NGK v Google Inc. & Anor
Neutral Citation No: [2017] NIQB 74
Judgment: approved by the Court for handing down
(subject to editorial corrections)*
Delivered: 08/09/2017
IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND
_________
QUEEN'S BENCH DIVISION
_________
NGK
Plaintiff:
-v-
GOOGLE INC.
and
GOOGLE UK LIMITED
Defendants:
________
STEPHENS J
Introduction
This is the plaintiff's application pursuant to Order 11 Rule 1(1)(b) and (f) and Order 11 Rule 3 of the Rules of the Court of Judicature (Northern Ireland) 1980 for leave to serve notice of the writ of summons (in Form No.5 in Appendix A) out of the jurisdiction on the first defendant, Google Inc., a company incorporated in Delaware USA and with its principal place of business in Mountain View, California, USA. Google Inc. owns and operates the Google Search Service ("Google Search"). The application is based on the propositions that:
(a) The plaintiff's claim is founded on a tort and the damages were sustained, or resulted from an act committed, within the jurisdiction (Rule 1(1)(f)). The torts which are alleged to have been committed are misuse of private information, breach of confidence and breach of the Data Protection Act 1998; and/or
(b) In the action begun by the writ an injunction is sought ordering Google Inc. to do or refrain from doing anything within the jurisdiction (Rule 1(1)(b)). The injunction which is sought is to:
"restrain and prohibit the defendants and each of them by themselves or by their respective servants and agents or otherwise howsoever, from processing personal data relating to the plaintiff and from indexing or cataloguing such data in such a manner as to produce search results making reference or tending to reveal sexual offences committed by the plaintiff while a child."
In the alternative the plaintiff seeks an injunction:
"requiring the defendants and each of them to withdraw and remove personal data relating to the plaintiff, making reference to or tending to reveal sexual offences committed by the plaintiff while a child, from their data processing and indexing systems and to prevent access to such personal data in the future."
The normal procedure is for an application under Order 11 to be heard ex parte but following the observations of Horner J in Galloway v Frazer & others [2016] NIQB 7 at paragraph [96] Google Inc. appeared on the hearing of the plaintiff's application so that it became a contested hearing with evidence and submissions on behalf of both the plaintiff and Google Inc. The application for leave to serve notice of the writ out of the jurisdiction was opposed on the basis that the plaintiff has not established an arguable case that the grounds in Order 11 are made out and in the alternative that there is no serious issue to be tried. In respect of these contentions Google Inc. asserts that the facts do not establish any breach of confidence, that there is no arguable case for the plaintiff to have had any expectation of privacy, that there is no arguable case in relation to breach of the Data Protection 1998 and that the injunction gateway is not available to the plaintiff. Google Inc. also contend that it is an information society service ("an ISS") under the Electronic Commerce (EC Directive) Regulations 2002 ("the 2002 Regulations") and has a complete defence under those Regulations.
The application to serve out of the jurisdiction relates solely to the first defendant, Google Inc. The second defendant, Google UK Limited, is incorporated in England and Wales and is a wholly owned subsidiary of Google Inc. The second defendant contends that the plaintiff's claim against Google UK Limited is fundamentally misconceived since Google UK Limited does not own or operate Google Search. Google UK Limited contends that there is therefore no basis for a claim being made against it. That is not an issue to be resolved in the present application.
At an earlier stage I granted an anonymity and reporting restriction order until further order so that if the plaintiff did have privacy rights they would not be thwarted by virtue of the requirement that he had to commence these proceedings in order to vindicate those rights. By virtue of that interim order the plaintiff is referred to by the letters 'NGK' rather than by his name. The question as to whether that order will be maintained will be re-considered after this judgment.
Mr Shaw QC appeared with Mr Reel for the plaintiff and Mr Lockhart QC and Mr Scherbel-Ball appeared on behalf of Google Inc.. I am grateful for their assistance and for the meticulous presentation of the papers and authorities.
Factual background
On 31 May 2006 the plaintiff, who was then 14 years and some 2 months old, used a mobile telephone to send sexualised text messages to another boy in his class at the school which they both attended. The other boy was also aged approximately 14. The plaintiff states that he and the other boy had been sending texts to each other but that it was the plaintiff who had introduced the sexual content. The other boy's mother found the text messages and brought them to the attention of the police. The plaintiff was prosecuted for the offence of improper use of a public electronic communications network. On 18 December 2007, when he was 15 years and some 9 months old, he was convicted of that offence. A probation order was imposed. Under the Rehabilitation of Offenders (Northern Ireland) Order 1978 ("the 1978 Order") there was a one year rehabilitation period applicable to this conviction so that if the plaintiff was not convicted of a further offence during that period the conviction became a "spent" conviction. There being no subsequent conviction within that period this conviction became "spent" on 18 December 2008.
On 1 May 2007 the plaintiff then aged 15 years and approximately one month committed the offence of disorderly conduct. The plaintiff states that he has no recollection of the facts and circumstances relating to this offence. Also on 18 December 2007 he was convicted of that offence. A conditional discharge was imposed for a period of two years. That conviction became "spent" on 18 December 2009.
