Adverse internet search results based on an individual’s name can have a negative impact on their right to privacy and have damaging consequences whether that be personal, professional or both.
It is not legitimate for search engines to return adverse results against individuals where the information is out of date, inaccurate, irrelevant or of no public interest. The adverse search results could relate to financial data, criminal convictions, past business dealings, medical records or any other records about an individual’s personal or professional life.
In certain circumstances it may be appropriate for an individual to exercise their right to be forgotten.
What is the right to be forgotten?
In the context of internet search results, the right to be forgotten is the right of an individual to request that search engine operators who are processing personal data de-list their personal data from the search results against their name.
This right was created by the European Court of Justice’s 2014 decision in Google Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) where it was held that an individual was entitled to have Google de-list information relating to an auction notice posted 16 years previously on a Spanish newspaper’s website following the individual’s bankruptcy.
NT1 & NT2 v Google LLC
Until recently the right to be forgotten had not been considered under English law and the first test case NT1 & NT2 v Google LLC  EWHC 799 was heard before the English Court earlier this year.
In short, NT1 and NT2 were individuals who had spent convictions for criminal conspiracy. Both received short custodial sentences. At the time of their convictions there was media reports and these reports remained online and links continued to be returned by a Google search of their name.
The two individuals submitted de-listing requests to Google asking for the links to be removed. Google declined and in relation to NT2 stated that the links in question related to matters of substantial public interest regarding their professional life.
The Court was asked to consider the following questions: 1) whether the record needed correcting; 2) whether the data protection or privacy rights of NT1 and NT2 extend to having their criminal past eliminated from Google search; and 3) whether NT1 and NT2 were entitled to damages.
The Court weighed up the rights of individuals in their personal and private information on the one hand and the freedom of information and expression on the other. Article 29 of the Data Protection Working Party’s Guidelines were used by the Court and these contained a number of criteria which the Court took into consideration. The criteria include (amongst others):
- Is the individual a public figure with a role in public life?
- Is the information accurate?
- Is the information relevant?
- Is the information made available for longer than necessary?
- Is the information prejudicial or harmful?
- Is the information for journalistic purpose?
- Does the data relate to a criminal offence?
In relation to NT1, the Court found that he was not entitled to have the information de-listed as he failed to produce any compelling evidence in support of the grounds he relied on. The Court held that much of the harm NT1 complained of was business-related but the information, in the opinion of the Court, remained relevant today. However, the Court found that NT2 had made the case for de-listing. The Court held that the crime and punishment information had become out of date, irrelevant and was of no sufficient legitimate interest to users of Google to justify its continued availability. As a result, there was no real need for anybody to be warned about his previous conviction. However, the Court did conclude that no damages were to be payable.
We understand that NT1 has appealed the Court’s decision and the appeal is to be heard on 11 April 2019.
NT1 & NT2 v Google LLC was heard on the eve of the coming into force of the General Data Protection Regulation (“GDPR”) but was based on the law under the Data Protection Act 1998. However, the decision is still likely to be relevant and taken into account in future cases.
The right to be forgotten as outlined in Google Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) and NT1 & NT2 v Google LLC is reinforced by the GDPR. Article 17 GDPR gives the data subject the right to obtain the erasure of personal data concerning the individual without undue delay.
The GDPR also gives individuals a number of other rights (i.e. the right of access (Article 15 GDPR), the right to rectification (Article 16 GDPR) and the right to restriction of processing (Article 18 GDPR)).
What action can I take?
If you are faced with adverse internet search results then, depending on the circumstances, it is likely that the first step would be to submit a de-listing request to the appropriate search engine. However, the appropriate course of action will depend on the facts of each case.
If the search engine refuses to de-list the information requested then you can either make an application to the Information Commissioner’s Office (ICO) or apply to Court for an order compelling the search engine to de-list the information.
Druces Dispute Resolution Team can assist in providing advice and guidance on the de-listing process and making a complaint to the ICO or applying for a Court order. For further information, please do not hesitate to contact Julian Johnstone or Christopher Louth in our Dispute Resolution Team.