In its first significant decision on the right to be forgotten, the Irish High Court has recently adopted a practical approach which gives an indication as to how the law in this growing area might develop in Ireland, particularly in the context of the GDPR and the Irish Data Protection Act 2018.
The right to be forgotten allows individuals to request that information relating to them be removed from search engines where that information is inaccurate, inadequate, irrelevant or excessive.
OPINION VS FACT
In Savage v Data Protection Commissioner and Google, the Irish High Court refused to order Google to delist an online thread describing an election candidate as homophobic. As part of a campaign for local election, candidate Mark Savage produced an election leaflet describing himself as an advocate for family values and condemning "the lewd behavior of Gay Perverts cavorting in flagrante on [Donabate] beach in broad daylight." The leaflet was posted by a third party to the online discussion forum, Reddit.com under the heading "North County Dublin's homophobic candidate". Savage complained that when his name was searched on Google, the result directed users to this page. He said this was defamatory and he objected to being labelled homophobic.
The Irish High Court refused to order Google to delete the listing as the search result was not inaccurate as to fact, since it referred only to an expression of opinion. The Court made clear that, when ascertaining whether a search result represents an opinion or fact, the result must be read in the context of the underlying thread or article. Here, it was clear from the underlying discussion thread that the original post was an expression of opinion.
This practical approach will be welcomed as an earlier decision of the Circuit Court had caused concern. The Circuit Court found that there was an obligation on search engines to distinguish expressions of opinion in search results by using quotation marks or parentheses. The High Court's more practical decision reflects the fact that search engines do not exercise an editing function, but rather automatically collate information for search and retrieval purposes.
REMOVAL OF INACCURATE INFORMATION - UK POSITION
Search engines can expect, however, to be required to remove search results containing information that is inaccurate as to fact. A recent decision of the English High Court, NT1 and NT2 v Google, is a useful illustration of how a court might deal with claims of this nature. The decision is not binding on the Irish courts, but it may be persuasive.
In that case two businessmen, both with spent convictions, asked Google to delist certain articles about their convictions that they said were inaccurate and misleading. The Court ordered Google to delist an article relating to one of the men as it was misleading as to the extent of his criminality and it incorrectly suggested that he had made criminal proceeds from his crime. The Court said that information about the man's crime was out of date, irrelevant and was not of sufficient legitimate interest to internet users to justify its continued availability. The Court was influenced by the fact that there was no risk of further
offending by the man and he no longer operated in the same line of business.
However, the other businessman's attempts to require Google to delist certain articles about him failed as he was unable to prove to the Court that the information about him was inaccurate in any material way. The Court also noted that the information was still relevant in that the man was still in business, had misled the public as to his past and had shown no remorse for his behaviour. The Court took the view that the availability of the information minimised the risk that he would continue to mislead.
IMPACT OF GDPR
The General Data Protection Regulation (GDPR) which enshrines the right to be forgotten, has now been placed on a statutory footing in Ireland with the Data Protection Act 2018. While the GDPR right to be forgotten applies beyond name searches on search engines it is also subject to various restrictions under Art 17(3) of the GDPR and the Data Protection 2018, notably section 60 and potentially several other sections also.
The provisions of the GDPR and the Data Protection Act 2018 must now be considered when dealing with any "right to be forgotten" requests received after 25 May 2018. In particular, any request will have to meet one of the criteria set out in Article 17(1) of the GDPR.
A particular provision to note is that relating to the right to be forgotten in respect of children (under 16). A child has the right to require a data controller to erase any information collected about them in the context of the offer to that child of commercial online or mobile services.
The GDPR and Data Protection Act 2018 also provide for certain exceptions to the right to be forgotten, including:
- Where data is held for the purpose of exercising the right to freedom of expression and information. This includes journalistic purposes and academic, artistic or literary expression (GDPR, Art 17/DPA 2018, section 43) and will likely play a prominent role where the claimant plays a role in "public life"; and
- Where necessary and proportionate for achieving certain objectives in the public interest, such as national security and the prevention of crime (GDPR, Art 17/DPA 2018, section 60).
Organisations, particularly search engines, social media and other forms of online media, can expect to see many more requests for the removal of data in the future and the practical judgments of both the Irish and English High Courts, as well as the provisions of the GDPR and the Data Protection Act 2018, will provide some guidance in responding to these requests. However, this is clearly an area where there are going to be significant developments in case law over the next few years.
This article contains a general summary of developments and is not a complete or definitive statement of the law. Specific legal advice should be obtained where appropriate.