It has taken some time for the principles recognised – somewhat ambiguously – in Google Spain to be tested in the English courts. Although the so-called right to be forgotten has rarely left the public memory (at least of that wretched and spindly section of the public which is interested in data protection), taking on Google takes guts, money and an ability to overlook the risk of the Streisand effect. NT1 & NT2 v Google LLC [2018] EWHC 799 (QB) is the battle royale you have been waiting for. But if you want brevity, look elsewhere.
NT1 and NT2 are, despite their monikers, unrelated and linked only by having received (now spent) convictions in connection to their business activities in the relatively distant past, and now seeking justice. So long as by justice you mean the delisting of references to their convictions online. It’s buddy movie, possibly starring Mel Gibson and Danny Glover, only with more copies of Directive 95/46/EC and fewer gunshot victims or gratuitous nudity. (That’s in the private judgments we assume.)
Both had made delisting requests to Google, which had refused to delist on public interest grounds. NT1 sought delisting of three links – two media reports and a book extract – and NT2 sought to delist eleven links. Both sought an order for the blocking or erasure of their data, an injunction to prevent future processing and damages.
The judgment of Warby J following the trials is long and comprehensive. It will – in the pompous phrase – repay careful reading, albeit only if you can find someone willing to pay you to do so. For those interested, there is plenty of good stuff and the analysis of at least three legal regimes of no small complication is to be applauded and respected: the Data Protection Act 1998 (DPA) and its European source material; the Rehabilitation of Offenders Act 1974 (ROA); and Article 8 ECHR.
Although the summary of the legal framework is largely uncontroversial – but very helpful to those unfamiliar – there are a few points to mention. Of possible future use is the note Warby J makes at [29] that s14 DPA has been implemented in narrower terms than Article 12(b) of the Directive, but the point did not arise for decision. The section dealing with the confidentiality and privacy attaching to criminal convictions is interesting, citing various cases of vigorous judicial denials that a conviction could be confidential and that the ROA did not alter that, next to a long series of cases establishing that disclosure of convictions can amount to an interference with privacy: at [45]-[48]. Happily, or unhappily if you are an insomniac, Google did not ultimately pursue a pleaded defence that the search function was a form of ‘caching’ protected under the E-Commerce Directive and Regulations. This would have afforded a fairly swingeing defence if borne out, whilst also having surprising regulatory consequences, i.e. more or less disapplying Google Spain to, erm, Google. The judgment records Google backing down after hearing the Commissioner’s intervention, whilst not at all conceding that they were legally wrong: at [50]. Maybe the point will be resurrected. One suspects not.
The judgment then considers issues separately and in turn.
Warby J declined to dismiss the claims as an abuse of process, because they sought to evade the limitations of defamation law, and the policy found in s8 ROA (which permits reliance on a spent conviction in defence to defamation, unless there is malice). That, with respect, must be right, or the right to be forgotten would be significantly undermined.
NT1 made various complaints of data inaccuracy in the search results contrary to the fourth data protection principle, although did not apparently particularise what they were, and Warby J’s characterisation of “not especially transparent or helpful” at [79] is something of a judicial understatement. A summary of the principles to be adopted are set out at [80]-[87], and they move the law on somewhat. The judge relied on DPA, s70(2) to support an approach which was not too narrow, and, importantly, held that it was appropriate to have some regard to principles from defamation law. Reading the words in context (and not a headline alone) is sensible in principle, although there is no engagement with whether it is only the search result and not the article context linked to which Google processes. The judicial emphasis on the broad discretion in ss10 and 14 was used to build in latitude, for example in a case of a single inaccuracy in an otherwise long and valid article, or to protect reporting which in defamation might attract qualified privilege. One sees the sense, but importing defamation into data protection is hardly unarguably correct, even if it makes life easier for the defamation bar. On the facts, partly because of an extremely unsatisfactory performance in the witness box from NT1 and partly because little effort had been made to evidence the claims which related to rather historic matters, none of the inaccuracy complaints succeeded: at [93]. The judge’s closing paragraph did, importantly perhaps, suggest he was ultimately applying a test of ‘evidently inaccurate’, derived from the Article 29 Working Party: at [94]. In contrast, the one inaccuracy complaint made by NT2 was upheld because the article identified him in a manner misleading as to the extent and nature of his criminality: at [189].
