NT1 and NT2 vs.
Google LLC (Information Commissioner Intervening) decisions following a request by a data subject) was granted permission to
13 Apr 2018 [2018] WLR (D) 225, QBD
Facts:
The two unrelated claims concerned the “right to be forgotten”, to
have personal information “delisted” or “de-indexed” by the operators of
internet search engines (“ISEs”).
The claimants were two businessmen who were convicted of
criminal offences many years ago. Both Claimants were granted anonymity
(as ‘NT1’ and ‘NT2’ respectively) so as to avoid undermining the purpose of
their claims. The defendant, an American multinational technology company,
operated a major ISE called “Search”.
NT1 is a businessman. He had been involved in a controversial
property business in the late 1980s and early 1990s, when he was in his
thirties. In the late 1990s he was convicted of conspiracy to false account,
having transferred monies to offshore companies to cheat the revenue.
NT1 received a four-year custodial sentence, and was released in
the early 2000s. When the sentence was passed it was of such a length that
it would never have been deemed “spent” for the purposes of the
Rehabilitation of Offenders Act (‘ROA’). However, it became spent following
a change in the law in March 2014 (which had retrospective effect). Notably
had the sentence been one day longer, the position would not have
changed.
NT1 sought the delisting of three URLs from the search results
returned upon entry of his name into Google’s search engine. Two of the
URLs related to contemporaneous media reports of NT1’s conviction. The
other was a book extract which referred to the conviction.
NT2 is also a businessman. Around the turn of the century he was
involved in a business which had attracted public controversy for
environmental reasons. The business was targeted by individuals seeking to
disrupt it. NT2 took steps to identify those individuals; this included
sanctioning the use of unlawful phone and computer hacking. NT2 was
convicted for his part in this and received a six-month custodial sentence, of
which he served six weeks. His conviction had also become spent in March
2014 (but it would have become spent in July 2014, even if the law had not
changed). NT2 complained of about 11 URLs, some being
contemporaneous reports of his prosecution and conviction, and some more
recent.
In October 2015 both claimants sued Google for breach of the Data
Protection Act 1998 (‘DPA’) and the Misuse of Private Information owing to
Google’s refusal to ‘delist’ the URLs they had complained of. The
Information Commissioner (who has a statutory duty to review Google’s
intervene in the proceedings.
They sought orders for the removal of links on the basis that such
information was old, out of date, irrelevant, of no public interest and/or
otherwise an illegitimate interference with their rights. The claim in the first
case related to three links providing information about the claimant’s
conviction after a trial for conspiracy to account falsely, and the sentence
imposed. The claimant in the second case complained of links to 11 source
publications. He made one inaccuracy complaint, which related to an item in
a national newspaper. Both claimants sought compensation under the Data
Protection Act 1998 and damages for misuse of private information.
Issue/s:
1. Were the actions an abuse of the Court’s process as amounting in
substance to claims for damage to reputation intended to outflank the limits
of defamation law and the specific provisions concerning defamation law
contained in section 8 of the 1974 Act?
2. Was there information in any of the third-party publications which was
inaccurate and so gave rise to complaint under the Fourth Data Protection
Principle of the 1998 Act – “Personal data shall be accurate and, where
necessary, kept up to date.” – leading to an order to de-list?
3. Was Google entitled to rely on the exemption for journalism, literature and
art provided by section 32 of the 1998 Act?
4. Did Google’s processing comply with the Data Protection Principles as
required by section 4(4) of the 1998 Act?
5. Did Google’s processing comply with the requirements of the Google
Spain case?
6. As concerns misuse of private information did each Claimant enjoy a
reasonable expectation of privacy in respect of any of the information at
issue; if so how on the facts should the balance between rights of privacy
and freedom of expression be struck?
7. If either Claimant succeeded on liability then what damages should be
awarded?
Held:
1. The actions were not an abuse of the Court’s process. As a general rule it
is legitimate for a claimant to rely on any cause of action that arises or may
arise from a given set of facts. While in the present cases the protection of
reputation was a significant and substantial element it would be wrong to
draw too sharp a distinction between the protection of reputation on the one
hand and private life on the other. The authorities show that injury to
reputation can engage the protection of ECHR Art 8. Nor was the protection
of reputation either Claimant’s only objective. The Claimants were not
therefore seeking to exploit data protection law or the tort of misuse of
private information to “avoid the rules” – to get round the obstacles that
defamation law would place in their way.
2. An assessment of “inaccuracy” under the 1998 Act should bear in mind
the approach taken by the law of defamation to the natural and ordinary
meaning of a publication of which an offending statement was part, see
Charleston v News Group Newspapers Ltd [1995] 2 AC 65. It may also be
possible however to give more weight to literal accuracy in the context of
data protection law with its broader aims and its wider and more flexible
range of remedies. On the facts NT1’s six complaints of inaccuracy were
each dismissed since NT1 had failed to provide all the information needed to
establish that the data in question are evidently inaccurate. NT2 had
established that the single third party item of which he complained in this
respect was inaccurate in that it gave a misleading portrayal of his criminality
and conveyed other false imputations about him. On that basis alone a
delisting order in NT2’s favour was appropriate in relation to the particular
national newspaper article in question.
3. Google was not entitled to rely on the exemption for journalism, literature
and art provided by section 32 of the 1998 Act. Section 32 was not engaged
