When does rehabilitation create a ‘right to be forgotten’?

20 April 2018 by Dominic Ruck Keene

In NT1 and NT2 v Google LLC, Mr Justice Warby considered whether Google should be required to ‘de-list’ links in its search results to articles about the spent historic convictions of two businessmen under what is commonly called the ‘right to be forgotten’. He held it was in the case of one claimant, but not the other.

The claimants argued that the Google search results conveyed inaccurate information about their offending. Further, they sought orders requiring details about their offending and their convictions and sentences to be removed from Google Search results, on the basis that such information was out of date; irrelevant; of no public interest; and/or otherwise an illegitimate interference with their rights. They also sought compensation for Google in continuing to return search results disclosing such details, after the claimants’ complaints were made. Google resisted both claims, maintaining that the inclusion of such details in its search results was legitimate.

Mr Justice Warby summarised the issues as “the first question is whether the record needs correcting; the second question is whether the data protection or privacy rights of these claimants extend to having shameful episodes in their personal history eliminated from Google Search; thirdly, there is the question of whether damages should be paid.”

Legal Background

The judge began his lengthy judgment (which runs to 230 paragraphs) by listing ten key elements of the relevant legal framework: including the ECHR, in particular Articles 8 (right to family life) and 10 (freedom of expression); the Rehabilitation of Offenders Act under which certain convictions become ‘spent’; the Data Protection Directive and Data Protection Act; the 2004 decisions of the House of Lords in Campbell v MGN Ltd [2004] UKHL 22 [2004] 2 AC 457 and In re S (A Child) [2004] UKHL 47 [2005] 1 AC 593 , in which the House recognised a common law right to protection against the misuse of private information; the May 2014 decision of the CJEU in Google Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) Case C-131/12 [2014] QB 1022, in which the CJEU interpreted the DP Directive and the Charter of Fundamental Rights as creating a qualified right to be forgotten; and the General Data Protection Regulation.

It should be noted that with respect to the Data Protection Act, the claimants argued that Google was in breach of its obligations as a data controller in that the information returned by Google was in some respects inaccurate and in any event was out of date and maintained for longer than necessary. Google argued that there was no breach, but in any event, it was entitled to rely on the journalism exemption under the DPA.

The judge went to consider the case of Google Spain and highlighted that the CJEU held that a delisting request relating could be upheld, in respect of “links to web pages published lawfully by third parties and containing true information in relation to him personally …” if the inclusion of those links in the list of search results “appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine”. Overall, a balance of the relevant rights and interests had to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public would be significantly greater if the data subject plays a role in public life.

The judge also sought to clarify what he felt to be popular misconceptions surrounding this legal issue:

it may be misleading to label the right asserted by these claimants as the “right to be forgotten”. They are not asking to “be forgotten”. The first aspect of their claims asserts a right not to be remembered inaccurately. Otherwise, they are asking for accurate information about them to be “forgotten” in the narrow sense of being removed from the search results returned by an Internet Search Engine in response to a search on the claimant’s name. No doubt a successful claim against Google would be applied to and by other Internet Search Engines. But it does not follow that the information at issue would have to be removed from the public record, or that a similar request would have to be complied with by a media publisher on whose website the same information appeared. In these proceedings the claimants are not asking for any such remedy. It is also worth noting here a point that I shall come back to: a successful delisting request or order in respect of a specified URL will not prevent Google returning search results containing that URL; it only means that the URL must not be returned in response to a search on the claimant’s name.

With respect to the particular nature of the personal information in question, namely previous convictions, the judge highlighted that the question of whether information about a conviction can count as an item of confidential information and/or an aspect of an individual’s private or family life had not so far been held capable in English courts of being confidential information and only recently had it been acknowledged that information of this kind could fall within the ambit of an individual’s Article 8 private life.

Decision in each case

When considering the substantive merits of the case, the judge began by dismissing Google’s argument that the claim amounted to an abuse of process through being an attempt to circumvent the restrictions on defamation cases. He held that:

I [do not] consider that the protection of reputation is the claimant’s only objective or, to use the words of Buxton LJ “the nub” of the claims. The pleading and the evidence in support of his case rely on factors which go beyond mere reputation, and cross over into areas of private life which are distinct from matters of reputation. I do not find that NT1 is seeking to exploit data protection law or the tort of misuse of private information to “avoid the rules” – to get round the obstacles that defamation law would place in his way. He is relying on the new law pronounced by the CJEU. As Mr Tomlinson submits, the Court should not be too liberal in its labelling of prejudice as “injury to reputation”, lest it undermine the Google Spain regime.

