HomepageCommercial LawPrivate LawPublic Law & Human RightsCriminal LawEU & International LawCareers

Accessibility

Have Irlen Syndrome, or need different contrast? Click the button below for options.

Background Colours

Subscribe

Enter you email address below to subscribe to free customisable article notifications.

Alternatively, click the button below for our various RSS Feeds (available journal wide, or per section).

NT1 & NT2 v Google Pt I: The Right to be Forgotten

Article Cover Image

About The Author

Connor Griffith (Deputy Editor)

Connor is a recent law graduate from the University of Nottingham with a particular interest in the impact of technology on the law. He is now undertaking the combined LLM LPC at Nottingham Law School before beginning his training contract with Browne Jacobson LLP. Outside the law, he enjoys stand-up comedy and horror books.

[Read More]

This article is part of the 'Right to be Forgotten and Criminal Convictions' series, edited by Connor Griffith.

The ‘right to be forgotten’ is a necessary but arguably controversial mechanism that received widespread media attention following the judgment of the European Court of Justice in Google Spain [2014]. Recently, the High Court considered the extension of the right so that it applies to past criminal convictions of data subjects. In a two-part series, Connor Griffith considers the reasoning behind Warby J’s decision to extend the already controversial legal mechanism, and the distinction that was made between NT1 (who was unsuccessful in his claim) and NT2 (who was successful).

Other articles from this series are listed at the end of this article.

As society becomes more accustomed to the everyday expectations of the digital age, the law is perpetually attempting to keep up with the implications of rapidly advancing technology. An example of this was evident in the High Court's recent judgment in NT1 & NT2 v Google LLC [2018], in which Warby J considered pleas by two former convicts seeking the removal of links to websites (knowing as being 'delisted’) discussing their convictions from the list of results given when their names were entered on Google Search.

The decision in NT1 & NT2 [2018] has revived the debate over the ‘right to be forgotten’. This relatively new legal mechanism received widespread media attention following the judgment of the European Court of Justice (ECJ) in Google Spain v AEPD [2014] – as was previously discussed for Keep Calm Talk Law by Chris Bridges – and the introduction of Article 17 of the General Data Protection Regulation, which expressly provides a wider ‘right to erasure' where certain circumstances are met.

In light of this, this two-part article series will consider how the judgment in NT1 & NT2 [2018] sought to apply this right. The first article will consider exactly what the Google Spain [2014] right to be forgotten is, the facts of NT1 & NT2 [2018] and the wider duties and exemptions applicable in data protection law. The second article will undertake an in-depth evaluation of how Warby J applied the criteria from Google Spain [2014] to the facts of NT1 & NT2 [2018], in which the core reasoning of the judgment is found.

What is the Right to be Forgotten?

The ECJ in Google Spain [2014] declared that a delisting order – requiring the removal from internet search engine results of links to certain webpages – can be given where in light of the original purpose of the:

[I]nformation appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed.

The justification for this decision centres around the fact that what may once have been lawful processing of data can, over time, become ‘incompatible by virtue of it no longer being necessary’. This provides a relief against the ubiquitous nature of the internet: once something is placed online, it can be very hard to remove. The right to be forgotten recognises that we all make ‘stupid’ mistakes, and that these mistakes should not forever tarnish our social and professional lives. In short, as Suzanne Moore writesit can be seen as:

[T]he right to have a past that is not always perfect: a life, in other words.

It should be noted, as pointed out by Warby J in NT1 & NT2 [2018], that the right to be forgotten is somewhat misleadingly named. A claimant is not asking to have his past erased from public memory but is instead requesting to have specific information ‘forgotten’ in the narrow sense of being removed from the search results returned by an internet search engine.

If, for example, The Daily Telegraph published an article some 20 years ago discussing a man’s conviction of theft, a delisting order would remove links to that article on a page of search results of the man’s name, but would not (without further intervention) require the Telegraph to take down the article. One could still search for that particular article; the article would just cease to appear in a list of results when a person’s name is searched.

As such, aligning the right to be forgotten with ‘wiping the slate clean’ is misguided; rather, the slate is placed out of the limelight, providing those with genuine interest the opportunity to still find and read it, but allowing the subject of the slate to continue about their life without that information constantly hanging over them.

The (Soon to be Forgotten?) Facts

NT1

In the 1980s, NT1 established the company ‘Alpha’ in order to offer services and credit to consumers and companies in connection with property. A number of payments were made by Alpha to ‘Romeo Ltd’ and ‘Sierra Ltd’, offshore companies of which NT1 was the beneficial owner. The Inland Revenue later alleged that the invoices were deceptive and that the payments were made pursuant to a conspiracy to account falsely, with the purpose of evading tax.

NT1 was charged with participation and was convicted in the late 1990s, receiving a sentence of four years and, partially due to the dishonest nature of NT1’s actions – which is given further inspection by Warby J in the judgment – a disqualification from acting as a company director, and a costs order. At the time of his conviction, there was media reporting of these and related matters, with links to that reporting being made available by Google Search. NT1 served half his sentence in custody and was then released on licence. The sentence came to an end in the early 21st century and was spent under the Rehabilitation of Offenders Act 1974 some years later.