The plaintiff's convictions on 18 December 2007 were for offences committed when he was under 18 and he was also under 18 at the date of the convictions. Discretionary reporting restrictions in the Magistrates and Crown Courts under Article 22(1) and automatic reporting restrictions in the Youth Court under Article 22(2) of the Criminal Justice (Children) (Northern Ireland) Order 1988 (as amended) only apply where an individual is under 18 when they appear in court, see R(JC and another) v Central Criminal Court [2015] 1 WLR 2865. The applicability of such reporting restrictions is not by reference to when the offence was committed. In R(JC) at paragraphs [38] – [39] and [50], the Court stated that the purpose of such reporting restrictions was to protect young people from publicity during the currency of their youth, not to promote the rehabilitation of young offenders or to hide the crimes of children when they had become adults.
By virtue of the fact that the plaintiff was under 18 at the date of his conviction for these offences there would have been an automatic reporting restriction of criminal proceedings which lasted until the plaintiff turned 18. This has had the effect that there were no contemporaneous press reports of these convictions. Accordingly, entering the plaintiff's name into Google Search does not reveal these convictions. It can be seen that by virtue of the lack of a contemporaneous press report and fortuitously these convictions which are "spent" are not revealed by a Google search. These two convictions are the only criminal convictions in relation to the plaintiff which are spent.
On 1 September 2008, after he had been prosecuted and convicted on 18 December 2007 of the earlier offence committed on 31 May 2006 of sending sexualised text messages, the plaintiff then aged 16 years and some 6 months committed the offence of harassment. The plaintiff also committed the offence of harassment on 29 September 2008 and 16 October 2009 when he was aged respectfully 16 years and 6 months and 17 years and some 7 months. The plaintiff states that the facts in relation to these offences were similar to the offence committed on 31 May 2006 in that he sent text messages to another boy at his school. The boy to whom he sent the text messages was in the year below him at the school. He had got to know the boy through social media. The plaintiff states that he sent him text messages which were sexual in nature to which the other boy replied "No." Despite that reply the plaintiff continued to send him sexualised text messages. On 16 November 2010 when the plaintiff was 18 years and some 8 months he was convicted of these three offences of harassment and sentenced to detention in a Young Offenders Centre for four months though on appeal the sentence was suspended for a period of two years. Ordinarily these convictions would have been "spent" after a seven year rehabilitation period which period has not yet expired. On that basis these convictions are not spent. In addition due to further convictions for triable either way offences during the rehabilitation period it has been extended. On the basis of the plaintiff's present criminal record these convictions will not become "spent" until 20 April 2023.
The plaintiff's convictions on 16 November 2010 were for offences committed when he was under 18. However, he was over 18 at the date of his conviction.
By virtue of the fact that the plaintiff was over 18 at the date of his conviction for these offences there was no automatic reporting restriction of those criminal proceedings. This has meant that there were contemporaneous press reports of these convictions so that entering the plaintiff's name into Google Search does reveal these convictions. Fortuitously the convictions which are revealed by a Google Search are not "spent" convictions.
A Sexual Offences Prevention Order ("SOPO") was imposed which prohibited the plaintiff from possessing or using a mobile telephone or any other similar device with a sim card. On the basis of the present evidence it is not clear as to the date upon which or the circumstances in which the SOPO was imposed. The plaintiff believes that it was imposed on 16 November 2010 which was the date on which he was convicted of the offences committed on 1 September 2008, 29 September 2008 and 16 October 2009. However, his criminal record establishes that he committed the offence of breaching the SOPO on 15 October 2009. On that basis it must have been imposed on a date earlier than 15 October 2009. The SOPO could have been imposed not only as part of a sentencing exercise but also following an application to the court by the police pursuant to Section 104(5) of the Sexual Offences Act 2003. However it is agreed that a SOPO was imposed in those terms. I do not consider it necessary to determine the exact date upon which or the circumstances in which the SOPO was made. The plaintiff has breached the terms of the SOPO on numerous occasions.
The fact that the convictions on 16 November 2010 for the three offences of harassment are not "spent" can be calculated in accordance with the provisions of the 1978 Order as applied to the facts. The plaintiff was convicted on 16 November 2010 and sentenced to a period of 4 months detention. There is a seven year rehabilitation period specified in Table A of Article 6 of the 1978 Order for a sentence of imprisonment for a term not exceeding 6 months. If the plaintiff had not re-offended during the rehabilitation period for these offences, these convictions would have become "spent" on 16 November 2017. However, the plaintiff has been convicted of many further offences during the rehabilitation period for these convictions, a number of which were triable either way. As a result, these convictions will not currently become "spent" until 20 April 2023 because:
(a) on 16 November 2011, the plaintiff was convicted of the triable either way offence of breaching the SOPO, which extended the rehabilitation period for these convictions until 16 November 2018;
(b) on 22 December 2011, the plaintiff was convicted of the triable either way offence of breaching the SOPO, which extended the rehabilitation period for these convictions until 22 December 2021;
(c) on 15 June 2012, the plaintiff was convicted of the triable either way offence of breaching the SOPO, which extended the rehabilitation period for these convictions until 15 June 2022;
(d) on 24 August 2015, the plaintiff was convicted of the triable either way offence of resisting police, which extended the rehabilitation period for these convictions until 24 August 2022;
(e) on 17 February 2016, the plaintiff was convicted of the triable either way offence of fraud by false representation, which extended the rehabilitation period for these convictions until 17 February 2023; and
(f) on 20 April 2016, the plaintiff was convicted of the triable either way offence of fraud by false representation, which extended the rehabilitation period for these convictions until 20 April 2023.
