On 18 August 2015, the Information Commissioner’s Office (“ICO”) issued an enforcement notice under section 40 of the Data Protection Act 1998 requiring Google Inc to remove nine links to web pages that include details of a minor criminal offence committed by the anonymised complainant nearly 10 years ago.
The complainant had asked Google Inc to remove the links under the principles established in the Google Spain case.
A newspaper subsequently published an article about Google’s removal of the link. The article included details of the original story about the complainant’s conviction. Similar articles were published by other online media organisations.
The complainant then asked Google to remove the links to these articles but it refused to do so on the ground that the links were still relevant and in the public interest.
Applying its criteria for deciding whether a search result should be delisted, the Commissioner decided that that Google should remove the links. Google refused to do so on the following grounds:
- The article formed an essential part of recent news story about a matter of public importance, namely its decision to delist a search result.
- The information relating to the complainant formed an essential part of the news story.
- It took into account the news media’s journalistic judgments in determining whether information was relevant and in the public interest.
The Commissioner was of the view that Google had contravened the first and third data protection principles. It took into account the following factors:
- The information was not about an individual in public life and making it available would not protect the public from improper or unprofessional conduct.
- The personal data was sensitive within the meaning of section 2(2) of the DPA.
- The information was not reasonably current – it related to a conviction almost 10 years old
- The processing had a disproportionate negative impact on the complainant’s privacy.
- The public interest in discussing decisions to delist search results could be adequately and properly met without a search made on the basis of the complainant’s name linking to articles containing this data.
- The data concerned a conviction for a relatively minor offence which was spent.
As a result, Google had contravened the Third Data Protection Principle. In addition, the processing was unfair and therefore contravened the First Data Protection Principle.
The Commissioner considered that the provision of links to the websites containing the information following a search against the complainant’s name caused him distress.
The enforcement notice requires Google to remove the links from search results within 35 days.
Deputy Information Commissioner David Smith commented
“We understand that links being removed as a result of this court ruling is something that newspapers want to write about. And we understand that people need to be able to find these stories through search engines like Google. But that does not need them to be revealed when searching on the original complainant’s name”
This decision is unsurprising. If the processing of the complainant’s personal data by Google linking to the original news stories about his conviction was breach of the DPA, it is difficult to see how linking to other articles mentioning the same conviction could be justified in the public interest. The decision, nevertheless, draws stark attention to the anomalous treatment of Google and the press.
It is difficult to see why the media reporting Google’s delisting is in any better position than Google itself. Such a media report involves the processing of the complainant’s sensitive personal data in circumstances where there is no public interest and where, as a result, it is difficult to see how the “journalistic exemption” in section 32 of the DPA can apply. The issue does not appear to have been raised by the complainant in this case but it seems likely that the application of the principles in Google Spain to the media will be the next battleground in this area.