Today sees the start of the first High Court trial to address the application of the right to be forgotten (“RTBF”) as articulated by the CJEU in C‑131/12 Google Spain v Agencia Española de Protección de Datos & Mario Costeja González (“Google Spain”).
Warby J will preside over the first of two trials (NT2 v Google LLC is due to start on 12 March) concerning data protection and privacy claims brought in respect of Google’s refusal to delist/deindex search results in two spent conviction cases. Nicklin J’s decision following the pre-trial review can be found here and Warby J’s decision on the reporting restrictions is available here.
NT1’s claim arises from Google’s refusal to delist/deindex search results (including contemporaneous press reporting) concerning information about a (now) spent conviction dating to the 1990s. Information contained in the search results is said to include both sensitive personal data and private information. The claim is brought under the Data Protection Act 1998 (“the DPA”), relying on the CEJU’s decision in Google Spain and various data protection principles, and in the tort of misuse of private information.
Significant reliance is likely to be placed on the Rehabilitation of Offenders Act 1974 (“the 1974 Act”). This Act provides for the “rehabilitation” of offenders (through their convictions becoming spent) at which point they are to be treated as not having those convictions. In his PTR decision (at ), Nicklin J characterised the 1974 Act as an early iteration of right to be forgotten, noting that through this Act “the principle of a “right to be forgotten” was recognised in domestic law many years ago, and long before data protection laws came along”.
Google’s defence in relation to the data protection claim is likely to focus on the right of the public to access the information contained in search results outweighing the data protection/privacy rights of NT1 on the facts. Google will presumably rely on condition 6 of Schedule 2 (legitimate interests of the data controller/third parties) and condition 5 of Schedule 3 to the DPA (steps deliberately taken by the data subject). It is anticipated that Google will also seek to rely, in the alternative, on the journalism exemption under s.32 of the DPA. If this exemption applies, Google would be exempt from compliance with the relevant data protection principles and data subject rights under ss.10 and 14(1) of the DPA. Reliance may also be placed on the caching defence under the E-Commerce Directive / Regulations.
In respect of the privacy claim, Google is likely to contend that the generation of search results does not amount to publication/(mis)use of information and/or that the article 10 rights of users outweigh the claimant’s article 8 rights.
The outcome of the data protection limb of this case may depend to a large extent on the application to the facts of the CJEU’s guidance in Google Spain and the Article 29 Working Party’s Guidelines on the implementation of that decision. However, this case gives rise to a series of issues with resonance beyond its facts. It seems likely that the following key issues will have to be considered:
- How Google Spainis to be applied to the generation of search results containing sensitive personal data given that the CJEU anchored the balancing exercise in article 7(f) of the Directive (condition 6 of schedule 2 to the DPA) which cannot justify the processing of sensitive personal data. There must be some doubt as to whether the processing of sensitive personal data by a search engine could ever satisfy any of the Schedule 3 DPA conditions, which is necessary for compliance with the First Data Protection Principle. If, as the Article 29 Working Party appears to envisage, the “sensitive” nature of the data concerned is simply one (important) factor in a broader balancing exercise, it is not clear what the UK legal basis for the processing of such data would be (logically such a foundation must exist before any question of balancing competing interests arises). To the extent that such processing by search engine operators is inherently unlawful, the issue arises as to whether this falls to be addressed through the disapplication or reading down of the First Data Protection Principle in delisting cases to enable a Google Spain balancing exercise to take place or perhaps through the approach taken to relief in delisting cases.
- The relationship between the E-Commerce Directive(and the E-Commerce Regulations 2002 which transpose the Directive into UK law) and data protection law and, in particular, whether the former has any application in the context of personal data processing. This encompasses the issue of whether a search engine operator can rely on the caching defence (under article 13 of the E-Commerce Directive) or any other safe harbour defence in circumstances in which a data subject has relied on the RTBF.
- Related to this is the question of whether Google Search is a caching service within the meaning of article 13 of the E-Commerce Directiveand regulation 18 of the E-Commerce Regulations so as to mean that Google would be exempt from paying damages so long as it complies with an order to delist.
- Whether Google can rely on the journalism exemption under 32 of the DPAin respect of its data processing through the generation of search results after its having received a delisting request (in Google Spain the CJEU suggested that it could not). This gives rise to a number of sub-questions including: (a) whether the generation of search results could ever be characterised as journalism; (b) how such processing could be said to be only/solely for journalistic purposes given the functions of a search engine and the purposes of its operator; (c) whether such processing could be regarded as being with a view to publication by primary/original online publishers; and (d) whether, on the facts, anyone involved in handling the delisting request and taking the decision to continue processing the impugned search results held the requisite reasonable belief that publication by the third party online publisher would be in the public interest (there is little doubt that an automated search generation process could not incorporate or hold such beliefs and that the s.32 exemption could not be relied upon prior to the handling of a delisting request).
- Whether, in the context of the commission of criminal offences leading to trial and/or sentencing in open court, reported information concerning the conviction is to be regarded having been made public as a result of steps deliberately taken by a data subject (per condition 5 of Schedule 3 to the DPA).
- Whether a search engine operator may be held liable for the misuse of private information in respect of the generation of search results. In Metropolitan International Schools v Designtechnica  EWHC 1765search engine operators were held not to be publishers (for the purposes of the law of libel) but it may be argued that either this point was wrongly decided or that a “misuse” of private information arises without “publication” as it is understood at common law.
- The role and relevance of 1974 Act in the context privacy claims arising from the use/publication of information about spent convictions, including the interaction between rehabilitation and the Open Justice Principle (where contemporaneous court reporting remains online). This issue is by no means confined to search results.
- Whether claimants can bring privacy claims (including a reputational element) in respect of the publication of information about spent convictions in circumstances in which section 8 of the 1974 Act is likely to give a publisher a defence under the law of defamation.
NT1 is a case with profound implications for both data protection law and the law of privacy. Warby J’s judgments in this case and that of NT2 are likely to determine important issues and provide guidance on the operation of the right to be forgotten; the processing of sensitive personal data by search engines; the application of the law of privacy to spent convictions; the application of the journalism exemption in data protection law to search engine operators; and the interaction between data protection law and the E-Commerce Directive/Regulations. These are all areas in which the law would benefit from clarification.
The digital age has undoubtedly made “rehabilitation” more difficult for ex-offenders because the internet establishes a quasi-permanent searchable record which may vitiate attempts by individuals to rebuild private and professional lives unburdened by the past. Yet the internet also serves as a sometimes-valuable resource for alerting consumers, would-be partners and others to risks associated with dealing with particular individuals. The application of the right to be forgotten to search engine operators (as well as primary publishers) is central to the striking of a balance between these values. This case and NT2 will provide important clarification of the law in this area.
Aidan Wills is a barrister at Matrix specialising in media and information law, public law and employment law.