As an adult the plaintiff has gone on to acquire a considerable criminal record so that by the age of 24 he has a total of 74 convictions of which only 2 are spent. In addition to the offences set out above of improper use of a public electronic communications network, disorderly behaviour and harassment, the plaintiff has 14 criminal convictions for breaching his SOPO, all of which convictions having taken place when he was aged 19 or 20. In addition in the last 5 years the plaintiff has been convicted of over 50 other offences (the most recent of these convictions being in April 2016). These include:
(a) 4 convictions for violence (assaults on police or aggravated assault on a female (who was also a police officer));
(b) 16 convictions for dishonesty (fraud);
(c) 28 convictions arising out of the plaintiff's disregard for the Court and the police (breaches of court orders, breaches of suspended sentences, resisting police, failing to register with police as a sex offender and failing to comply with notification requirements - all of which are in addition to the breaches of the SOPO); and
(d) 6 convictions for disorderly behaviour and criminal damage.
The plaintiff has received custodial sentences arising out of these convictions (including suspended sentences). He has been imprisoned on at least 2 occasions:
(a) serving four months of an eight month prison sentence starting on 15 June 2012 following convictions for harassment, breaches of the SOPO and breaches of suspended sentences; and
(b) serving a further 6 and a half weeks of a 3 month prison sentence starting on 24 August 2015 following a conviction for disorderly behaviour and resisting police.
The plaintiff has been the subject of significant press coverage as a result of both (i) his extensive and repeated criminal offending and (ii) the nature of that offending. In the last six years, the plaintiff has been the subject of at least 26 articles in newspapers across Northern Ireland. These articles identify his unspent convictions only. The estimated cumulative circulation of the newspapers in which these articles appeared is 185,968, based on circulation figures in the first half of 2012. Some of these articles included photographs of the plaintiff and his street address when reporting on his appearances in court.
Examples of the press coverage are contained in this paragraph. On 23 November 2010 there was a contemporaneous report of the plaintiff's bail application following his convictions and the imposition of a custodial sentence on 16 November 2010 under the heading "Bail for teen who sent boys sex texts". The report named the plaintiff and gave his then address. On 24 November 2011 there was a report in the Mid-Ulster Mail of the plaintiff having been given a 4 month suspended sentence for breach of the SOPO. On 19 January 2012 there was a report in the Belfast Telegraph under the hearing "Student held over breach of sexual offences order". On 26 January 2012 another report appeared in the Mid-Ulster Mail under the hearing "Magherafelt student remanded in custody for breaching sexual offences prevention order". On the same date there was a report in the Belfast Telegraph under the heading "Sex offender flouted ban on mobile use court told". The report named the plaintiff and referred to his conviction for sending obscene text messages. On 10 May 2012 the Mid-Ulster Mail published an article under the heading "Sex offender plans kids' charity event". The article stated that a man jailed for sending sexually explicit text messages to school boys is attempting to hold a fundraising night in aid of a children's charity. The article goes on to state that the plaintiff, naming him, is currently facing 13 charges of breaching a sexual offences prevention order earlier this year and that he was attempting to run the event this Sunday at a city centre nightclub in Derry. On 11 May 2012 in the Derry Journal an article appeared under the heading "Sex offender arranging charity night admits breaching SOPO." There was further press coverage on 21 June 2012 in the Mid-Ulster Mail under the heading "8 month jail sentence for sex offender." There was also further press coverage in relation to a wedding fraud scam carried out by the plaintiff together with other press reports.
The repetitive breaches by the plaintiff of the SOPO not only attracted press interest but also attracted political attention. Lord Morrow called into question the effectiveness of SOPOs. The plaintiff was the subject of questions at the Northern Ireland Assembly by Lord Morrow who highlighted the plaintiff's persistent pattern of re-offending as exemplifying how, in Lord Morrow's view, SOPOs were ineffective and inadequate as a method of preventing and deterring offending.
On 26 October 2012 the plaintiff changed his first name by deed poll in order to try to escape the publicity that had surrounded his previous criminal activity including the sex offences which he had committed when he was under the age of 18. The plaintiff had been convicted of 52 separate offences by the time he had changed his name. He has a further 22 convictions for offences committed under his new name.
On 26 July 2013 the SOPO was removed by order of Dungannon Magistrates' Court.
