On 13 April 2018, the High Court, in NT1 & NT2 v Google LLC  EWHC 799 (QB), ruled against Google, in favour of two businessmen advocating for the right to be forgotten. You can find the full judgment here, but in this blog we explore the reasoning behind the Court’s decision.
Right to be forgotten/right to erasure
The Court of Justice of the EU confirmed the right to be forgotten as an existing right under data protection laws, in Google Spain SL v Agencia Espanola de Protección de Datos Case of 2014: 317. The right to be forgotten is made explicit in the EU General Data Protection Regulation 2016/679 (GDPR) text. Essentially, in the GDPR the right is an enhanced right of erasure. The right is not absolute, which means that a controller does not need to comply with the request if there is a legitimate reason for continuing to process the personal data.
Two separate businessmen brought cases, which were consolidated. Each case centred on the reporting of business-related criminal convictions that were spent and over a decade old:
- NT1 was convicted of conspiracy to commit false accounting and tax evasion; and
- NT2 pleaded guilty to conspiracy to tap phones and hack computers of environmental activists who had made threats against him and his business.
Both claimants requested Google remove links from searches to their names. The claims focused on breach Article 8 of the European Convention on Human Rights (that is, right to respect for one’s private and family life), breaches under the Data Protection Act 1998 (DPA), and the common law tort of misuse of private information. Google relied on various arguments, including abuse of court process and the journalism exemption under the DPA.
The first claimant, NT1, who was convicted in relation to more serious offences than NT2 pleaded guilty to, failed in his claim. Justice Warby, however, found that the personal information with regard to the second claimant’s (NT2) crime and punishment “has become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability”.
The Court issued a delisting order for Google to remove the relevant data and search links related to NT2. As Google had shown a commitment to complying with data protection requirements and had taken reasonable care, no damages or compensation were awarded to NT2.
The case provides some useful insight on how the courts interpret the right to be forgotten, particularly for those search providers and other controllers that, in the future, are required to deal with delisting requests. Controllers will need to ensure their processes for reviewing delisting requests comply with EU data protection requirements.
- The Court emphasised that the concept of journalism was broad in nature and went beyond the activities of media undertakings, thus incorporating other activities that have as their aim the disclosure to the public of information, opinions and ideas. However, the Court concluded that “the concept [of journalism] is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions.”
- While the GDPR will play a prominent role in circumstances arising after 25 May 2018, it should not be used as a reference when interpreting Google Spain or other legal principles applying to events that take, or have taken place, prior to its effective date.
- The refusal to award compensation is a reminder that courts will look upon search providers favourably where they have taken reasonable care and demonstrated compliance with data protection laws.
The right to be forgotten continues to be a hot topic in data protection circles, and particularly for content providers. In a recent development, NT1 was given permission to appeal, so the Court of Appeal will be considering these issues in the near future, so watch this space.