spent convictions hoping for clarity (or even
guidelines) on when they can expect Google to delist results will be
disappointed by the judgment. No tangible principle of when a URL relating to a
criminal conviction should be delisted has been established. The commonly
argued proposition that results should be delisted at the point a conviction
becomes spent was rejected as being a ‘blunt instrument’ that was incompatible
with human rights (freedom of expression) jurisprudence. If a conviction was
spent this was held to be ‘weighty factor’ in favour of delisting, but ‘not
determinative’. A more nuanced assessment was required in each case than simply
looking at the length of a sentence and the prescribed time limits under the
ROA (which can be found here).
The judge sought to summarise the rationale and approach (at
[166]):
‘Without attempting to be exhaustive I have arrived, for the
purposes of these cases, at the following reconciliation:
(1) The right to rehabilitation is an aspect of the law of
personal privacy. The rights and interests protected include the right to
reputation, and the right to respect for family life and private life,
including unhindered social interaction with others. Upholding the right also
tends to support a public or societal interest in the rehabilitation of
offenders. But the right is not unqualified. It will inevitably come into
conflict with other rights, most notably the rights of others to freedom of
information and freedom of expression. It is not just legitimate but clearly
helpful for Parliament to lay down rules which clearly prescribe the point at
which a given conviction is to be treated as spent. But such rules, depending
simply on the offender’s age and the nature and length of the sentence, can
only afford a blunt instrument. Parliament has legislated for exceptions, but
these cannot be treated as necessarily exhaustive of the circumstances in which
information about a spent conviction may be disclosed. More subtle tools are
needed, if the court is to comply with its duty under the HRA to interpret and
apply the law compatibly with the Convention. Section 4 of the 1974 Act must be
read down accordingly as expressing a legal policy or principle.
(2) The starting point, in respect of information disclosed
in legal proceedings held in public, is that a person will not enjoy a
reasonable expectation of privacy (Khuja, [61] above). But there may come a
time when they do. As a general rule (or ‘rule of thumb’, to adopt the language
of the Working Party), the point in time at which Parliament has determined
that a conviction should become spent may be regarded as the point when the
convict’s Article 8 rights are engaged by any use or disclosure of information
about the crime, conviction, or sentence (see T, [49(2)] above). But this does
not mean that in 1974 Parliament enacted a right to confidentiality or privacy
from that point on (Pearson, L v The Law Society, [47-48] above). Still less
does it follow that the convict’s Article 8 rights are of preponderant weight,
when placed in the balance. As a matter of principle, the fact that the
conviction is spent will normally be a weighty factor against the further use
or disclosure of information about those matters, in ways other than those
specifically envisaged by Parliament. The starting point, after all, is the
general policy or principle in favour of that information being ‘forgotten’, as
expressed in s 4 of the 1974 Act. That policy has if anything become weightier
over time. It is likely that in many cases the particular circumstances of the
individual offender will support the application of that general principle to
his or her case. But the specific rights asserted by the individual concerned
will still need to be evaluated, and weighed against any competing free speech
or freedom of information considerations, or other relevant factors, that may
arise in the particular case.
(3) Part of this balancing exercise will involve an
assessment of the nature and extent of any actual or prospective harm. If the
use or disclosure causes, or is likely to cause, serious or substantial
interference with private or family life that will tend to add weight to the
case for applying the general rule. But where the claim relies or depends to a
significant extent upon harm to reputation, the Court is in my judgment bound
to have regard to s 8 of the 1974 Act. It is possible to identify a public
policy that underlies that section, and which qualifies the public policy that
underpins s 4. It is that offenders whose convictions are spent should not be
able to obtain remedies for injury to their reputation (or consequent injury to
feelings) resulting from the publication in good faith of accurate information
about the spent conviction, or the related offending, prosecution or sentence.
It is not a satisfactory answer to this point to say that the causes of action
relied on are not libel or slander, but data protection and/or misuse of
private information. That is too narrow and technical an approach, which
ignores the fact that neither cause of action was known to Parliament when it
legislated. The fact that, as I accept, reputational harm can support a claim
under those causes of action tends, in fact, to undermine the force of that argument.
I therefore do not accept that the policy that underlies s 8 falls to be
disregarded merely because the claim is not framed in defamation. Again, there
can be no bright line, because Convention jurisprudence shows that reputational
harm can be of such a kind or severity as to engage Article 8 (Yeo, [140],
above); but subject to considerations of that kind I would consider that this
statutory policy or principle falls to be applied by the Court.