The plaintiff describes a particularly disturbing incident that occurred in or about 2014. He states that he was working at McDonalds at the end of Boucher Road close to the motorway and had moved into a flat on Sandy Row. He states that he was working one Sunday evening when he was spoken to by a supervisor. He told him that they had been approached by a "community representative." That this person had said that they were aware of the plaintiff's background and that he should leave the premises immediately. The plaintiff states that his supervisor told him that given the nature of the threat it was not safe for him to continue working and indeed it was not safe for him to attempt to leave the premises on foot rather he had to wait until a taxi was summoned to take him away. He was advised by his supervisor that he should stay somewhere else overnight and not return to his flat. The plaintiff states that he stayed at a friend's house and he went to his flat the next morning and found that it had been broken into and his belongings had all been damaged or destroyed. The plaintiff believes that the Google Search results and particularly search results in relation to his sexual offending whilst under 18 has led to this and other distressing incidents.
On 30 May 2014 the plaintiff requested Google Inc. to remove 12 URLs from search results produced when searching for his name. He asserted that:
"[e]ach URL says i am currently accused of several sexual offences breaches and subject to a SOPO (Sexual offences prevention order) this order was discharged on 26 July 2013 and i am no longer on the sexual offences register nor am i banned from owning a mobile phone."
On 22 November 2014, the plaintiff made a further request for Google Inc. to delist seven of the 12 previously notified URLs. He stated that:
"All the above links claim i am bound over to a SOPO which prevents me from owning, using or processing a mobile phone or sim car, This order was discharged 26/07/2013 and is now irrelevant and outdated. They all claim i am a sex offender which is inaccurate. I was convicted off harassment and not a sexual offence. The Breaches of SOPOS is for being caught with a mobile phone and ever a a sexual offence which i think is misleading also. This is effecting my education and employment opportunities and has resulted in death threats, and me being assaulted" [sic].
Google Inc. declined to de-list any of the URLs notified by the plaintiff in May 2014 on the basis that the inclusion of the news articles in Google Inc.'s Search results was still relevant and in the public interest.
Only eight of the 12 notified URLs continue to link to webpages containing content about the plaintiff. The content of these URLs is all journalistic content relating to the plaintiff's criminal activities. In particular:
(a) None of the content to which these eight URLs link identifies any of the plaintiff's "spent" convictions.
(b) Seven of these URLs link to webpages containing contemporaneous newspaper reports relating to the plaintiff's court appearances and his criminal convictions between 2010 and 2013. The newspaper content on these webpages was originally published by the Belfast Telegraph, the BBC, the Tyrone Times, the Derry Journal, and the Daily Mirror (Northern Irish edition).
(c) One of these seven URLs is a link to a third party, subscription-based search engine for online journalistic material. The link includes an extract of an article which appeared in Sunday Life on 6 October 2013. The extract does not refer to any sexual offences committed by the plaintiff. It refers only to fraud charges against the plaintiff in respect of a failed wedding venture.
(d) The eighth URL links to a webpage operated by the Women's Resource and Development Agency, a local NGO. The content at the webpage in question is a copy of the Department of Justice, Assembly Questions and Answers June 2012. It identifies only the plaintiff's unspent convictions in the Magistrates' Court in 2011. These do not include convictions for sexual offences, but they do include convictions for breaches of the SOPO, breaches of court orders and failure to comply with notification requirements, along with convictions for resisting and assaulting police, disorderly behaviour and criminal damage.
On 4 February 2016, the plaintiff's solicitors wrote to Google Inc. purporting to serve a notice under section 10 of the Data Protection Act 1998. The letter asked Google Inc. to cease processing "information relating to our client's conviction in respect of sexual offences when he was a minor." The letter asserted that Google Inc.'s processing of information in respect of this conviction had caused the plaintiff damage and distress in the form of "the harassment of our client by people who obtain the said information and consequent loss of employment by our client."
On 14 March 2016 the plaintiff commenced these proceedings.
The gateway relying on breach of confidence
Mr Shaw correctly recognised that the plaintiff's previous convictions, even if spent, could not amount to confidential information see L v Law Society [2008] EWCA Civ 811 at paragraphs [23]-[25]. Accordingly, there is no serious issue to be tried in relation to the plaintiff's claim for breach of confidence and any application to serve notice of the writ of summons out of the jurisdiction on Google Inc. under Order 11 Rule 1(1)(f) on the basis of that tort is refused.
The gateway relying on misuse of private information
The tort of misuse of private information can only come into play where it is established that any information about which complaint is made is private and the publisher knew or ought to have known that it was private; see CG v Facebook [2011] NICA 54 at paragraph [40]. There has to be a reasonable expectation of privacy in respect of the information; see In Re JR38 [2015] UKSC 42. The question of whether there is a reasonable expectation of privacy "is a broad one, which takes account of all the circumstances of the case" (see Murray v Express Newspapers [2008] EWCA Civ 446).
The information about which the plaintiff asserts he has a reasonable expectation of privacy was identified in the plaintiff's draft statement of claim as being:
(i) Details of criminal offences committed by the plaintiff in childhood.
(ii) Details of the plaintiff's change of name.