With regards to the inaccuracy claim, the judge held that under the Data Protection Act

even where data are found to be inaccurate the Court has a toolbox of discretionary remedies that can be applied according to the circumstances of the individual case. Indeed, the Court may grant a remedy even if … the data are not found to be inaccurate. At one extreme, the Court may deem it appropriate to order a data controller both to block and erase data, and to tell third parties to whom the data have been disclosed that this has been done. At the other extreme, the Court may conclude that no order should be made. Between those two extremes lies a variety of options. The Court’s order will need to be tailored to the circumstances, having regard to the effect a particular remedy would have on the parties and on the wider public.

He went on consider the individual allegations of inaccuracy and dismissed them for varying reasons, including that the words in question had been taken out of context, and that he had not been persuaded that there had in fact been inaccuracy having assessed the facts of what had happened.

The judge then considered the breach of Data Protection Act claim, and started by dismissing Google’s argument that it was processing information solely with a view to publication for journalistic purposes. He also held that in any event, Google had not shown that it had held a reasonable belief that it would be incompatible with the special purposes for its continued processing of the data to be carried out in compliance with the Act.

He went on hold that Google had complied with the Data Protection Act to the extent first that “the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject”. Those deliberate steps was the criminal conduct in question. Secondly, that Google plainly had a legitimate interest in the processing of third party data in pursuit of its business, and third parties have a legitimate interest in receiving information via Google.

The judge then turned to the Google Spain balancing exercise. He began by holding that “the balancing process in any individual delisting case is ordinarily, as a matter of principle, to be entered into with the scales in equal balance as between delisting on the one hand and continued processing on the other.”

Regarding NT1, he concluded that

The key conclusions I have drawn are these. Around the turn of the century, NT1 was a public figure with a limited role in public life. His role has changed such that he now plays only a limited role in public life, as a businessman not dealing with consumers. That said, he still plays such a role. The crime and punishment information is not information of a private nature. It was information about business crime, its prosecution, and its punishment. It was and is essentially public in its character. NT1 did not enjoy any reasonable expectation of privacy in respect of the information at the time of his prosecution, conviction and sentence. My conclusion is that he is not entitled to have it delisted now. It has not been shown to be inaccurate in any material way. It relates to his business life, not his personal life. It is sensitive information, and he has identified some legitimate grounds for delisting it. But he has failed to produce any compelling evidence in support of those grounds. Much of the harm complained of is business-related, and some of it pre-dates the time when he can legitimately complain of Google’s processing of the information. His Article 8 private life rights are now engaged, but do not attract any great weight. The information originally appeared in the context of crime and court reporting in the national media, which was a natural and foreseeable result of the claimant’s own criminal behaviour. The information is historic, and the domestic law of rehabilitation is engaged. But that is only so at the margins. The sentence on this claimant was of such a length that at the time he had no reasonable expectation that his conviction would ever be spent. The law has changed, but if the sentence had been any longer, the conviction would still not be spent. It would have been longer but for personal mitigation that has no bearing on culpability. His business career since leaving prison made the information relevant in the past to the assessment of his honesty by members of the public. The information retains sufficient relevance today. He has not accepted his guilt, has misled the public and this Court, and shows no remorse over any of these matters. He remains in business, and the information serves the purpose of minimising the risk that he will continue to mislead, as he has in the past. Delisting would not erase the information from the record altogether, but it would make it much harder to find. The case for delisting is not made out.

With regards to to NT2, he held that the underlying document linked to by Google was inaccurate, and accordingly should be delisted. He concluded that

My key conclusions in respect of NT2’s delisting claim are that the crime and punishment information has become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability, so that an appropriate delisting order should be made. The conviction was always going to become spent, and it did so in March 2014, though it would have done so in July of that year anyway. NT2 has frankly acknowledged his guilt, and expressed genuine remorse. There is no evidence of any risk of repetition. His current business activities are in a field quite different from that in which he was operating at the time. His past offending is of little if any relevance to anybody’s assessment of his suitability to engage in relevant business activity now, or in the future. There is no real need for anybody to be warned about that activity.

Comment

This judgment will clearly be of relevance to future ‘delisting’ arguments, in particular because of the checklist approach that was adopted. The most surprising aspect of the case is perhaps the degree to which the judge undertook a detailed factual assessment of the claimants’ probity, behaviour and character. It is notable that the question of whether the previous conviction was now ‘spent’ was a weighty factor when considering each claimant in this case.

It is also interesting to note Mr Justice Warby’s obiter comment that there was a powerful argument that the scheme of the Data Protection Act is incompatible with fundamental rights, as it fails to recognise any possibility of a free speech justification for the processing of sensitive personal data without consent (see para 105).

One final point – the judge granted NT1 permission to appeal. The courts have not finished clarifying the principles of the ‘right to be forgotten’ just yet.

Dominic Ruck Keen is a barrister at One Crown Office Row.