A significant ruling in the judgment is that the work of Google is not journalism for the purposes of the broad s32 DPA exemption. It accepts that support or ancillary activities – such as printing a newspaper – can be within s32, but that Google’s search engine cannot: at [98]-[100]. Its processing for its own purposes, not those of journalism, and it failed the statutory language of ‘solely’: at [101]. The Court accepted the Commissioner’s point that it would prevent any regulatory oversight of search engines. It also noted that Google could not have had a reasonable belief of public interest publication because that was not how its assessment process worked: at [102].
The existence or otherwise of a processing condition in Schedule 3 which justified Google’s processing of sensitive personal data is a matter of real legal debate, and one which evidently concerned all the parties and the court, on the basis that there is not an obvious or ready answer, and the absence of one is untenable: at [104]. The judge felt it did not matter much, because the parties also agreed that the claim required a fair balancing test to be conducted under Google Spain: at [105]. Nonetheless, he gave some obiter views. He refused to interpret backwards from the GDPR, and he declined to leave the entire balance to the remedy stage. He recognised the logic of the Commissioner’s argument that the requirement to meet a condition in Schedule 3 be disapplied as in Vidal-Hall because of a failure to recognise free speech rights, but, fairly enough, was unkeen on leaping too readily to that answer. Warby J did, however, find a Schedule 3 condition to be met: namely condition 5, that the information has been made public by deliberate steps taken by the data subject: at [110]. This was the line taken in Northern Ireland, and this author is as sceptical about the answer now as in advance of this judgment (see here). There is certainly greater engagement with the counter-arguments, but the ruling that so long as there is a deliberate step and the information is subsequently made public (at [111]) is not obviously consistent with the evident purpose of the condition, and not at all consistent with the wording of the Directive, which is not very “obscure” at all (see at [112]). That the scheme would be problematic without it is clearly right. But it is a rare part of the judgment which is not at all convincing, and might be thought something close to textual vandalism.
As to the application of Google Spain itself, Warby J indicated that the balancing exercise mandated was to be done with the scales empty and that the CJEU had not prescribed anything else contrary to classic Article 8-10 balancing: at [132]-[133]. The Court accepted Article 10 rights were engaged: at [134]. The Working Party criteria were to be used as a helpful guide, but did not prevent Google adopting other factors: at [135]. All of that is plainly right. The judge then proceeded through the criteria one by one, and readers can see the application of those to the facts for themselves. A well-known businessman has, he found, at least some degree of a role in public life and he remains in business with customers, and there was no expectation of privacy in respect of his trial and conviction. The fact there was sensitive health data did not mean it needed delisting, given its age and lack of harm. The judge was plainly unimpressed by broad, generalised assertions of harm and social shunning.
However, within that exercise Warby J had to reconcile the ROA with the DPA regime. He did so at [166]. Rehabilitation is an aspect of privacy, but it is not unqualified, and the exceptions legislated for are not necessary exhaustive of disclosure. The ROA could be read down under s3 of the Human Rights Act 1998. A spent conviction will “normally be a weighty factor” in the balance, but that weighing must still happen by reference to all the facts. Just because the claim is not in defamation, the policy in s8 ROA is still relevant, where the primary harm alleged is to reputation. The source material is of course not removed by delisting.
On the facts of NT1’s case, Warby J thought it important that he had put out false and misleading statements about his past, there was little harm involved, the Article 8 aspects were weak, he showed real difficulties in acknowledging his guilt, and he remains in business. The claim failed: at [167]-[170]. On the facts of NT2’s case, Warby J had evidently found him a much better witness, the convictions were not for dishonesty offence and NT2 had pleaded guilty, he shows genuine remorse, and public comments made were to explain his behaviour rather than mischaracterise it. The claim succeeded: at [202]-[207], [223].
However, in the case of NT2, no award of damages was appropriate because Google was, the judge ruled, entitled to rely on the statutory defence in s13(3) of having taken such care as reasonably required. This appears to have been concluded on the basis of reverse reasoning back from the fact that the trial had been a lengthy and difficult one, which was doubtless true but rather risks encouraging controllers to fit trials to be able to establish their reasonableness at the time. (This may be a phantom fear; certainly one doubts Google’s counsel costs alone would have been less than any damages conceivably at stake.)
If anyone is still reading this ‘summary’, a warning: your own reading of the judgment will doubtless produce different points of emphasis and different areas of concern. This post may well be hopelessly wrong. But at least if it is, and I admit it with remorse, I may be able to get it delisted in a few years.
Christopher Knight