The plaintiff asserts that anyone who puts his name into Google search will find links to his childhood sexual offences and to his old name. During the course of his submissions Mr Shaw stated that the private information could be identified as the details of the sexual offences committed by the plaintiff whilst under 18 conceding that there was no expectation of privacy in the fact that the plaintiff had committed a sexual offence. However, he stated that there was an expectation of privacy in relation to the fact that the offences involved sending sexualised text messages to boys at the school which the plaintiff was attending.
The question as to whether there can be an expectation of privacy in relation to a criminal conviction was considered by the Supreme Court in R (T) v Chief Constable of Greater Manchester Police [2015] AC 49. The decision of the majority was that the point at which a conviction recedes into the past and becomes part of a person's private life will usually be the point at which it becomes "spent" under the Rehabilitation of Offenders Act 1974. In CG v Facebook [2016] NICA 54 at paragraph [43] Morgan LCJ giving the judgment of the Court of Appeal stated that:
"We agree that with the passage of time the protection of an offender by prohibiting the disclosure of previous convictions may be such as to outweigh the interests of open justice. In principle, however, the public has a right to know about such convictions. Information about what has happened in open court can be freely communicated by members of the public unless there is some compelling reason to prevent it. The open justice principle is fundamental to securing public confidence in the administration of justice and is particularly important in the criminal context where the public is concerned with the punishment and rehabilitation of the offender and the extent of the risk of harm he may present. This is, therefore, a factor of very significant weight which can only be outweighed by the interest of the individual in freedom from intrusion in the most compelling circumstances."
It can be seen that a balance has to be achieved between on the one hand open justice which includes public debate about the effectiveness of the criminal justice system and on the other hand the protection of an offender by prohibiting the disclosure of previous convictions. "Usually" the balance depends on whether the conviction is "spent" but particular facts and circumstances may take the case out of the usual either one way or the other.
In this case the convictions which have been revealed by Google Search are all convictions which are not "spent" including the sexual offences committed when the plaintiff was under 18 in relation to which he was convicted on 16 November 2010. Usually there can be no expectation of privacy in such offences which are not spent. The reason why the sexual offences are not "spent" is that the statutory rehabilitation period has not expired and it has been extended as the plaintiff is a notorious recidivist. In relation to the question as to why this case should be taken out of the usual it was submitted that the sexual offences involved particularly intrusive personal material relating to the plaintiff's sexual orientation with a disproportionate effect on the plaintiff. The fact that an offence reveals a particular sexual orientation on the part of an offender, whatever that orientation may be, is not a most compelling circumstance so as to require open justice to be outweighed by the protection of the offender. The public interest in disclosure is also demonstrated by the fact that the plaintiff has sought to associate his name with a children's charity. That charity and others like it should have access at the very least to information about his unspent sexual convictions. Also the public interest in disclosure is demonstrated by the fact that the plaintiff's recidivism has been raised as an issue of public concern in the Assembly. I do not consider that there is any disproportionate effect on the plaintiff. There is no arguable case as to an expectation of privacy in relation to the convictions which are not "spent" and this is the position regardless as to whether the expectation of privacy is articulated as in the draft statement of claim or as by Mr Shaw in submissions.
In relation to the contention that there is a reasonable expectation of privacy in relation to the plaintiff's change of name it is apparent that the plaintiff has committed 52 offences under his old name and 22 offences under his new name. Criminals frequently use aliases in order to hide from appropriate publicity. The only difference in this case is that the change of name was formalised by the use of a deed poll. However the simple and usual consequence of committing offences is that the offender's name will be public and an offender cannot avoid this by the device of changing his name either formally by deed poll or informally by adopting an alias. There is no arguable case as to an expectation of privacy in relation to the change of the plaintiff's name.
There is no serious issue to be tried in relation to the plaintiff's claim for misuse of private information and any application to serve notice of the writ of summons out of the jurisdiction on Google Inc. under Order 11 Rule 1(1)(f) on the basis of that tort is refused.
The gateway relying on breach of the Data Protection Act 1998
I have found that there is no serious issue to be tried in relation to the plaintiff's claim for misuse of private information which is a privacy tort based on Article 8 ECHR. In the alternative the plaintiff seeks to frame his case relying on the Data Protection Act 1998 ("the 1998 Act"). The plaintiff contends that the 1998 Act can be used to block access to information which does not engage his privacy rights under Article 8 ECHR which information is neither inaccurate nor untrue. The 1998 Act is a privacy Act based on a European Directive informed by both the Charter of Fundamental Rights of the European Union ("the Charter") and the European Convention of Human Rights ("ECHR"). It would be surprising if the result was different under the 1998 Act than that arrived at under the tort of misuse of private information when I have found that the plaintiff's privacy rights under Article 8 ECHR are not engaged.
Article 32 of Directive 95/46/EC on the protection of individuals with regard to the Processing of Personal Data and on the Free Movement of such Data ("the Directive") required Member States to "bring into force the laws, regulations and administrative provisions necessary to comply with this Directive …." The United Kingdom complied with Article 32 by enacting the 1998 Act.
Recital 2 of the Directive states amongst other matters that "data processing systems are designed to serve man" and that those systems "must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy …." The requirement that fundamental rights of individuals should be safeguarded is referred to in Recital 3 which also states that "personal data should be able to flow freely from one Member State to another …." Recital 7 identifies a difference between Member States in the levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data. It goes on to recite that "… this difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State."
