23 avril 2018

High Court 'right to be forgotten' ruling

The High Court has considered the applications of two individuals to have links to details of previous criminal convictions removed from google search results. One application was upheld, the other was dismissed.

What's the issue?

The confirmation of a right to be forgotten online where information is inaccurate or out of date, provided it is not in the public interest to retain the information, was established by the CJEU ruling in the Google Spain case. The Google Spain case also requires the Court to strike a fair balance between fundamental rights and interests, including the right to privacy, freedom of expression and freedom of information.

What's the development?

The High Court has handed down judgment in a case involving applications by two individuals to have search results delisted which link to information about their criminal convictions. One application was upheld, the other was dismissed.

What does this mean for you?

This is the first significant judgment in the UK to deal with the impact of the 2014 Google Spain case and, as such, provides some guidance as to the approach the courts will take when conducting analysis of competing rights where data erasure is requested. It is worth remembering that after 25 May 2018, applications of this nature will most likely seek to rely primarily on the Article 17 GDPR right to erasure. Elements of the Google Spain case and its application are, however, likely to remain relevant, for example its discussion of data subject rights under Articles 7 and 8 of the EU Charter on Fundamental Rights.

NT1 was convicted of a criminal conspiracy to account falsely in relation to the activities of a property business which dealt with members of the public. NT1 was sentenced to four years' imprisonment. His claim related to three links appearing in google search results giving information about the conviction.

NT2 was sentenced to six months following a conviction for conspiring to intercept communications. His claim related to 11 source publications.

Legal framework

The claims were made under UK data protection law and the tort of misuse of private information. The High Court recognised ten key relevant elements of law including the Google Spain decision, the Rehabilitation of Offenders Act, the Data Protection Act (in particular the right to blocking and erasure) and Article 17 of the GDPR (not yet in force).

The Court said that the balancing exercise required by Google Spain is "not a stand-alone exercise, separate from the question of compliance with the DPA. Nor is it to be carried out in accordance with the GDPR which is not yet in force…It is an integral part of deciding whether Google's activities have been and are being carried out in accordance with its duties under the DPA….The processing in this case complies with DPA Schedule 3 condition 5. The question of whether the processing complies with the other requirements of the DPA collapses into the application of the Google Spain balancing test and is not separate or distinguishable from it". The Court relied on the Article 29 Working Party guidance on implementation of the Google Spain decision when carrying out the balancing test.

The Court placed particular emphasis on the fact that the data in both cases related to a criminal offence and on the extent to which such information remained relevant today.

The issues to resolved

These were summarised as being:

Whether the claimant is entitled to have the links in question excluded from search results either:

because one or more of them contain personal data relating to him which is inaccurate;
because for that and/or other reasons, the continued listing of those links by Google involves an unjustified interference with the claimant's data protection and/or privacy rights; and

If so, whether the claimant is also entitled to compensation for continued listing between the time of the original request for delisting and judgment.

Broken down further, the data protection claims were defined as consisting of two heads:

The inaccuracy issues – is any information which is linked to by Google inaccurate?
The privacy issues:

Is Google entitled to rely on the journalistic exemption?
At what point in the legal analysis should the Court assess the compatibility of Google's processing of the offending links with the principles in Google Spain?
Does Google's processing comply with the DPA s4(4)?
Does Google's processing comply with the requirements of Google Spain?

The misuse of private information issues where summarised as:

Does the claimant enjoy a reasonable expectation of privacy in respect of any of the information at issue?
If so, how on the particular facts of the case, should the balance between the rights of privacy and freedom of expression be struck?

The Court also looked at liability and at whether, as Google claimed, the claims were an abuse of process, as well as at defamation issues.

The judgment

The length of the judgment (66 pages), demonstrates the complexity of the questions raised.

The first claim by NT1 was dismissed. The judge held that:

The claim was not, as Google argued, a defamation claim in disguise and an abuse of Court process.
NT1 failed to demonstrate the inaccuracy claimed.
Google was not entitled to rely on the journalism exemption in relation to the processing of personal data as it had not processed the data for solely journalistic purposes.
NT1 did not enjoy any reasonable expectation of privacy in respect of the information at the time of the conviction.
The data processing complied with DPA Schedule 3 condition 5. The question of whether the processing complied with other DPA elements collapsed into the application of the Google Spain test.
NT1 failed to make out his claim for delisting pursuant to Google Spain. There is a lengthy analysis of this claim against the WP29 guidelines and other issues raised in the pleadings. The main factors in holding that the balance of interests did not fall in NT1's favour were:

NT1 continues to have a limited role in public life as a businessman.
The information about the crime relates to his business activities and has never attracted an expectation of privacy.
The original reporting appeared in the context of the crime committed by NT1.
The sentence was of such a length that at the time it was handed down, NT1 could not have expected the conviction would ever be spent (the law changed subsequently).
NT1's business career since leaving prison makes the information relevant to the past assessment of his honesty by members of the public and remains relevant today. This is particularly true as NT1 has not acknowledged his guilt, has misled the public and the Court, and has shown no remorse. Keeping the information in the public domain by maintaining links in search results minimises the risk that he will continue to mislead.

The second claim by NT2 was upheld. While the Court ruled along the same lines when dismissing Google's argument that the claim was an abuse of process and that it could rely on the journalistic exemption, it held that:

The inaccuracy complaint about one of the national newspaper items was made out. The article was misleading as to the nature and extent of the claimant's criminality and falsely suggested that he made criminal proceeds with it, dealt dishonestly, and sought to shield the proceeds from creditors.
The Google Spain delisting claim was upheld because:

The crime and punishment information had become out of date, irrelevant and was of no sufficient legitimate interest.
NT2 acknowledged guilt and expressed remorse.
The sentence was always going to be spent.
The past offence had little if any relevance to NT2's current or future business activity.

As there was no misuse of private information, no compensation was awarded, Google having successfully established that it took reasonable care. A delisting order will be made.