(4) Another aspect of the proportionality assessment will be
the nature and quality of the societal benefits to be gained in the individual
case by the use or disclosure in question. Freedom of expression has an
inherent value, but it also has instrumental benefits which may be weak or
strong according to the facts of the case. The fact that the information is, by
its very nature, old will play a part at this stage also.
(5) Most, if not all, of these points about spent convictions
are likely to be relevant in more than one context. Where a spent conviction is
the subject of a de-listing claim, the Court will need to weave its evaluation
according to domestic principles into the overall Google Spain balancing
exercise. The Working Party criteria are a key tool for this purpose. One
matter that Ms Proops rightly identifies as needing due weight at this stage is
the fact that de-indexation does not per se remove the source websites
containing the relevant data from the online environment. It merely makes that
data harder for the public to find.’
Findings
Whilst the legal framework of the decision-making is
inescapably convoluted, the factual findings can be summarised relatively quickly.
NT1 had been convicted of a serious dishonesty offence, and
received a relatively lengthy sentence of four years. When it was imposed he
could have had no expectation that the conviction would ever become spent. The
judge also noted from the Crown Court judge’s sentencing remarks that an even
stiffer sentence would have been imposed had it not been for one specific item
of personal mitigation. NT1 continued to refuse to accept, or fully accept,
culpability for his crime. His evidence was poor, and the judge found him to be
evasive, arrogant and dishonest. This led to the judge making a number of
adverse factual findings against him, including that he started a second
business using the proceeds of the first crime. The judge analysed his conduct
since the conviction and noted he had been prosecuted for a second matter, with
the charges left on file (ie he was neither convicted or acquitted) and been
involved in a number of other civil claims and regulatory matters, including
making a dishonest credit licence application to the OFT. Of particular concern
was the fact that NT1 had published information online (or caused it to be
published) that actively sought to portray him as a man of upstanding character
and integrity.
NT2’s position was markedly different. His crime was much
less serious and had not been committed for financial gain. NT2 had pleaded
guilty at an early opportunity and expressed considerable remorse for a one-off
mistake. He had received only a six-month sentence, which would always have
become spent in the fullness of time. NT2’s evidence came across well and the
judge accepted that it was a one-off incident and that he was rehabilitated.
Warby J was critical of both claimants for their failure to
properly particularise the damage and distress they had suffered as a result of
the data processing. He raised causation issues and noted the lack of evidence
in relation to the number of times searches had been carried out against their
names, and particular pages accessed. In both cases, there was a heavy focus on
business reputation. He was just about satisfied in NT2’s case that substantial
damage and distress had been caused by the search results, attaching particular
importance to the fact that NT2 had children of school age, and that they could
also be affected by the data processing.
Considering all the factors together, the judge agreed that
the continued processing of the URLs for NT1 was justified and in the public
interest. In relation to NT2, the judge sided with the claimant, finding that
that search results were no longer relevant and did not justify an interference
with the claimant’s data protection rights.
Misuse of private information
The outcome of the balancing exercise similarly meant that NT1’s
claim for the misuse of private information failed and NT2’s succeeded. The
starting point was that neither claimant had had a reasonable expectation of
privacy in respect of their court proceedings and convictions, however with the
passing of time NT2 had developed such an expectation whereas NT1 had not. Google’s
interference with NT2’s privacy rights could not be justified in all the
circumstances.
Orders made
Warby J made a ‘delisting order’ in respect of all the URLs NT2
had complained about. No order was in respect of any of the URLs relating to NT1.
The judge declined to make an order for damages in favour of
NT2 finding that Google had availed itself of the defence in the DPA, s 13(3): ‘In
proceedings brought against a person by virtue of this section it is a defence
to prove that he had taken such care as in all the circumstances was reasonably
required to comply with the requirement concerned.’ For the same reason, no
order was made for damages in the claim for the misuse of private information.
NT1 was granted permission to appeal. Google did not seek
permission to appeal the decision in NT2 and has indicated it will respect the
court’s decision.
Commentary
Whilst this case has attracted press headlines because an
English court has told Google what to do (almost all the mainstream press
headlines focussed on NT2’s success), it would probably be wrong to describe it
as a landmark decision. Broadly-speaking the judge simply applied existing data
protection law in line with what one would expect following the decision in Google
Spain.
