On 13 April 2018, the English High Court handed down judgment in the landmark case of NT1 & NT2 v Google LLC,[1] the first “right to be forgotten” case tried in the English Courts. The case specifically concerned the right to have personal information “de-listed” or “de-indexed” by the operators of internet search engines (ISEs). In this case, the Court held that Google had to remove links to articles about the spent criminal conviction and sentence of the anonymous claimant NT2 from search results returned by Google Search, an ISE, for the individual’s name.

Background 

The claims were prompted by the May 2014 decision of Court of Justice of the European Union (CJEU) in the Google Spain case,[2] in which the CJEU interpreted the Data Protection Directive (the DP Directive)[3] and the Charter [4] as creating a qualified “right to be forgotten.”

NT1 and NT2 were two businessmen involved in separate business practices in the late 1980s/early 1990s and early 2000s respectively, in respect of which both were convicted of criminal offences. There was contemporaneous media reporting of these matters, links to which were made available by Google. After NT1 and NT2’s sentences became spent, [5] both asked Google to remove such links from internet searches using Google.

NT1’s request to Google was only partially successful, and NT2’s request was entirely unsuccessful. Subsequently both claimants commenced High Court proceedings in 2015, seeking orders for the blocking and/or erasure of links to the two media reports, an injunction to prevent Google from continuing to return such links, and financial compensation. Google resisted both claims, maintaining that the inclusion of such details in its search results was and remains legitimate. Due to the similarity of the issues, NT1 and NT2’s claims were tried together. 

The Issues

The main issues in both cases were:

1. Whether these de-listing claims were an abuse of process – i.e. whether they were an illegitimate attempt to bring a defamation claim against Google;

2. Whether the claimants were entitled to have the links in question excluded from Google Search results in accordance with their rights to block the processing of personal data under Sections 10 and 14 of the UK Data Protection Act 1998 (DPA) [6] either: 

  •  Because they contained inaccurate personal data; or
  •  Because the continued listing of such links involved an unjustified interference with the claimants’ data protection and/or privacy rights; and

3. If so, whether the claimants were also entitled to compensation for the continued listing by Google under Section 13 of the DPA. 

The Abuse Issue 

Google argued that the claim brought by NT1 was in fact a defamation claim, and that this claim was therefore an abuse of the Court’s process, by trying to seek through a different means something that NT1 and NT2 would not be entitled to under the law of defamation. [7]

The Judge in the case, Mr Justice Warby, accepted that the protection of reputation was a significant and substantial element of NT1’s de-listing claim. However, he did not consider the claim to be an attempt to exploit data protection law or the tort of misuse of private information to obtain a remedy that NT1 would not be able to seek under the law of defamation, but rather a reliance on the new law pronounced by the CJEU. 

Inaccuracy of Data Issue 

NT1 claimed that some of the information contained in the articles that were listed by Google were inaccurate and that there had therefore been a breach of the Fourth Data Protection Principle requiring that personal data “shall be accurate.” 

Warby J considered the DP Directive Working Party’s comments that “de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual.” However, on the evidence before him, Warby J was unable to conclude that the articles complained of were in fact inaccurate, and NT1 failed on this aspect of his claim.

The Privacy Issues

1. The Exemption Issue

Google relied on the so-called “Journalism Exemption” contained in Section 32 of the DPA, which provides that in certain circumstances personal data can be processed without adherence to the Data Protection Principles and other provisions of the DPA. This exemption applies to personal data being processed for special purposes (i.e. literature, journalism and art) where the data controller reasonably believes that publication would be in the public interest (objective element) and that compliance with DPA would be incompatible with such special purposes (subjective element). 

Warby J rejected Google’s arguments in this regard, stating that the concept of journalism in EU law is “not so elastic … to embrace every activity that has to do with conveying information or opinions” and that “when Google responds to a search on an individual’s name by facilitating access to journalistic content … this is purely accidental.” He concluded that the processing was undertaken by Google for its own commercial purposes in providing internet search results and not any special purposes as required by Section 32 of the DPA. He held that on the facts, Google had failed to show that it met both the objective and subjective elements of Section 32 of the DPA.

2. The Structure Issue 

Article 17 (Right to erasure) of the General Data Protection Regulation (the GDPR), [8] provides that personal data need not be erased where the processing is necessary to protect the right to freedom of expression. Google argued that Article 17 should be used as an aid to interpretation of Google Spain and that it effectively “sets out” the law as declared in this case. Warby J stated that there was no principled basis on which to consider the GDPR in this context, given that most of the relevant events under consideration had taken place before the enactment of the GDPR, and all before it has taken effect.

3. The DPA Compliance Issue

Google argued that its processing of data concerning criminal convictions (which is sensitive personal data under the DPA) was compliant with Schedule 3 of DPA, which sets out the conditions on which processing of sensitive personal data can be based. 

