​Courts grapple with the “Right to be Forgotten”

Weeks out from the introduction of the General Data Protection Regulation, Article 17 of which places an amended version of the “right to be forgotten”, (known as the “right to erasure”) on an EU wide statutory footing, Courts on both sides of the Irish Sea are grappling with the current “right to be forgotten”, with the first cases in both Ireland and England reaching the respective High Court in each jurisdiction.

Remembering “The Right to be Forgotten”

In brief, the “right to be forgotten” was first explicitly recognised by the Court of Justice of the European Union (CJEU) in the case Google v AEPD & Costeja González.

In the Gonzalez case, the individual complained that a search of his name on Google continued to return links to decade old newspaper articles which detailed an announcement of a real estate auction following proceedings for the recovery of social security debts owed by him. As these matters had been resolved sometime previously, the individual objected to the continued indexing of the links by Google.

The Court determined that when it came to the index of search results returned on searching for an individual’s name (the web links displayed when you type a person’s name into Google/Bing/Yahoo etc), if the information displayed was “inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed” the continued indexing of some or all of the links may fall foul of the current EU wide data protection law (the Data Protection Directive) and may be liable to removal by the search engine on request by the individual, or by direction/order of the relevant national statutory/judicial authority.

The outworking of the case has allowed individuals unhappy with the information displayed by a search engine to challenge the continued indexing of the information by the search engine, if they can show the information is “inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed”.

Since May 2014, in the United Kingdom, Google has “delisted” (removed) 106,014 links, but has refused to delist 160,222, whilst in Ireland Google has delisted 5,453 and refused to delist 9,449. [1]

What then, if your request to delist is refused by the search engine?

In those circumstances, individuals can refer the matter to the Information Commissioner’s Office (or in Ireland, the Data Protection Commissioner), who can take steps to have the search engine to remove the link(s), though ultimately an individual (or the search engine) can have the matter determined by the Court.

And, as sure as night follows day, the first such cases have now made their way to the High Court in various jurisdictions, including England and Wales, and Ireland.

The Right to be Forgotten before the Courts

In Dublin, last Friday the High Court (Mr. Justice White) overturned a Circuit Court decision, and reinstated the decision of the Data Protection Commissioner, in which she had determined not to order Google to delist links to a Reddit thread in which data concerning an individual, (Mark Savage) was present. The URL of the Reddit thread described Mr. Savage, a former Independent candidate in the 2014 local elections, as a “homophobic candidate” and included within the thread was a discussion on this content, in which Mr. Savage himself had made several discussion contributions.

Despite a request from Mr. Savage, Google declined to delist the thread, on the basis that Mr. Savage was a public figure (in light of his election candidature), and his views related to his public persona. The Data Protection Commissioner agreed that Mr. Savage was a public figure, and that the data was relevant and accurate, in that it expressed the personal opinion of the author (another user of Reddit) of Mr. Savage. Whilst the Circuit Court took the view that the Data Protection Commissioner had erred in her finding, the High Court determined that the Circuit Court had not identified any serious error of law or fact in the Data Protection Commissioner’s original determination, and on that basis reinstated it.

Meanwhile, in London, this week marks the commencement of the trial in NT1 v Google LLC, (with a trial on similar legal issues, NT2 v Google LLC due to commence on 12 March). In both, the High Court (Mr. Justice Warby) will be asked to consider whether Google’s refusal to delist links concerning both individuals containing information about their previous convictions for conspiracy to account falsely (NT1), and conspiracy to intercept communications (NT2). Neither individual is a celebrity or politician, and both have been “rehabilitated” within the meaning of the Rehabilitation of Offenders Act 1974. Whilst the links at issue include links to contemporaneous media reporting of the conviction of each, the Claimants’ contention is that the time has now come for these links to be removed from the search engine results.

These cases are likely to consider a number of cutting edge legal issues, including the legal basis on which information concerning “spent” convictions can continue to be itemised and easily accessible in search results, whether a failure to delist can provide a basis in which to claim compensation against the search engine, and whether a search engine can be liable for the misuse of private information in the generation of search results.

Owing to these, and the myriad of other legal issues the cases are likely to encounter, the outcome will be keenly awaited by media organisations, privacy practitioners and those interested in how the law determines in what, if any, circumstances an individual’s history (including long forgotten “skeletons”) can follow them around ad infinitum, accessible to all at the touch of a simple smartphone search.

If you would like further information on the delisting application process, or to discuss any of the issues raised above, please contact Fergal McGoldrick.

For more information on the General Data Protection Regulation, including tips and helpful FAQs, please review our GDPR article.

[1] Accurate as at 27 February 2018 (11:52)