From a claimant (and claimant-lawyer) point of view, the
judgment is distinctly conservative. A decision that URLs about criminal
convictions should be delisted at the point the conviction becomes spent would
have opened the floodgates to claims (backed by conditional fee agreements)
against Google (media law practitioners will know that Google regularly refuses
to delist articles that refer to spent convictions, particularly where the
convictions are for serious dishonesty or sexual offences). The judge was at
pains to set out the case law in this area and to explain why such a simplistic
approach would be wrong. The practical effect of this is of course that the
purpose of the ROA will continue to be seriously undermined as employers and
others undertake the most casual of due diligence on prospective employees,
using the world’s favourite search engine. ‘Rehabilitated offenders’ will
continue to suffer. The flip side of the coin is that the legal definition of
rehabilitated offenders includes individuals who have committed serious
offences that many members of the public feel we should continue to be warned
about regardless of whether a conviction is spent or not. This is an age-old
debate which reflects societal anxiety (misplaced or otherwise) that certain
types of offender (such as confidence tricksters and child sex offenders) will
always be prone to re-offending. Of course, there are various legitimate
disclosure regimes in place to protect the public, including the enhanced DBS
check, and the Child Sex Offender Disclosure Scheme.
The outcome of NT2’s claim was wholly unsurprising. Without
having sight of the submissions to Google it is impossible to know what
information was provided to it at what point. However, NT2’s case, as set out
in the judgment, is a reasonably compelling one for delisting. If Google had
been on notice of the core facts it seems it was entirely wrong to it refuse to
delist the URLs at the outset and he should not have had to sue Google and wait
three years for a court to confirm this (and of course many individuals will
not be in a position to sue). It follows from this that the judge’s decision to
find that Google had a defence under s 13(3) is surprising. What is said about
this is that Google is an enterprise that takes its obligations under Google
Spain very seriously. The fact that Google has a system of sorts to process
delisting requests, and complies with some of them is surely not a blanket
defence for failing to do the job in any particular case? Yes, Google has
received a lot of delisting requests (670,000 since 2014), and it must process
these as well as the millions of take-down requests it receives globally as a
result of copyright complaints, and other causes of action. However, Google has
for many years had a turnover greater than the GDP of a majority of the world’s
nation states. It has money enough to pay people to review these requests
properly. A more proper basis for not awarding damages – taking into account
the judge’s criticism of the way it was pleaded – might have been that the
damage/distress suffered was de minimis, although that would surely call into
question the validity of the entire claim. The apparent transposing of the s
13(3) defence to the tort of misuse of private information without further
explanation is confusing at best.
Of more general note is that Google has been found liable
for the misuse of private information (seemingly for the first time). There is
no discussion of the actus reus required for this. For instance, there is no
suggestion that publication is required and thus the principle in Metropolitan
International Schools Ltd v (1) Designtechnica Corporation (2) Google UK Ltd
& (3) Google Inc [2009] EWHC 1765 (QB) that Google is a ‘mere facilitator’
for the purpose of defamation law is seemingly irrelevant. Presumably, the act
of making search results available – when on notice (again there is no
discussion about this) – can prima facie be a ‘misuse’ of private information. This
finding is significant, not least because it means that privacy claims against
Google are exempt from statutory changes introduced in 2014 that prevent the
recoverability of conditional fee agreement success fees and after the event
insurance premiums (the misuse of private information is an exempted cause of
action, breach of the DPA is not). This is great news from an access to justice
perspective as it may allow individuals to bring claims who would not be in a
position to fund claims privately.