NT1 made his first delisting request to Google on 28 June 2014, seeking the removal of six links. Google removed one but refused to remove the remaining five. After further unsuccessful requests, NT1 brought proceedings on 2 October 2015.

NT2

NT2 was a senior executive and shareholder in ‘Delta’, a company engaged in a controversial business that was the subject of public opposition over its environmental practices resulting in protests, the involvement of local authorities and death threats being sent to NT2. NT2 hired an investigations firm to find out who was engaged in the hostile activity in order to take legal action against them. When offered the opportunity to engage in phone tapping and computer hacking for this purpose, NT2 agreed and granted authorisation to do so.

The hacking and phone tapping were later discovered by the authorities, and charges were brought. NT2 pleaded guilty at a relatively early stage and was sentenced to 6 months’ imprisonment, reduced from a starting point of 12 months due to an early plea and personal mitigation. NT2 served six weeks in custody before being released on licence. The sentence came to an end over a decade ago and the conviction later became spent. Reports on NT2’s conviction and sentence by national and local media remained online, and links continued to be returned by Google Search.

NT2’s solicitors requested the delisting of eight links on 14 April 2015, but Google rejected all eight, alleging the links in question ‘relate[d] to matters of substantial public interest to the public regarding [NT2’s] professional life’. NT2 issued proceedings on 2 October 2015.

The Aim of the Claims

Both claimants sought an order from the court which would require details about their offending, convictions and sentences to be removed from Google Search on the basis that such information is old, out of date, irrelevant, of no public interest, and/or otherwise an illegitimate interference with their rights – it is this claim with which we are most concerned. Both claimants also sought to have at least one article removed on the grounds that it contained inaccurate information, and pursued compensation for Google’s conduct in continuing to return search results disclosing such details despite complaints by the claimants.

The Issues at Stake

In considering the claims in NT1 & NT2 [2018], Warby J stated that there were two main issues to consider regarding each claimant individually:

  • Whether the claimant is entitled to have the links in question excluded from Google Search results, either-
    • because one or more of them contain personal data relating to him which are inaccurate, or
    • because for that and/or other reasons the continued listing of those links by Google involves an unjustified interference with the claimant’s data protection and/or privacy rights; and
  • If so, whether the claimant is entitled to compensation for continued listing between the time of the delisting request and judgment.

For present purposes, the consideration of whether the continued listing of those links by Google involves an unjustified interference with the claimant’s data protection and/or privacy rights is most important. This formed the group of issues dubbed ‘The Privacy Issues’, and consisted of – as well as the ‘Structure Issue’, which falls outside the scope of these articles – the following questions:

The Exemption Issue and the DPA 1998 Compliance Issue are considered below. The Google Spain [2014] Issue forms the basis of the second article on this judgment.

The Exemption Issue

Google, in an attempt to justify their refusal to remove the links to websites discussing the claimants’ convictions, sought to rely on the ‘journalism exemption’. Under Section 32(1) of the DPA 1998, personal data which is processed only for the ‘special purposes’ – journalism, literature, and art – is exempt from the data protection principles if certain criteria are met. The data protection principles of relevance in the current situation are those requiring removal of unnecessary/irrelevant data. The required criteria permit exemption if-

  • The processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
  • The data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
  • The data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

However, in relation to both NT1 and NT2, Warby J held that Google’s argument fell at the first hurdle, namely the requirement for the data to be processed ‘only for the special purposes’. Google had alleged that the processing was for the purposes of ‘journalism’, due to the reports about the convictions and sentences being published in media outlets. However, while the concept of journalism was agreed to be a ‘broad one’ which ‘extends beyond the activities of media undertakings and encompasses other activities’, Warby J indicated that the ‘concept is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions’. Indeed, to do so would ‘be to elide the concept of journalism with that of communication’.

Likewise, when considering whether processing by Google is undertaken ‘with a view to’ publication for journalistic purposes, Warby J rejected the argument that ‘the concept of journalism is apt to cover, at least in the present cases, the purpose of the service provided to internet users by Google’s search engine’. Though Section 32 of the DPA 1998 extends to processing ‘undertaken with a view to the publication [of journalistic material] by any person’, the role of Google is not ‘exclusively subsidiary, subservient, or ancillary to those’ of any publisher. Instead, Google – which obtains, indexes, stores and makes available information that is automated and governed by computer-based algorithms – does not in any way discriminate between journalistic and non-journalistic works when a user searches on its search engine. To claim, therefore, that Google’s processing of the data was purely for journalistic purposes is a fallacy, as Google’s activities clearly go beyond the definition of ‘journalism’.

As stated by Warby J:

[W]hatever the nature of the search in question, when Google responds to a search on an individual’s name by facilitating access to the journalistic content about the individual, this is purely accidental, and incidental to its larger purpose of providing automated access to third party content of whatever nature it may be…

This is a ‘commercial purpose’ which is ‘not undertaken for any of the special purposes, or “with a view to” the publication by others of the journalistic material’ within Section 32(1)(a) of the DPA 1998. As a result, Google’s attempt to rely on the journalism exception failed with regards to both claimants.

