Nt1-and-nt2-v-google-llc.docx

NT1 and NT2 vs. Google LLC (Information Commissioner Intervening) 13 Apr 2018 [2018] WLR (D) 225, QBD Facts: The two unrelated claims concerned the “right to be forgotten”, to have personal information “delisted” or “de-indexed” by the operators of internet search engines (“ISEs”). The claimants were two businessmen who were convicted of criminal offences many years ago. Both Claimants were granted anonymity (as ‘NT1’ and ‘NT2’ respectively) so as to avoid undermining the purpose of their claims. The defendant, an American multinational technology company, operated a major ISE called “Search”. NT1 is a businessman. He had been involved in a controversial property business in the late 1980s and early 1990s, when he was in his thirties. In the late 1990s he was convicted of conspiracy to false account, having transferred monies to offshore companies to cheat the revenue. NT1 received a four-year custodial sentence, and was released in the early 2000s. When the sentence was passed it was of such a length that it would never have been deemed “spent” for the purposes of the Rehabilitation of Offenders Act (‘ROA’). However, it became spent following a change in the law in March 2014 (which had retrospective effect). Notably had the sentence been one day longer, the position would not have changed. NT1 sought the delisting of three URLs from the search results returned upon entry of his name into Google’s search engine. Two of the URLs related to contemporaneous media reports of NT1’s conviction. The other was a book extract which referred to the conviction. NT2 is also a businessman. Around the turn of the century he was involved in a business which had attracted public controversy for environmental reasons. The business was targeted by individuals seeking to disrupt it. NT2 took steps to identify those individuals; this included sanctioning the use of unlawful phone and computer hacking. NT2 was convicted for his part in this and received a six-month custodial sentence, of which he served six weeks. His conviction had also become spent in March 2014 (but it would have become spent in July 2014, even if the law had not changed). NT2 complained of about 11 URLs, some being contemporaneous reports of his prosecution and conviction, and some more recent. In October 2015 both claimants sued Google for breach of the Data Protection Act 1998 (‘DPA’) and the Misuse of Private Information owing to Google’s refusal to ‘delist’ the URLs they had complained of. The Information Commissioner (who has a statutory duty to review Google’s

decisions following a request by a data subject) was granted permission to intervene in the proceedings. They sought orders for the removal of links on the basis that such information was old, out of date, irrelevant, of no public interest and/or otherwise an illegitimate interference with their rights. The claim in the first case related to three links providing information about the claimant’s conviction after a trial for conspiracy to account falsely, and the sentence imposed. The claimant in the second case complained of links to 11 source publications. He made one inaccuracy complaint, which related to an item in a national newspaper. Both claimants sought compensation under the Data Protection Act 1998 and damages for misuse of private information. Issue/s: 1. Were the actions an abuse of the Court’s process as amounting in substance to claims for damage to reputation intended to outflank the limits of defamation law and the specific provisions concerning defamation law contained in section 8 of the 1974 Act? 2. Was there information in any of the third-party publications which was inaccurate and so gave rise to complaint under the Fourth Data Protection Principle of the 1998 Act – “Personal data shall be accurate and, where necessary, kept up to date.” – leading to an order to de-list? 3. Was Google entitled to rely on the exemption for journalism, literature and art provided by section 32 of the 1998 Act? 4. Did Google’s processing comply with the Data Protection Principles as required by section 4(4) of the 1998 Act? 5. Did Google’s processing comply with the requirements of the Google Spain case? 6. As concerns misuse of private information did each Claimant enjoy a reasonable expectation of privacy in respect of any of the information at issue; if so how on the facts should the balance between rights of privacy and freedom of expression be struck? 7. If either Claimant succeeded on liability then what damages should be awarded? Held:

1. The actions were not an abuse of the Court’s process. As a general rule it is legitimate for a claimant to rely on any cause of action that arises or may arise from a given set of facts. While in the present cases the protection of reputation was a significant and substantial element it would be wrong to draw too sharp a distinction between the protection of reputation on the one hand and private life on the other. The authorities show that injury to reputation can engage the protection of ECHR Art 8. Nor was the protection of reputation either Claimant’s only objective. The Claimants were not therefore seeking to exploit data protection law or the tort of misuse of private information to “avoid the rules” – to get round the obstacles that defamation law would place in their way. 2. An assessment of “inaccuracy” under the 1998 Act should bear in mind the approach taken by the law of defamation to the natural and ordinary meaning of a publication of which an offending statement was part, see Charleston v News Group Newspapers Ltd [1995] 2 AC 65. It may also be possible however to give more weight to literal accuracy in the context of data protection law with its broader aims and its wider and more flexible range of remedies. On the facts NT1’s six complaints of inaccuracy were each dismissed since NT1 had failed to provide all the information needed to establish that the data in question are evidently inaccurate. NT2 had established that the single third party item of which he complained in this respect was inaccurate in that it gave a misleading portrayal of his criminality and conveyed other false imputations about him. On that basis alone a delisting order in NT2’s favour was appropriate in relation to the particular national newspaper article in question. 3. Google was not entitled to rely on the exemption for journalism, literature and art provided by section 32 of the 1998 Act. Section 32 was not engaged at all since the processing by Google for Search was not undertaken “with a view to” publication for journalistic purposes. The concept of journalism is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions. To label all such activity as “journalism” would be to elide the concept of journalism with that of communication. Further and in any event Google’s processing could not be said to be undertaken “solely” or “only” for journalistic purposes. Further still section 32 if it had been applicable required a data controller to show that it actually held objectively reasonable beliefs that a publication was in the public interest and that compliance with any provision from which it sought exemption was incompatible with a special purpose. There was however no evidence at all that anyone at Google had given such consideration to the public interest. 4. While most of Google’s arguments that its processing was compliant with Schedule 3 of the 1998 Act were rejected it had satisfied Schedule 3

