United Kingdom

[GB] Information Commissioner orders Google to remove links to recent news articles in search results for an individual’s name

IRIS 2015-9:1/14

Lorna Woods

School of Law, University of Essex

Following the judgment of the European Court of Justicein Google Spain (Case C-131/12) (see IRIS 2014-6/3), many people sought to take advantage of the so-called “right to be forgotten”. Google, in processing these claims, developed the practice of notifying the news sources of the decision to de-list that story in response to a search on an individual’s name. As a result, a number of news outlets then ran stories about the de-listing which included a re-iteration of the data thatin the circumstances have been accepted as out-of-date. In this regard, an individual who had successfully requested that Google remove a link to a website, which contained a report of the individual’s conviction for a minor offence, made a further request to Google that recent stories be de-listed in relation to searches on that individual’s name. Google refused on the basis that the de-listing itself was a story in the public interest, which thereby outweighed the individual’s data protection rights. The individual then complained to the Information Commissioner’s Office (the UK’s information rights authority, ICO).

The ICO confirmed that Google was a data controller for the purposes of s.1(1) Data Protection Act 1998 (DPA). As a data controller, s. 4(4) DPA required Google to comply with the ‘data protection principles’ set out in the DPA. The relevant provisions of the DPA are the first and third data protection principles. The first principle requires that data be processed fairly and lawfully, and the third that data must be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. The ICO then considered the principles developed jointly by the ICO and the other European Data Protection Authorities in the light of the Google Spain judgment (see IRIS 2015-2/3). Google did not comply with the ICO’s determination that the articles should be de-listed due to a failure to comply with the first and third data protection principles. Consequently the ICO issued an enforcement notice in respect of that decision, giving Google 35 days to comply (22 September 2015). Google may appeal, but if the notice stands, failure to comply is a criminal offence under s. 47 DPA.

In balancing the data subject’s rights with the public’s interest in knowing, the ICO highlighted the fact that the individual in question is a private individual rather than someone in public life. Further, the data concerned was ‘sensitive personal data’ within the meaning of s.2(2) DPA in that it concerned the commission of a criminal offence. Further, the information pertaining to the individual was not reasonably current, being in relation to a conviction from more than 10 years ago. The conviction, for a minor offence, was spent under the Rehabilitation of Offenders Act 1974. The re-publicising of the conviction was having a prejudicial effect on the individual concerned. While the ICO noted that there was journalistic activity involved, this did not necessitate having the story about de-listing arise in relation to the individual’s name.

So while the removal of search engine links was a matter of public interest in itself, the identity of the complainant was not. Google’s processing was contrary to the third data protection principle in that Google was processing data that was no longer relevant and was excessive in proportion to the purposes served. It was moreover unfair contrary to the first data protection principle in that the effect of the processing was having such a prejudicial effect on the individual. In its press release accompanying the enforcement notice, the ICO remarked that ‘Google was right, in its original decision, to accept that search results relating to the complainant’s historic conviction were no longer relevant and were having a negative impact on privacy. It is wrong of them to now refuse to remove newer links that reveal the same details and have the same negative impact’.