High Court Judgment on 'Right to be Forgotten'

The High Court has given judgment in two claims that concern the ‘right to be forgotten’ or the right to be delisted.

In NT1 and NT2 v Google and the Information Commissioner [2018] EWHC 799 (QB), Warby J had to consider claims concerning the right to be forgotten or what he said was more accurately described as the right to have personal information ‘delisted’ or ‘de-indexed’ by the operators of internet search engines.

The full judgment can be downloaded from the link below, following the summary. The report on bailli.org can be found here. In the meantime, the Judiciary of England and Wales have published a summary of the judgment which is set out below (references therein (eg [3]-[4]) are to paragraphs of the judgment). We will aim to bring you further analysis in the course of the next week.

A number of reports of the case have headlined with 'Google loses . . . '. That is a vast oversimplification. Indeed, Google won on one claim and lost on the other in a strict sense but even in the case it lost the judge considered that it had taken reasonable care and no damages were awarded. Google is probably quietly satisfied.

Official Summary of the Judgment

1. The Court gives judgment after the trial of two claims based on the “right to be forgotten” or, more accurately, the right to have personal information “delisted” or “deindexed” by the operators of internet search engines (“ISEs”). The claims are made under data protection law and the English law tort of misuse of private information. References in square brackets are to paragraphs in the judgment.

2. The claimants are two businessmen who were convicted of criminal offences many years ago. They complain of search results returned by Google’s ISE, “Search”, that feature links to third-party reports about the claimants’ convictions which they say are inaccurate and/or old, irrelevant and of no public interest, or otherwise an illegitimate interference with their rights [1]-[2].

3. The claimants are anonymised in this public judgment, to avoid the claims being self-defeating, or leading to additional publicity for the information in question. In each case there is a private judgment containing details that could not be made public in case they identify the claimants [3]-[4].

4. The judgment sets out “nutshell” summaries of the facts of each claim and identifies the main issues as (1) whether the claimant is entitled to have the links in question excluded from Google Search results either (a) because one or more of them contain personal data relating to him which are inaccurate, or (b) because for that and/or other reasons the continued listing of those links by Google involves an unjustified interference with the claimant’s data protection and/or privacy rights; and (2) if so, whether the claimant is also entitled to compensation for continued listing between the time of the delisting request and judgment. [6]-[9].

5. The judgment identifies and discusses in detail the legal framework, which is “complex and has developed over time”, with many legislative provisions dating back to before the internet and well before the creation of ISEs. [10]-[50]. Among ten key elements of the legal framework [13] are:-

· the European Communities Act 1972, which made EU Directives directly applicable in the UK, and required English Courts to apply decisions of the Court of Justice of the EU (“CJEU”); 

· the Rehabilitation of Offenders Act 1974, which provides that some convictions become “spent” after a specified period, after which the offender is to be treated “for all purposes in law” as if he had not been convicted, but cannot sue for defamation in respect of a report of his conviction or sentence unless he proves malice (the convictions in these cases are “spent”);

· The Data Protection Act 1998 (“DPA”), which implemented EU Directive 95/46 (“DP Directive”), the purpose of which was to safeguard individuals’ fundamental rights and freedoms, notably the right to privacy, within the EU;

· The tort of misuse of private information, recognised by the House of Lords in the 2004 decisions in Campbell v MGN Ltd and In re S (A Child);

· The May 2014 decision of the CJEU in Google Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) and another Case C-131/12 [2014] QB 1022 (“Google Spain”), in which the CJEU interpreted the privacy rights enshrined in the DP Directive and the EU Charter of Fundamental Rights as creating a qualified “right to be forgotten”; and

· Article 17 of the General Data Protection Regulation (“GDPR”), which came into force on 25 May 2016 and will have direct effect in Member States, including the UK, from 25 May 2018.

6. The CJEU’s decision in Google Spain requires the Court to strike a fair balance between fundamental rights and interests, of which freedom of expression and freedom of information are two. The outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. [37].

7. The Court observes [38] that:

 … it may be misleading to label the right asserted by these claimants as the “right to be forgotten”. They are not asking to “be forgotten”. The first aspect of their claims asserts a right not to be remembered inaccurately. Otherwise, they are asking for accurate information about them to be “forgotten” in the narrow sense of being removed from the search results returned by an ISE in response to a search on the claimant’s name. No doubt a successful claim against Google would be applied to and by other ISEs. But it does not follow that the information at issue would have to be removed from the public record ... And a successful delisting request or order in respect of a specified URL will not prevent Google returning search results containing that URL; it only means that the URL must not be returned in response to a search on the claimant’s name.

The NT1 case

8. The claim relates to three links returned by Google, providing information about NT1’s conviction after a trial for conspiracy to account falsely, and the sentence imposed, which was one of 4 years’ imprisonment.

9. The issues are re-stated in more detail [51]-[57], and decided as follows:-

(1) The claim is not a defamation claim in disguise, and hence an abuse of the Court’s process, as alleged by Google [58]-[65].

(2) The claimant has failed to make out any of the six complaints of inaccuracy he makes in respect of the three links of which he complains: see [66]-[78] (facts), [79] (complaints), [80]-[87] (law), [88]-[92] (evidence), [93]-[94] (assessment).