Condition 5 namely “the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject”, Townsend v Google Inc [2017] NIQB 81 applied. The ordinary meaning of Condition 5 reflects that those who deliberately commit crimes run the risk of apprehension, prosecution, trial, conviction and sentence where publicity follows in the light of the open justice principle. The parties accepted that Schedule 2 Condition 6(1) was capable of application in this case. However whether or not it applied in addition to Schedule 3 Condition 5 so that section 4(4) of the 1998 Act should be disapplied completely required the conduct of a balancing exercise between the “legitimate interests” put forward by Google on the one hand and the question on the other of whether the prejudice to their rights complained of by the Claimants was unwarranted. 5. Whether Google’s processing complied with the requirements of the Google Spain case required in each instance an application of the facts to the Article 29 Working Party Guidelines – which had been developed by a Working Party pursuant to Articles 29 and 30 of Directive 95/46 in the wake of the Google Spain decision. No presumption operates in either party’s favour. The 13 guidelines themselves were expressed to be flexible, nonexhaustive and liable to evolve over time on the basis of experience. So far as NT1 was concerned his case for de-listing was not made out. The information about his crime and punishment was not information of a private nature. It was information about business crime, its prosecution and its punishment. NT1 continued to play a limited role in public life. He had not shown the information to be inaccurate in any material way. It is sensitive information and NT1 had identified some legitimate grounds for delisting but he had failed to produce any compelling evidence in support of those grounds. Much of the harm complained of was business-related and some of it pre-dated the time when NT1 could legitimately complain about Google’s processing. NT1’s Article 8 private life rights were engaged but did not attract any great weight. The information originally appeared in the context of crime and court reporting in the national media which was a natural and foreseeable result of NT1’s own criminal behaviour. The information was historic and the domestic law of rehabilitation was engaged but only at the margins. NT1’s sentence was of such a length that at the time he had no reasonable expectation that his conviction would ever be spent. The law has changed but if the sentence had been any longer the conviction would still not be spent. NT1’s business career since leaving prison made the information relevant in the past to the assessment of his honesty by members of the public. The information retained sufficient relevance today. NT1 had not accepted his guilt, had misled the public and the Court and showed no remorse over any of these matters. He remained in business and the information served the purpose of minimising the risk that NT1 will continue to mislead as he had in the past.

NT2’s de-listing claim was made out. The crime and punishment information concerning him had become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability. The conviction was always going to become spent and it did so in 2014. NT2 had frankly acknowledged his guilt and expressed genuine remorse. There was no evidence of any risk of repetition. His current business activities were in a field quite different from that in which he was operating at the time. NT2’s past offending was of little if any relevance to anybody’s assessment of his suitability to engage in relevant business activity now or in the future. There was no real need for anybody to be warned about that activity. 6. NT1 did not have a reasonable expectation of privacy in relation to the information about his prosecution, conviction and sentence. However, even if NT1 did have such a reasonable expectation of privacy it was outweighed in his case by the same factors as given in relation to the Google Spain balancing exercise. The evidence had failed to establish any material interference with NT1’s right to respect for family life and there was nothing more than a modest interference with his private life. That did not make an interference by the Court with the operation of Google Search a proportionate response. In NT2’s case his Article 8 rights were engaged with the presence of a young family a distinguishing feature. There was just enough in the realm of private and family life to cross the threshold and require a justification. However Google’s case on relevance concerning NT2 was very weak. Accordingly the relevant factors weighed in favour of de-listing. 7. The question of damages did not arise in NT1’s case. In NT2’s case it would be hard to say by reference to the terms of s 13(3) of the Data Protection Act 1998 that Google had failed to take “such care as in all the circumstances was reasonably required” to comply with the relevant requirements. Accordingly, the Court issued a delisting order for Google to remove the relevant data and search links related to NT2. As Google had shown a commitment to complying with data protection requirements and had taken reasonable care, no damages or compensation were awarded to NT2.

.