It can be seen that the Directive secures fundamental rights of individuals notably privacy and the freedom of internet data. In Vidal-Hall & Ors v Google Inc. (Information Commissioner Intervening) [2015] 3 WLR 409 Lord Dyson MR and Sharpe LJ, with whom McFarlane LJ agreed stated at paragraph 56 that "[the] Directive as a whole is aimed at safeguarding privacy rights in the context of data management."
The basic interpretive provisions are contained in Section 1 of the 1998 Act with further interpretive provisions being contained in sections 2 and 3. As there was a measure of agreement between the parties it is not necessary to set out all the definitions of for instance data, personal data, sensitive personal data, data controller, data processor, data subject and processing. It was correctly conceded (or partially conceded) by Google Inc. that
(a) the information processed in this case falls within the definition of data as it was information being processed by means of equipment operating automatically in response to instructions given for that purpose.
(b) the information is personal data as it relates to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
(c) the information in this case is sensitive personal data as it consists of information as to the commission … by him of any offence, or any proceedings for any offence committed … by him, the disposal of such proceedings or the sentence of any court in such proceedings.
(d) Google Inc. is a data controller as it is a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed. In Google Spain SL v Agencia Espanola de Proteccion de Datos [2014] QB 10 22 at 1067 paragraph 41 the ECJ held that "the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order or preference must be classified as "processing of personal data" within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the controller" in respect of that processing, within the meaning of Article 2(d)." In Google Inc.'s skeleton argument it was contended that whilst it was accepted that, as the operator of Google Search, it is a data controller in respect of processing of personal data that to be a data controller of sensitive personal data it has to be established that it had (a) received an adequately substantiated request which gives notice of the specific URLs at which the alleged sensitive personal data appears, and (b) have had adequate time to consider the request made in relation to such sensitive personal data. I reject that contention which conflates the concept of a data controller with the defence for an ISS under the 2002 Regulations which provides that an ISS will not be liable for damages where it does not have actual knowledge of "unlawful activity or information" and is not aware of facts or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful. If it obtains such knowledge then it will not be liable if it acts expeditiously to remove or disable access to such information. I consider that Google Inc. is a data controller and that it is not appropriate to distinguish between a data controller of personal data and a data controller of sensitive personal data.
(e) Google Inc. is a data processor as it processes the data on behalf of the data controller.
(f) the plaintiff is the data subject as he is the individual who is the subject of personal data.
Section 5 of the 1998 Act provides that this Act applies to a data controller in respect of any data only if (a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment, or (b) the data controller is established neither in the United Kingdom nor in any other EEA State but uses equipment in the United Kingdom for processing the data otherwise than for the purposes of transit through the United Kingdom. Google Inc. correctly accepts that it is established in the United Kingdom for the purposes of the 1998 Act in relation to its provision of Google Search, see paragraphs 54 - 60 of Google Spain and Morgan LCJ in CG v Facebook at paragraph [74] et seq.
The obligation on the data controller to comply with the data protection principles
Section 4(4) of the 1998 Act provides, subject to certain exceptions, that it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller. The data protection principles are set out in Part I of Schedule 1 and those principles are to be interpreted in accordance with Part II of Schedule 1.
The first data protection principle
The first data protection principle is that
"personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."
The data in this case is not only personal data but it is also sensitive personal data. Accordingly, unless it can rely on an exception the data controller, Google Inc., is required not to process the data unless at least one of the conditions in Schedule 2 is met, and at least one of the conditions in Schedule 3 is also met.
The plaintiff asserts that the first data protection principle has been contravened in that Google Inc. are unable to establish that one of the conditions in Schedule 2 has been met and that one of the conditions in Schedule 3 has been met. Google Inc. contends that it has met condition 6 in Schedule 2 and condition 5 and/or condition 10 in Schedule 3.
Condition 6 in Schedule 2 provides that:
"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject." (emphasis added)
This implements Article 7 (f) of the Directive which states:
"Member States shall provide that personal data may be processed only if: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1)."
Article 1(1) of the Directive states that "in accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data."
It was correctly accepted on behalf of the plaintiff in relation to condition 6 in Schedule 2 that the legitimate interests pursued by Google Inc. would be the legitimate interests in running the business of a search engine. There is no statutory definition of the word "unwarranted" in the 1998 Act and that word does not appear in the Directive. However, it is clear from the 1998 Act that whether the processing is unwarranted is determined by whether there is prejudice to the rights and freedoms or legitimate interests of the data subject. That would include for instance the right for criminal convictions in certain circumstances to recede into the past together with a consideration of the Article 8 ECHR and Article 7 and 8 Charter rights of the data subject and the balance with Article 10 ECHR and the Article 11 Charter rights. As data protection is within the scope of EU law the relevant provisions are the provisions of the Charter. Such a balance is also clear from Articles 7 and 14(a) of the Directive. Article 14(a) is the part of the directive which was implemented by section 10 of the 1998 Act. Article 14 (a) requires Member States to grant the data subject the right (in certain circumstances) to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, …. It also requires that if there is a justified objection, the processing instigated by the controller may no longer involve those data. The use of the words "compelling legitimate grounds" and a "justified objection" require a broad consideration of the competing rights in play relating to his particular situation. I consider this to be an aid to the proper construction of the use of the word "unwarranted" in condition 6 of Schedule 2. In relation to an application to serve out of the jurisdiction it is only if the balance clearly comes down on the side of Google Inc. that there would be no serious issue to be tried.