The DPA Compliance Issue

The second key point of consideration in NT1 & NT2 [2018] concerned whether Google’s processing complied with its obligations under Section 4(4) of the DPA 1998. This section sets a statutory duty on data controllers, requiring them to ‘comply with the data protection principles in relation to all personal data with respect to which he is the data controller’. These principles are listed in Schedule 1 of the DPA 1998. Of most interest for present purposes is Principle 1, which provides:

  • Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
    • at least one of the conditions in Schedule 2 is met, and
    • in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Regarding this principle, Warby J held that, as most of the personal data in the present case are ‘sensitive personal data’ – defined in Section 2 of the DPA 1998 to include, amongst others, information concerning the commission or alleged commission of any offence by the data subject, or any proceedings or sentence thereof – at least one of the conditions in Schedule 2 and Schedule 3  of the DPA 1998 must be satisfied.

Schedule 2 of the DPA 1998 can be dealt with swiftly as all sides agreed that Condition 6(1) applied to the cases of both NT1 and NT2. This requires:

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Google was held to ‘plainly have a legitimate interest in the processing of third party data in pursuit of its business’ as an internet search engine, and third parties ‘have a legitimate interest in receiving information via Google or other [internet search engines]’. Whether, on the facts of this case, the particular processing at issue was ‘necessary’ was held to call for a balancing exercise between Article 8 (the right to respect for private and family life) and Article 10 (the right to freedom of expression) of the European Convention on Human Rights, and was considered as part of The Google Spain [2014] Issue, as discussed in part two to this article series.

Regarding Schedule 3 of the DPA 1998, the only condition which was deemed satisfied was Condition 5, namely, that ‘the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject’. However, the justifications differed for NT1 and NT2.

When considering NT1, Warby J pointed to Townsend v Google Inc [2017], in which Stephens J stated that ‘legally as a consequence of the open justice principle by committing an offence [the offender] is deliberately taking steps to make the information public’. Therefore, though NT1’s offence had been committed in private, this did not matter as a person who ‘deliberately conducts himself in a criminal fashion runs the risk of apprehension, prosecution, trial, conviction, and sentence’, with publicity for what happens at a trial being ‘the ordinary consequence of the open justice principle’.

On the other hand, Condition 5 was satisfied in the case of NT2 due to NT2 – in an attempt to restore both his personal and business reputations – giving consent, at a time when his conviction was not yet deemed spent, for two articles about his conviction to be published by media outlets.

Therefore, the first principle of the DPA 1998 was deemed satisfied in relation to both NT1 and NT2. Whether the remaining principles were also satisfied was given more attention when considering the Google Spain [2014] balancing exercise, along with the extensive criteria with which Warby J undertook the balancing exercise between the claimants’ Article 8 and Article 10 ECHR.

(A Halfway) Conclusion

The Exemption Issue and DPA Compliance Issue both played contributing factors in Warby J’s analysis of The Google Spain [2014] Issue. He clarified that Google’s activity did not have a journalistic purpose in itself, thus closing a door to this broad exemption from delisting.

In his assessment of Principle 1 of the DPA 1998, Warby J identified the need to conduct a balancing exercise between the interests of the data subjects and ISEs, which he went on to conduct in The Google Spain [2014] Issue of his judgement.

This issue is of fundamental importance to in NT1 & NT2 [ 2018], having considerable implications for the scope and potential of the right to be forgotten as a whole. It will therefore be considered in detail in the second part of this article series.

For the latest articles straight to your inbox, you can subscribe for free. Alternatively, follow @KeepCalmTalkLaw on Twitter or Like us on Facebook.

Tagged: Data Protection, Privacy Law, Technology, The GDPR

Comment / Show Comments (0)

Other Articles From The Right to be Forgotten and Criminal Convictions Series

Section Pick June

Spanish Rugby in the Dock Part III: The End of the Line?

Editors' Pick Image

View More

KCTL News

An Anniversary or Two: Four Years of Keep Calm Talk Law

11th Nov 2017

Rising from the Ashes: The Return of Keep Calm Talk Law

18th Nov 2016

Two Years On, KCTL’s Legacy is Expanding

11th Nov 2015

Our First Birthday

11th Nov 2014

From Noticeboard to Broadsheet

13th Oct 2014

Twitter

Javascript must be enabled for the Twitter plugin to function. Click below to visit us on Twitter.

Free Email Subscription

Subscribe to Keep Calm Talk Law for email updates, and/or weekly roundups. You can tailor your subscription on activation. Both fields are required.

Your occupation / Career stage is used to tailor your subscription and for readership monitoring.

Uncheck this box if you do not want to receive our monthly newsletter.

By clicking the Subscribe button, you agree to our privacy policy and terms of service. Please ensure you read these in full.

Free Subscription