Practical issues for those wanting to make delisting
requests following this judgment
Individuals who are thinking of submitting a delisting
complaint to Google should note the following from this case:
- The fact that a conviction is spent is weighty, but not
determinative. If you say it is, then Google can rely on this case to say it is
not. Incidentally, media lawyers will know that the judgment reflects the ICO’s
own position on this issue. - Attempting to go behind a criminal conviction (or the
finding of any recognised tribunal) will normally be fatal. The case for
delisting will be stronger if you can show that you are genuinely remorseful
for your conduct and have felt this way for some time. - Your conduct following the ‘incident’ (whether it is a
criminal conviction or otherwise) is extremely relevant. This can include any
kind of conduct. The case for delisting will be stronger when you can show you
have turned over a new leaf. This means more than simply being able to say you
were not caught again. If you have turned your life around, explain how you
have done this. - What you are doing in your life now will be relevant. If you
are an accountant who was struck off for breaching your regulator’s code of
conduct, the case for delisting will be stronger if you have left the
profession and become a yoga teacher. - There is a higher threshold if you are public figure. The court
has adopted the very broad definition of ‘public figure’ put forward by the Article
29 Working Party: it may be said to include anyone with a degree of media
exposure, members of the regulated professions, and business figures. There are
millions of ‘regulated professionals’ in the UK (over 250,000 registered
doctors alone), whilst ‘business figures’ could include even wider numbers of
people. - The prospects of delisting of URLs relating to convictions
are lower where the offence involved dishonesty and/or personal financial gain. - The prospect of delisting an unspent conviction following
this decision are likely to be remote. - If you have put false information into the public domain or
attempted to give a false impression as to your history, this may count against
you. Using ‘search engine specialists’ to attempt to suppress articles in the
mainstream media will often be ineffective. Many individuals find their search
results littered with poor quality and repetitive links which, in and of
themselves, may cause third parties confusion and suspicion. The suppression of
URLs from major websites will often require work to be done on an ongoing basis
(thereby leading to great expense) where it is even successful at all (such
techniques have a higher chance of success when the offending URLs appear on
obscure websites). - An interesting consequence of the judge’s somewhat creative
use of the DPA sch 3, condition 5 is that, where criminal proceedings resulted
in acquittal or discontinuance it may be arguable that none of the conditions
in sch 3 are met (and thus the First Data Protection Principle has been
breached/the data processing is automatically unlawful). This is because if the
data subject has not committed a criminal offence it is harder, if not
impossible, to argue that they have deliberately taken steps to put information
in the public domain (as found by Warby J in respect of NT1 and NT2). The
caveat to this is that an acquittal or discontinuance is not a finding of
innocence, and therefore, in certain cases, it may be open to Google to argue
that an offence was committed (as it was effectively able to do with NT1 in
relation to the second set of criminal proceedings). It may also argue that the
data subject took other steps to put information in the public domain. - Any complaint of inaccuracy should be properly
particularised with reference to evidence. A bald assertion is insufficient. Minor
inaccuracies in respect of specific items of information may be disregarded if
the balance of the information is accurate when viewed in context. - Absolute candour is required. Bad points should be
addressed. It may be appropriate to provide evidence of rehabilitation. - It is necessary to properly set out the damage and distress
you have suffered. Where possible you should give specific examples of the
search results affecting your personal life. For instance, partners or
colleagues bringing them to your attention, the loss of a job opportunity, or
children raising them. - The case for delisting will normally be stronger where there
is evidence that damage/distress may also be caused to minors (eg school
children being bullied about URLs referring to their parents). - There is no basis for complaining about data that refers to
businesses/companies. Data protection law only concerns living individuals. - You should not place general reliance on NT1/NT2 v Google unless
you are referring to a specific part of the case that is directly applicable.
In many instances, the case will be just as helpful to Google as it is to
claimants. - Never sue Google LLC without taking specialist legal advice
and understanding the potentially huge adverse cost consequences of losing or
abandoning your claim. A request to the ICO for a review of a decision by
Google is an inexpensive and risk-free alternative (although that should also
be submitted via lawyers, where means permit). - Never sue Google UK Limited or any other parent or
subsidiary. They do not operate the search engine, or process your data and are
therefore the wrong defendant. - A delisting request should normally be detailed and address
the relevant legal criteria. The law in this area is complex and technical. If
you are in a position to instruct specialist solicitors to make a request to
Google on your behalf then this is normally recommended so that the focus of
the submissions is on the correct issues and to give you the best prospects of
the request being successful.
Finally, as the judge eloquently explained, we are in the
twilight of the Data Protection Act 1998 and the dawn of the General Data
Protection Regulations (‘GDPR’) is nearly upon us. The GDPR will come into
force on 25 May 2018. From this date, delisting requests will be founded on the
GDPR. Whilst NT1/NT2 will no doubt be persuasive, the underlying law is
changing. The right to be forgotten will be codified in statute as the ‘right
to erasure’. In short, individuals’ data protection rights will be strengthened
(for instance there will be no need to show that any harm has been suffered). Whilst
changes are unlikely to be seismic insofar as delisting requests to Google are
concerned, those thinking of making (or renewing) such a request may now
benefit from waiting until the new law is in force.
Iain Wilson is a Partner at Brett Wilson LLP.
This post originally appeared on the Brett
Wilson Media Law Blog and is reproduced with permission and thanks.
