The right to be forgotten

The recent global focus on Facebook and Cambridge Analytica’s use of data and the forthcoming General Data Protection Regulation (GDPR) have thrown the spotlight on data and privacy issues. An important issue in this context is whether an individual has the right for that data to be removed or forgotten. A recent UK High Court ruling has found that individuals have the ‘right to be forgotten’ insofar as spent criminal convictions are concerned. The case is a first of its kind since the right to be forgotten was established by the European Court of Justice in 2014, in a case known as Google Spain that will be highly significant to any company which processes data. The decision is also of interest as it comes shortly before the implementation of the GDPR, which incorporates an express right to be forgotten.

(1) NT1 and (2) NT2 v Google LLC and The Information Commissioner (2018)

The claimants in this case were two businessmen who were convicted of criminal offences a number of years ago. At that time, there were media reports in relation to their prosecution and conviction. The nature of the offences and subsequent rehabilitation were considered by the Court to be of significant importance:

• NT1 was convicted of criminal conspiracy in the late 1990s and accused but not tried for a separate conspiracy connected with the same business. The conviction involved serious dishonesty. After release from prison, NT1 went back into business in a similar area as that before his conviction.
• NT2 was charged with two counts of conspiracy in relation to a controversial environmental business and the obtaining of illegal surveillance. He pleaded guilty. After a short period in prison and rehabilitation, NT2 moved into an entirely unrelated business area.

NT1 and NT2 brought claims against Google, as Google’s internet search engine continued to return results that featured links to the media reports about the claimants’ criminal convictions. Both claimants claimed that the search results conveyed inaccurate information and that the details about their offending, convictions and sentences should be removed from Google search results as the information was old, out of date, irrelevant, of no public interest and an illegitimate interference with their rights. Both claimants sought compensation for Google’s conduct.

The legal framework

The claims were tried separately, but the Court released a single judgment as the issues in each were the same. The Court had to consider the legal framework, including UK and European legislation. The Court considered the claims in the context of the Data Protection Act 1998 and Directive 95/46 EC (the Data Protection Directive) but Google also referred to the GDPR as containing an express right to be forgotten. The High Court dismissed this on the basis that the events preceded enactment of the GDPR.

The Court referred extensively to the Google Spain decision. In Google Spain the European Court of Justice interpreted the Data Protection Directive and the Charter of Fundamental Rights of the European Union 2000/C 364/01 (created to strengthen fundamental rights such as respect for private life, protection of personal data and freedom of expression and information) as creating a qualified right to be forgotten.

The application of the legal framework to both claims highlights the fact-specific nature of a claim for a right to be forgotten.

NT1’s claim for delisting and damages failed. The Court found that NT1 was a public figure as a businessman and therefore the crime and sentencing information was not private as it was information about a business crime, its prosecution and punishment. Publicity was provided in reports by regulators. The nature of the specific offence meant the crime and punishment were public in character and NT1 could not reasonably expect privacy at the time of his prosecution, conviction and sentencing. The information was not inaccurate in a material way and did not relate to NT1’s personal life. The Court found that any harm that was alleged to have been caused was mostly before a time when a legitimate complaint of Google’s processing of information could be made.

Perhaps most crucially though, the Court found that NT1’s business career since leaving prison made the information relevant in relation to the assessment of his honesty by members of the public. NT1 had not accepted his guilt, had misled the public and the court and showed no remorse over any of the matters. He was also still involved in the same business sector.  The continued availability of the information about his conviction therefore minimised the risk that NT1 would mislead the public again.

In contrast, NT2’s claim for delisting succeeded. The Judge concluded that the crime and punishment information was out of date and irrelevant and of no legitimate interest to users of Google to justify its continued availability. NT2 had acknowledged his guilt and expressed genuine remorse. His current business activities were entirely unrelated and in a different field. As the past offending is of little relevance to his current business activity, there was no real need for anyone to be warned about that activity. NT2 was also found to enjoy a reasonable expectation of privacy in respect of the information, with the Court giving weight to the presence of a young family in NT2’s life.

This important decision shows us that the enforcement of the right to be forgotten is fact-sensitive, particularly where criminal convictions are concerned.

It is very relevant to any company that processes data and receives a right-to-be-forgotten request. Data processors will need to ensure that each request is considered on the facts. If a public interest argument is to be used to circumnavigate the right to be forgotten, careful consideration will need to be given to whether the information or data remains in the public interest.

The case is still likely to be of relevance following the implementation of the GDPR, and Article 17. Article 17(3) excludes the right to be forgotten when exercising the freedom of expression, complying with legal obligations that require processing, or performing a task carried out in the public interest. There will undoubtedly be further discussion around what is, and is not, in the public interest.

Finally, it is worth noting neither claimant was awarded damages. This was because the Court found that Google acted reasonably. Liability was only established after consideration of difficult issues in a trial lasting several days. A finding against a data processor may not guarantee a right to compensation.

 

Contributed by Tom White, partner, Clyde & Co, London