In the first two “right to be forgotten” claims brought in the UK, the English court has confirmed that in certain circumstances an internet search engine (ISE) operator can be required to delist links in its search results, in this case, relating to “spent” criminal convictions. Although ISE operators can take some comfort from the fact Google was not ordered to pay compensation, the judgment shows the detailed balancing exercise that must be undertaken: NT1 & NT2 v Google LLC (The Information Commissioner intervening) [2018] EWHC 799 (QB), 13 April 2018
Each case involved a businessman, referred to respectively as NT1 and NT2, who had been convicted for unrelated conspiracy crimes. Both convictions are now deemed to be “spent” under the Rehabilitation of Offenders Act 1974, which allows prior convictions to be effectively ignored after a period of time. However, content about the criminal actions of NT1 and NT2 remained online, and links to that content could be found on Google when the individuals’ names were searched. NT1 and NT2 requested that Google delist the links; these requests, save one, were rejected.
The respective claimants commenced proceedings against Google claiming a “right to be forgotten” and seeking the removal and/or erasure of this content, an injunction, compensation due to the misuse of private information and damages.
Right to be forgotten
In 2014, the European Court of Justice (ECJ) considered a claim brought by a Spanish national who wanted to remove two links on Google that referred to his previous indebtedness1. The ECJ found that a “right to be forgotten” existed and held that data subjects could compel ISE operators to remove search results about them that are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing”.
Any claim to the “right to be forgotten” requires a Member State court to conduct a balancing act: the legitimate interests of internet users having access to the information weighed up against an individual’s rights to privacy. This assessment depends on a number of factors including the nature of the information and its sensitivity.
Google could not rely on the journalism exemption
Although Warby J agreed with Google’s submissions that the concept of journalism under EU law is broad, he drew a distinction between journalism and communication. He concluded that Google’s activities as an ISE operator could not be equated with journalism and therefore Google could not benefit from the exemption at s32 Data Protection Act 1998 (DPA).
NT2 succeeds
Applying the balancing act required by the ECJ, Warby J found that NT2’s case for the “right to be forgotten” was made out, and that Google could be compelled to delist the links complained of (one of which was found to be inaccurate). The reasoning was based on an assessment of the relevant facts, in particular: NT2 acknowledged his guilt (having pleaded guilty at a relatively early stage of the criminal proceedings) and showed genuine remorse for his previous actions. He was also no longer involved in the same line of work and the court found no basis to think he would reoffend and therefore pose a risk to the public. Warby J concluded that “the crime and punishment information has become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability, so that an appropriate delisting order should be made”. Warby J also commented that the existence of a young family (favouring a reasonable expectation of privacy) was a decisive factor in favour of delisting.
NT1 fails – information still relevant
In contrast, NT1’s claims were dismissed as it was found that the information complained of “retains sufficient relevance today”. Warby J determined that at the time of his conviction, NT1 and his role in the controversial property business was reasonably well known. He did not accept his guilt and had shown the court no evidence of remorse for these actions. Further, he remained in business, and the information about his conviction was therefore relevant to the assessment of his honesty by members of the public.
No compensation or damages payable by Google
Although NT2’s claim for delisting succeeded, Warby J found that Google was an organisation that was committed to compliance with the relevant requirements and cannot be said to have failed to take “such care as in all the circumstances … reasonably required”. As such, NT2’s claim to compensation under s13(3) of the DPA failed.
Comment
There is no doubt that the factual matrix of each case played a decisive role in Warby J’s decision-making. It is apparent from the reasoning that the element of dishonesty (in the case of NT1) in the historic crime and the perceived risk of reoffending, as well as the conduct of the claimants since their convictions played a vital role in the outcome. It is clear therefore that any similar future cases will have to undergo the same detailed analysis of the factors surrounding the previous offences. It should also be noted that the “right to be forgotten” is not a right to change the past. The content complained of in these cases will not be removed from the underlying online sources; the links will simply not be revealed following a search on Google for NT2.
Bearing in mind the strengthened rights that individuals will enjoy under the GDPR (which comes into force on 25 May 2018) relating to the processing of their personal data (in particular, Article 17 provides expressly for a “right to be forgotten”), it is advisable that organisations examine whether they have adequate processes in place dealing with data subjects rights.
Footnote:
1 Google Spain SL v Agencia.