Google Inc. contends that it has met condition 5 in Schedule 3 which provides that:
"The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject."
In considering that condition Google Inc. emphasises the breadth of the statutory definition of sensitive personal data which includes at section 2(b) political opinions. The consequence is that the political opinions of every politician fall within the definition of sensitive personal data and processing requires compliance with one of the conditions in Schedule 3. It is obvious that politicians, as data subjects, make public their political opinions so that condition 5 of Schedule 3 is satisfied. Google Inc. contend that criminals make public their criminal offences. If authority is needed for such a proposition Google Inc. rely on the judgment of Coghlin LJ delivering the judgment of the Divisional Court in R A's Application [2010] NIQB 27 at paragraphs [15] – [16] and the cases cited in those paragraphs. One of the cases cited was in Re Trinity Mirror Plc [2008] EWCA Crim 50 in which Igor Judge P stated at paragraph 32:
"In our judgment it was impossible to over-emphasis the importance to be attached to the ability of the media to report criminal trials. In simple terms this represents the embodiment of the principle of open justice in a free country. An important aspect of the public interest in the administration of criminal justice is that the identity of those convicted and sentenced for criminal offences should not be concealed. Uncomfortable though it may frequently be for the defendant that is a normal consequence of his crime. Moreover, the principle protects his interest too, by helping to secure the fair trial which, in Lord Bingham of Cornhill's memorable epithet, is the defendant's 'birthright'. From time to time occasions will arise where restrictions on this principle are considered appropriate but they will depend on express legislation and, where the court is vested with a discretion to exercise such powers, on the absolute necessity for doing so in the individual case." (emphasis added)
Relying on the principle of open justice Google Inc. contend that a normal consequence of committing a crime is that the offender makes public information in relation to his criminal activity and that condition 5 in Schedule 3 is satisfied.
It is also contended on behalf of Google Inc. that it has met condition 10 in Schedule 3 which provides that
"The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph."
The order made by the Secretary of State upon which Google Inc. rely is Data Protection (Processing of Sensitive Personal Data) Order 2000. Article 2 of that Order provides that for the purposes of paragraph 10 of Schedule 3 to the Act, the circumstances specified in any of the paragraphs in the Schedule to this Order are circumstances in which sensitive personal data may be processed. Google Inc. relies on paragraph 3 in the Schedule which states:
"3.—(1) The disclosure of personal data—
(a) is in the substantial public interest;
(b) is in connection with—
(i) the commission by any person of any unlawful act (whether alleged or established),
(ii) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person (whether alleged or established), or
(iii) mismanagement in the administration of, or failures in services provided by, any body or association (whether alleged or established);
(c) is for the special purposes as defined in section 3 of the Act; and
(d) is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.
(2) In this paragraph, "act" includes a failure to act." (emphasis added)
In particular the plaintiff contends that this exception in paragraph 3 does not apply as the disclosure of personal data is not for the special purpose of journalism.
The third and sixth data protection principles
The plaintiff also asserts that irrespective of the contravention of the first data protection principle Google Inc. has contravened the third and sixth data protection principles.
The third data protection principle is:
"Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed."
The right to be forgotten is contained within the third data protection principle that the personal data shall be adequate, relevant and not excessive. Amongst other matters this principle allows criminal convictions to recede into the past with the passage of time.
The sixth data protection principle is:
"Personal data shall be processed in accordance with the rights of data subjects under this Act."
The plaintiff accepts that the sixth principle "does not add a lot to the issues in this case."
Google Inc. denies any breach of the third and sixth principles asserting that the criminal convictions of the plaintiff should clearly not be allowed to recede into the past, that any balance under the third principle would inevitably come down in favour of Google Inc. and that it has complied with the rights of the data subject under the 1998 Act.
Data subject notice
The plaintiff also asserts that he is entitled to relief from Google Inc. by virtue of the provisions of section 10 of the 1978 Act and the data subject notice that was served on his behalf on Google Inc.
Subject to certain exceptions, section 10 contains a right to prevent processing likely to cause damage or distress. The provisions of section 10 state that:
"an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons— (a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and (b) that damage or distress is or would be unwarranted." (emphasis added)
The individual, in this case the plaintiff, has to establish not only substantial damage or substantial distress but also that the damage or distress is unwarranted. I consider that use of the word unwarranted again imports a balance between competing rights. It can be seen that a notice in writing is required from the individual ("a data subject notice"). Section 10 (3) then provides that the data controller must within twenty-one days of receiving the data subject notice give the individual who gave it a written notice (a) stating that he has complied or intends to comply with the data subject notice, or (b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it. If the individual is dissatisfied with the response from the data controller then he can apply for an injunction under section 10(4) which is a discretionary remedy and for compensation under section 13. In this case the plaintiff contends that he did avail of section 10 by serving a data subject notice.