at all since the processing by Google for Search was not undertaken “with a
view to” publication for journalistic purposes. The concept of journalism is not
so elastic that it can be stretched to embrace every activity that has to do
with conveying information or opinions. To label all such activity as
“journalism” would be to elide the concept of journalism with that of
communication. Further and in any event Google’s processing could not be
said to be undertaken “solely” or “only” for journalistic purposes. Further still
section 32 if it had been applicable required a data controller to show that it
actually held objectively reasonable beliefs that a publication was in the
public interest and that compliance with any provision from which it sought
exemption was incompatible with a special purpose. There was however no
evidence at all that anyone at Google had given such consideration to the
public interest.
4. While most of Google’s arguments that its processing was compliant with
Schedule 3 of the 1998 Act were rejected it had satisfied Schedule 3
Condition 5 namely “the information contained in the personal data has been
made public as a result of steps deliberately taken by the data subject”,
Townsend v Google Inc [2017] NIQB 81 applied. The ordinary meaning of
Condition 5 reflects that those who deliberately commit crimes run the risk of
apprehension, prosecution, trial, conviction and sentence where publicity
follows in the light of the open justice principle. The parties accepted that
Schedule 2 Condition 6(1) was capable of application in this case. However
whether or not it applied in addition to Schedule 3 Condition 5 so that section
4(4) of the 1998 Act should be disapplied completely required the conduct of
a balancing exercise between the “legitimate interests” put forward by
Google on the one hand and the question on the other of whether the
prejudice to their rights complained of by the Claimants was unwarranted.
5. Whether Google’s processing complied with the requirements of the
Google Spain case required in each instance an application of the facts to
the Article 29 Working Party Guidelines – which had been developed by a
Working Party pursuant to Articles 29 and 30 of Directive 95/46 in the wake
of the Google Spain decision. No presumption operates in either party’s
favour. The 13 guidelines themselves were expressed to be flexible, non-
exhaustive and liable to evolve over time on the basis of experience. So far
as NT1 was concerned his case for de-listing was not made out. The
information about his crime and punishment was not information of a private
nature. It was information about business crime, its prosecution and its
punishment. NT1 continued to play a limited role in public life. He had not
shown the information to be inaccurate in any material way. It is sensitive
information and NT1 had identified some legitimate grounds for delisting but
he had failed to produce any compelling evidence in support of those
grounds. Much of the harm complained of was business-related and some of
it pre-dated the time when NT1 could legitimately complain about Google’s
processing. NT1’s Article 8 private life rights were engaged but did not attract
any great weight. The information originally appeared in the context of crime
and court reporting in the national media which was a natural and
foreseeable result of NT1’s own criminal behaviour. The information was
historic and the domestic law of rehabilitation was engaged but only at the
margins. NT1’s sentence was of such a length that at the time he had no
reasonable expectation that his conviction would ever be spent. The law has
changed but if the sentence had been any longer the conviction would still
not be spent. NT1’s business career since leaving prison made the
information relevant in the past to the assessment of his honesty by
members of the public. The information retained sufficient relevance today.
NT1 had not accepted his guilt, had misled the public and the Court and
showed no remorse over any of these matters. He remained in business and
the information served the purpose of minimising the risk that NT1 will
continue to mislead as he had in the past.
NT2’s de-listing claim was made out. The crime and punishment information
concerning him had become out of date, irrelevant and of no sufficient
legitimate interest to users of Google Search to justify its continued
availability. The conviction was always going to become spent and it did so
in 2014. NT2 had frankly acknowledged his guilt and expressed genuine
remorse. There was no evidence of any risk of repetition. His current
business activities were in a field quite different from that in which he was
operating at the time. NT2’s past offending was of little if any relevance to
anybody’s assessment of his suitability to engage in relevant business
activity now or in the future. There was no real need for anybody to be
warned about that activity.

6. NT1 did not have a reasonable expectation of privacy in relation to the

information about his prosecution, conviction and sentence. However, even if
NT1 did have such a reasonable expectation of privacy it was outweighed in
his case by the same factors as given in relation to the Google Spain
balancing exercise. The evidence had failed to establish any material
interference with NT1’s right to respect for family life and there was nothing
more than a modest interference with his private life. That did not make an
interference by the Court with the operation of Google Search a
proportionate response.

In NT2’s case his Article 8 rights were engaged with the presence of a young
family a distinguishing feature. There was just enough in the realm of private
and family life to cross the threshold and require a justification. However
Google’s case on relevance concerning NT2 was very weak. Accordingly the
relevant factors weighed in favour of de-listing.

7. The question of damages did not arise in NT1’s case. In NT2’s case it
would be hard to say by reference to the terms of s 13(3) of the Data
Protection Act 1998 that Google had failed to take “such care as in all the
circumstances was reasonably required” to comply with the relevant
requirements. Accordingly, the Court issued a delisting order for Google to
remove the relevant data and search links related to NT2. As Google had
shown a commitment to complying with data protection requirements and
had taken reasonable care, no damages or compensation were awarded to
NT2.