NT1 & NT2 v GOOGLE LLC

In the High Court of Justice Queen's Bench Division

LOGIC RESEARCH PAPER

GLOBAL DATA PROTECTION REGULATION (GDPR)

AKSH JAIN,
A-044,
S.Y.BLS. LL.B.5
(SEM IV)
In the High Court of Justice Queen's Bench Division Media and Communications List, Mr.
Justice Warby delivered the judgement in the said matter on 13th April 2018.

INTRODUCTION
The right to be forgotten is also known as the right to erasure. It gives individuals the power to
request the removal of their personal data when there is no compelling justification for its
continued processing by a company.
The right to be forgotten is, however, an elusive privilege. It more easily captures an idea than
it does a policy. An act of disremembering is impossible to enforce, but the principle has been
invoked to support personal privacy by expunging outdated, inaccurate or irrelevant
information.

FACTS
 Two separate businessmen brought cases, which were consolidated. Each case centred on
the reporting of business-related criminal convictions that were spent and over a decade
old:

 NT1 was convicted of conspiracy to commit false accounting and tax evasion; and
 NT2 pleaded guilty to conspiracy to tap phones and hack computers of environmental
activists who had made threats against him and his business.
 Both claimants requested Google remove links from searches to their names. The claims
focused on breach Article 8 of the European Convention on Human Rights (that is, right to
respect for one’s private and family life), breaches under the Data Protection Act 1998
(DPA), and the common law tort of misuse of private information. Google relied on various
arguments, including abuse of court process and the journalism exemption under the DPA.

 The f1irst claimant, NT1, who was convicted in relation to more serious offences than NT2
pleaded guilty to, failed in his claim. Justice Warby, however, found that the personal
information with regard to the second claimant’s (NT2) crime and punishment “has become
out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to
justify its continued availability”.

 The Court issued a delisting order for Google to remove the relevant data and search links
related to NT2. As Google had shown a commitment to complying with data protection
requirements and had taken reasonable care, no damages or compensation were awarded to
NT2.

Weber, Rolf H. "The right to be forgotten." More than a Pandora's Box 2 (2011)
Pino, G. (2000). "The right to personal identity in Italian private law: Constitutional interpretation and judge-
made
ISSUES

1. Were the actions an abuse of the Court’s process as amounting in substance to claims for
damage to reputation intended to outflank the limits of defamation law and the specific
provisions concerning defamation law contained in section 8 of the 1974 Act?

2. Was there information in any of the third-party publications which was inaccurate and so
gave rise to complaint under the Fourth Data Protection Principle of the 1998 Act
– “Personal data shall be accurate and, where necessary, kept up to date.” – leading to
an order to de-list?
3. Was Google entitled to rely on the exemption for journalism, literature and art provided
by section 32 of the 1998 Act?

4. Did Google’s processing comply with the Data Protection Principles as required by
section 4(4) of the 1998 Act?

5. Did Google’s processing comply with the requirements of the Google Spain case?
6. As concerns misuse of private information did each Claimant enjoy a reasonable
expectation of privacy in respect of any of the information at issue; if so, how on the facts
should the balance between rights of privacy and freedom of expression be struck?

7. If either Claimant succeeded on liability then what damages should be awarded?

COMMENTS
The case provides some useful insight on how the courts interpret the right to be forgotten,
particularly for those search providers and other controllers that, in the future, are required to
deal with delisting requests. Controllers will need to ensure their processes for reviewing
delisting requests comply with EU data protection requirements.

 The Court emphasised that the concept of journalism was broad in nature and went
beyond the activities of media undertakings, thus incorporating other activities that
have as their aim the disclosure to the public of information, opinions and ideas.
However, the Court concluded that “the concept [of journalism] is not so elastic that it
can be stretched to embrace every activity that has to do with conveying information or
opinions.”
 While the GDPR will play a prominent role in circumstances arising after 25 May 2018,
it should not be used as a reference when interpreting Google Spain or other legal
principles applying to events that take, or have taken place, prior to its effective date.
2
 The refusal to award compensation is a reminder that courts will look upon search
providers favourably where they have taken reasonable care and demonstrated
compliance with data protection laws.

