The High Court of England and Wales handed down judgment in the joined cases of NT 1 & NT 2 v Google LLC ([2018] EWHC 799 (QB)) April 13. The cases address the scope of a person's right to have results about them delisted by the Google search engine when no longer relevant, in line with the 2014 Court of Justice of the European Union ruling in the Google Spain case (ZD 2014, 350 m. Anm. Karg). As is well known, this so-called ‘right to be forgotten’ has subsequently been incorporated in Article 17 of the General Data Protection Regulation; however, the U.K. cases were brought and decided in accordance with the position under the 1995 Data Protection Directive. 

Both U.K. cases involved search results linking to internet publications that recorded the claimants' criminal convictions. NT1 had been convicted in the late 1990s of a serious fraud-related offense in relation to a company he had run, in which both the tax authorities and members of the public had lost significant sums of money, and for which he received a four year prison sentence. For his part, NT2 had in the early 2000s been sentenced to a six months’ imprisonment following his conviction for conspiring to intercept communications.

In each case the offenses had since become "spent," under the U.K. Rehabilitation of Offenders Act 1974 (which aims to facilitate the reintegration of ex-offenders into society), meaning that for most purposes they should be treated as never having occurred. In the light of this, and following the Google Spain ruling, the claimants applied to Google, in 2014 and 2015, respectively, to have the internet pages referring to the convictions (which appeared when searching their names) delisted. After Google declined to do comply, they then commenced the current proceedings, seeking court orders to require the delisting as well as damages for the alleged continued unlawful processing of their data after the receipt by Google of their initial requests.

In a lengthy ruling — running to 230 paragraphs — the judge, Mr. Justice Warby, was required to grapple with various complex data protection and domestic U.K. legal issues. One matter, as noted, concerned the interplay between data protection law and rules designed to assist the rehabilitation of criminal offenders. However, even prior to this, a piquant underlying problem arose. In particular, it will be recalled that in Google Spain, the CJEU found Google to be a data controller in respect of the web pages its search engine locates and lists. An extra feature of the NT1 & 2 case was that the relevant data — relating to criminal offenses — was sensitive data, within the meaning of Schedule 3 of the U.K. Data Protection Act 1998 (transposing Article 8 of the Data Protection Directive). The problem was that on its face Schedule 3 (and indeed the directive) did not appear to provide Google with a lawful basis to process such data in the first place.

Even so, all sides agreed before the Court that an interpretation of the law that prevented internet search engines from showing results relating to historic criminal offenses, whether or not "spent" was not tenable, a view supported by the Information Commissioner’s Office, which the Court allowed to intervene and make submissions. Indeed, the ICO suggested the Court might need to disapply the limiting rules on lawful sensitive data processing in the DPA 1998 as incompatible with the right of freedom of expression under the EU Charter of Fundamental Freedoms (albeit, the 1998 act here simply gives effect to the directive).

In the event, though, Mr. Justice Warby suggested a lawful basis for Google’s processing in that the claimants could be said to have made the data public (i.e., as provided in Article 8(2)(e) of the directive), as it was a foreseeable consequence of committing the offenses: If the claimants were tried and convicted, such information would be made public. This interpretation may admittedly be thought a little strained, and the question of what will happen under the GDPR (which in its Article 10 further limits the processing of criminal offense data), also remains open. 

As to the issue of whether, granted the data processing had once been lawful, Google was required to delist the relevant web pages as requested by the claimants, the Court attached great weight to guidance issued by the Article 29 Working Party following the Google Spain case. Indeed throughout several paragraphs of the judgment, Warby engaged in a detailed application of the criteria from that guidance to the specific facts of the two cases. In this regard, he rejected the argument of the claimants that, once a criminal conviction is spent, the interest in favor of the offender’s rehabilitation automatically wins out (and hence requests to delist search results showing such convictions should always be complied with).

Rather, in each case a careful assessment is needed that pays due regard to the particular facts. As the judge noted, this is the approach advocated by the WP29 guidance, which states: "EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. DPAs will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the de-listing of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis."

As a result, the High Court rejected the claim of NT1 to have his offense data delisted (it had been a serious offense, for which NT1 in the judge’s view had shown little insight or remorse, and he remained active in a business capacity), but granted NT2 the order he sought, requiring Google to delist the links adverting to his more minor conviction. In NT2’s case too, though, the Court refused to make an award of damages, holding that Google could rely on the defense (in section 13(3) of the DPA 1998) that in the circumstances it had taken reasonable care in processing the data.

Photo credit: sjiong Royal Courts of Justice, London via Flickr license