Warby J held most of Google’s arguments to be unfounded but decided that Google was processing sensitive personal data in compliance with Condition 5 of Schedule 3 (the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject). In reaching that conclusion, Warby J followed reasoning given by Stephens J in the recent case of Townsend v Google Inc. [9] and clarified that Condition 5 “does not require a deliberate decision or ‘step’ by the data subject ‘to make’ the information public, but rather (a) the taking by him of a deliberate step or steps, as a result of which (b) the information is ‘made public.’” 

The Judge then went on to determine whether Google could also show the necessary compliance with one of the conditions for processing of personal data set out in Schedule 2 of the DPA. Condition 6(1) of Schedule 2 was held to be plainly relevant: “The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.” It was evident that Google had a legitimate interest in the processing of third-party data in pursuit of its business as an ISE, so the vital question is whether the processing was “unwarranted” for any of the reasons specified in Condition 6(1). Warby J therefore conducted a balancing test [10] as mandated by Google Spain.

4. The Google Spain Issue

Warby J followed an approach established in the In re S case dictating that neither privacy nor freedom of expression takes precedence over the other, dismissing NT1’s argument that the “general rule” as established by the Google Spain case is that factors in favour of de-listing will outweigh those in favour of continued availability. Considering the 13 criteria that the DP Directive Working Party has set out to assist with the judging of where the balance lies, Warby J concluded that the most relevant for these purposes was the last – “do the data relate to a criminal offence?” Here the decision was finely balanced. NT1’s conviction would not, under the ROA as originally enacted, ever have become spent. It was only changes to the ROA following NT1’s conviction that allowed it to be eligible to be spent. Had his sentence been for one day longer than it was, even after the changes to the ROA, it would have been ineligible. He continued to refuse to accept his guilt, and his continued business interests mean that the information remains relevant to the public.

The case for de-listing was not therefore made out, and Google was permitted to continue to list the complained of articles in response to searches for the individual’s name.

The Misuse Issue

This second head of NT1’s claim arose out of the English tort of misuse of private information. In essence, if a claimant has a reasonable expectation of privacy in respect of the relevant information, and the claimant’s rights to respect for private and family life under Article 8 ECHR outweigh the right to freedom of expression under Article 10 of the ECHR, the claimant shall have the right to seek a prohibition on the publication of the relevant information and/or damages. 

As set out above, Article 8 of the ECHR was engaged once the conviction was spent, and therefore the Judge undertook the balancing exercise and again concluded that “the interference with Article 8 that continued processing by Google represents is justified by, and proportionate to, the factors that favour the Article 10 right to receive information in this case” and also therefore dismissed this head of NT1’s claim.

The Damages Issue

Since Warby J found that Google’s continued processing has been and is justified according to the Google Spain test, there was no basis for any award of compensation to NT1 under Section 13 of the DPA.

NT2's Claim

Warby J subsequently applied the above stated principles and reasoning to NT2’s case and upheld his claims. This divergence of outcomes was explained by the evidence put forward by NT2:

  1. One of the articles linked to by Google was found to be inaccurate; 
  2. The offence for which NT2 was convicted did not involve dishonesty, and he had pleaded guilty to that offence. In evidence before Warby J, NT2 accepted his guilt and showed genuine remorse;
  3. The Judge assessed the relevance of the data about NT2’s convictions to investors, staff or customers of NT2’s businesses to be “slender to non-existent”;
  4. NT2’s conviction would always have become spent under the ROA as originally enacted;
  5. NT2 has a young family (meaning there was a stronger interference with family life);
  6. NT2 gave more credible evidence about the interference in his business reputation; and
  7.  There was no plausible suggestion of a risk of repeat wrongdoing. 

Taking all of the above into account, de-listing was appropriate. Based on the same factors, Warby J held that there had been a misuse of private information by Google in listing the relevant articles in response to searches for NT2’s name.

Despite this, no compensation or damages were awarded; Google’s conduct was reasonable, and it took such care as was reasonably required in all the circumstances to comply with the relevant legal requirements for processing. It therefore had a defence to a claim for damages under Section 13(3) of the DPA.

Conclusion 

Since the CJEU’s decision in Google Spain, Google has received requests to de-list almost 1.9 million links or URLs, and there are likely to be more following the success of NT2. The data protection authorities in the EU Member States may also see an increase in similar requests. 

The significance of this long-awaited English High Court decision lies in the fact that it not only provides more clarity to individual data subjects, but also to ISEs, data controllers or content providers by indicating the approach courts will be likely to take in future to de-listing requests and the right to be forgotten more generally. Mr Justice Warby himself recognised the wide-ranging implications that this case will have and has therefore allowed NT1 permission to appeal his decision to the Court of Appeal. The NT1 case will therefore continue and may ultimately reach the UK Supreme Court.