Article 13 of the E-Commerce Directive 2000/31/EC and Regulation 18 of the Electronic Commerce(EC
Directive) Regulations 2002 (SI 2002/2013)
https://www.judiciary.uk/wp-content/uploads/2018/04/nt1-Nnt2-v-google-2018-Eewhc-799-QB.pdf
 GLOBAL DATA PROTECTION REGULATION (GDPR)
Regulation (EU) 2016/679 (also known as the General Data Protection Regulation ‘GDPR’)
comes into force on 25 May 2016. It replaces Directive 95/46/EC (the ‘DP Directive’) from
which the DPA emanates. Article 17 of the GDPR recognizes the Costeja judgment and
incorporates a ‘Right to Erasure’, which can be requested if certain grounds are met.
However, Warby J declined to engage with the GDPR stating “this case is being determined
in the twilight of the DP Directive regime, with the first light of the GDPR already visible on
the horizon. It seems unlikely to me that my decision will have an impact on other cases”

The right to be forgotten has an ancestor that emerged in the pre-internet era, known as
“practical obscurity”. It refers to physical data that is so difficult to access it is "practically
obscure".

Practical obscurity first came to public attention in 1979, when reporters sought the FBI rap
sheet of a man called Charles Medico, whose family business allegedly had ties to organised
crime. Their suit was taken all the way to the US Supreme Court, which ruled that that the rap
sheets weren't subject to disclosure under a Freedom of Information request. Although such
records were publicly available in court houses and government offices. They were thereby
deemed "practically obscure", and should be withheld as their release could constitute "an
unwarranted invasion of personal privacy".

Under Article 17 of the GDPR individuals have the right to have personal data erased. This is
also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain
circumstances.
Individuals have the right to have their personal data erased if:

 the personal data is no longer necessary for the purpose which you originally collected or
processed it for;
 you are relying on consent as your lawful basis for holding the data, and the individual
withdraws their consent;
 you are relying on legitimate interests as your basis for processing, the individual objects to
the processing of their data, and there is no overriding legitimate interest to continue this
processing;
 you are processing the personal data for direct marketing purposes and the individual objects
to that processing;
 you have processed the personal data unlawfully (ie in breach of the lawfulness requirement
of the 1st principle);
 you have to do it to comply with a legal obligation; or
 you have processed the personal data to offer information society services to a child.

privacylawbarrister.com/2018/04/17/nt1-nt2-v-google-llc-the-information-commissioner-intervening-2018-
ewhc-799-qb/
The GDPR will give any individual the right to request the erasure of their personal data from
anywhere in the union when there is no compelling reason for its processing. Article 17 of the
regulation outlines the different circumstances under which they can exercise the right to
erase their personal data. It should be granted if the data is no longer necessary to serve the
purposes for which it was originally processed; if the subject withdraws consent or has a
rightful objection to the processing and there are no overriding legitimate grounds for it to
continue; if it has been unlawfully processed; if it needs to be erased for compliance with a
legal obligation; or if it was collected in relation to the offer of certain information society
services.

It also includes additional requirements for the personal data of children. They will have the
right to erase data that they previously consented to provide, as they may not have fully
understood the risks at the time they gave consent. This is particularly relevant to information
posted on social networks and internet forums. If the data controller has made personal data
public and is obliged to erase it, they must take reasonable steps to inform anyone else
processing the data that the erasure has been requested.

They don't apply if the processing is necessary for exercising the right of freedom of
expression and information, for use in legal claims, for complying with legal obligations, is in
the public interest, or for some archiving that is part of scientific or historical research or
statistical purposes

In the above judgement, from a claimant and a claimant-lawyer’s point of view, the judgment
is distinctly conservative. A decision that sites/links about criminal convictions should be
delisted at the point of the conviction spent would open the floodgates to claims, backed by
conditional fee agreements against Google. A more proper basis for not awarding damages to
NT2 taking into account the judge’s criticism of the way it was pleaded might have been that
the damage suffered was minimum. Finally, as the judge eloquently explained, we are in the
twilight of the Data Protection Act 1998 and the dawn of the General Data Protection
Regulations (‘GDPR’) is nearly upon us and also said that the GDPR will come into force
from 25 May 2018. From that date, delisting requests will be founded on the GDPR.
While NT1 and NT2 will no doubt be persuasive, the underlying law is changing. The right to
be forgotten will be codified in statute as the ‘right to erasure’. In short, individuals’ data
protection rights will be strengthened.3

(September 23, 2015)Expert: Google Can Not Escape French Law on Right to Delist. Yibada.com