(3) Google cannot rely on the so-called “journalism exemption” in s 32 of the DPA. It has not processed these data for journalistic purposes, or alternatively not only for those purposes. Moreover, it has not adduced any evidence that it held a belief that compliance with the provision of the DPA, from which it seeks exemption, would be incompatible with such a purpose [95]-[102].

(4) The balancing process which Google Spain requires is not a stand-alone exercise, separate from the question of compliance with the DPA. Nor is it to be carried out in accordance with the GDPR, which is not yet in force. Nor is it one to be addressed as part of the Court’s decision on remedies. It is an integral part of the process of deciding whether Google’s activities have been and are being carried out in accordance with its duties under the DPA. The Court agrees with the parties that this exercise should be carried out with reference to guideline criteria established by a Working Party established under Article 29 of the DP Directive. [103]-[105].

(5) The processing in this case complies with DPA Schedule 3 condition 5 [110]- [113]. The question of whether the processing complies with the other requirements of the DPA collapses into the application of the Google Spain balancing test, and is not separate or distinguishable from it. [114]-[115].

(6) NT1 has failed to make out his claim for delisting pursuant to Google Spain: [118]- [130] (further facts), [131]-[135] (some further issues of principle), [136]-[169] (application of law to facts). Consideration of the Working Party criteria leads the Court to these key conclusions, at [170]:

Around the turn of the century, NT1 was a public figure with a limited role in public life. His role has changed such that he now plays only a limited role in public life, as a businessman not dealing with consumers. That said, he still plays such a role. The crime and punishment information is not information of a private nature. It was information about business crime, its prosecution, and its punishment. It was and is essentially public in its character. NT1 did not enjoy any reasonable expectation of privacy in respect of the information at the time of his prosecution, conviction and sentence. My conclusion is that he is not entitled to have it delisted now. It has not been shown to be inaccurate in any material way. It relates to his business life, not his personal life. It is sensitive information, and he has identified some legitimate grounds for delisting it. But he has failed to produce any compelling evidence in support of those grounds. Much of the harm complained of is business-related, and some of it pre-dates the time when he can legitimately complain of Google’s processing of the information. His Article 8 private life rights are now engaged, but do not attract any great weight. The information originally appeared in the context of crime and court reporting in the national media, which was a natural and foreseeable result of the claimant’s own criminal behaviour. The information is historic, and the domestic law of rehabilitation is engaged. But that is only so at the margins. The sentence on this claimant was of such a length that at the time he had no reasonable expectation that his conviction would ever be spent. The law has changed, but if the sentence had been any longer, the conviction would still not be spent. It would have been longer but for personal mitigation that has no bearing on culpability. His business career since leaving prison made the information relevant in the past to the assessment of his honesty by members of the public. The information retains sufficient relevance today. He has not accepted his guilt, has misled the public and this Court, and shows no remorse over any of these matters. He remains in business, and the information serves the purpose of minimising the risk that he will continue to mislead, as he has in the past. Delisting would not erase the information from the record altogether, but it would make it much harder to find. The case for delisting is not made out.

10. The claim for misuse of private information also fails [171]-[172], and there can be no question of compensation or damages. [173].

The NT2 case

11. NT2 complains of links to 11 source publications. He makes one inaccuracy complaint, which relates to an item in a national newspaper of relatively recent date. The Court assesses this claimant as an honest and generally reliable witness, whose evidence is accepted on most of the points of dispute. [176]. The Court:

(1) dismisses Google’s argument that the claim is an abuse of process [177];

(2) outlines the facts relevant to the data protection claims [178]-[184], noting that the convictions in this case were for conspiracy to carry out surveillance, and the sentence one of 6 months’ imprisonment;

(3) upholds the inaccuracy complaint, finding that the national newspaper item is misleading as to the nature and extent of the claimant’s criminality, and falsely suggests that he made criminal proceeds from it with which, with the aid of a financial firm, he dealt dishonestly and sought to shield from creditors [186]- [190];

(4) adopts in this case the conclusions reached in NT1 about the journalism exemption and the way in which to apply Google Spain [193]; and

(5) applying the legal principles identified when dealing with the case of NT1, upholds NT2’s Google Spain delisting claim: see [194] (law), [195]-[200] (further facts), [201]-[207] (assessment of relevance), [208]-[222](consideration of the Working Party criteria). In this case, the conviction was not one involving dishonesty, and it was based on a plea of guilty. The Court reaches these key conclusions, at [223]:

The crime and punishment information has become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability, so that an appropriate delisting order should be made. The conviction was always going to become spent, and it did so in March 2014, though it would have done so in July of that year anyway. NT2 has frankly acknowledged his guilt, and expressed genuine remorse. There is no evidence of any risk of repetition. His current business activities are in a field quite different from that in which he was operating at the time. His past offending is of little if any relevance to anybody’s assessment of his suitability to engage in relevant business activity now, or in the future. There is no real need for anybody to be warned about that activity.

(6) The same result follows in the tort of misuse of private information. No compensation is awarded because Google has established the defence under s 13(3) of the DPA, that it took reasonable care. Nor are damages for misuse awarded. But a delisting order will be made.


Published: 2018-04-13T15:00:00

0 comments

    This site uses cookies. By using the site you agree to our use of cookies as set out in our Privacy Policy.

    Please wait...