Compensation under the 1998 Act
Section 13 entitles a data subject to bring a claim for compensation. It provides that:
"(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes." (emphasis added)
Section 13 (3) also provides a defence in the following terms
"(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned."
The exception in relation to the special purpose of journalism
One of the exceptions from the data protection principles and to a data subject notice under section 10 relates to the special purpose of journalism; see sections 3 and 32 of the 1998 Act. Google Inc. contend that if there is a serious issue to be tried as to whether it has complied with the data protection principles then in the alternative it contends that the journalism exception applies to it so that it does not have to comply.
It was contended on behalf of the plaintiff that the section 32 exception does not apply to section 13 which is the right to compensation but I do not consider that it is necessary to specifically refer to section 13 in section 32. If there has been no contravention then the right to compensation does not arise. The effect of an exception is to exclude a contravention and the plaintiff has to establish a contravention in order to claim compensation under section 13.
Section 32 provides that:
"(1) Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if—
(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.
(2) Subsection (1) relates to the provisions of—
(a) the data protection principles except the seventh data protection principle,
(b) section 7,
(c) section 10,
(d) section 12, and
(e) section 14(1) to (3).
(3) In considering for the purposes of subsection (1)(b) whether the belief of a data controller that publication would be in the public interest was or is a reasonable one, regard may be had to his compliance with any code of practice which—
(a) is relevant to the publication in question, and
(b) is designated by the [F1 Secretary of State] by order for the purposes of this subsection.
(4) Where at any time ("the relevant time") in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed—
(a) only for the special purposes, and
(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller, the court shall stay the proceedings until either of the conditions in subsection (5) is met.
(5) Those conditions are—
(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or
(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.
(6) For the purposes of this Act "publish", in relation to journalistic, literary or artistic material, means make available to the public or any section of the public."
The plaintiff contends that a search engine such as Google Search is not journalism but rather it is a process of finding information published or placed on the Internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to Internet users according to a particular order of preference. An individual may search for journalistic material through a search engine and the search engine may then republish journalistic material but the plaintiff contends that this is not personal data being processed only for the special purpose of journalism. In that respect the plaintiffs relied on paragraph 85 of the decision in Google Spain which states:
"Furthermore, the processing by the publisher of a web page consisting in the publication of information relating to an individual may, in some circumstances, be carried out "solely for journalistic purposes" and thus benefit, by virtue of article 9 of Directive 95/46, from derogations from the requirements laid down by the Directive, whereas that does not appear to be so in the case of the processing carried out by the operator of a search engine. It cannot therefore be ruled out that in certain circumstances the data subject is capable of exercising the rights referred to in article 12(b) and sub-paragraph (a) of the first paragraph of article 14 of Directive 95/46 against that operator but not against the publisher of the web page." (emphasis added).
It was suggested that in this paragraph the ECJ was drawing a distinction between the individual who publishes the information on the internet who may benefit from the exception in relation to the special purpose of journalism and an internet search engine that does not appear to benefit from that exception. However, Google Inc. contend that the ECJ in this paragraph did not categorically say that a search engine does not benefit from that exception.
Google Inc. asserts that to ask the question as to whether a search engine is journalism is to ask the wrong question. Rather the enquiry should be whether the material is journalistic material. It was recognised that this was not an assertion raised by Google in the Google Spain case.
Whether a triable issue as to Google Inc.'s compliance with Condition 6 in Schedule 2
There was no suggestion that processing the data was not for the legitimate interest pursued by the data controller. The only issue was whether the processing was unwarranted in the particular case of the plaintiff by reason of prejudice to his rights and freedoms or legitimate interests. I have held that the plaintiff's privacy right under Article 8 is not engaged in relation to his unspent criminal convictions. There is a clear public interest in open justice. There is a clear right to freedom of expression. In such circumstances the processing was not unwarranted and there is no triable issue in relation to any allegation that Google Inc. has not satisfied this condition.
Whether a triable issue as to Google Inc.'s compliance with Condition 5 in Schedule 3
Condition 5 provides that "the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject." Ordinarily an offender wishes to hide his criminal activity rather than deliberately taking steps to make it public. However, legally as a consequence of the open justice principle by committing an offence he is deliberately taking steps to make the information public. I consider that there is no triable issue in relation to any allegation that Google Inc. has not satisfied this condition.
Whether a triable issue that Google Inc. has contravened the third and sixth data protection principles
The third data protection principle requires an assessment as to whether the personal data as to the plaintiff's unspent criminal convictions was adequate, relevant and not excessive. I consider that given the public interests in play and the lack of any expectation of privacy in relation to those convictions there is no triable issue in relation to any allegation that the personal data did not comply with the third data protection principle.
In relation to the sixth data protection principle it was recognised on behalf of the plaintiff that the outcome in relation to the other issues in this case would be determinative. I consider that there is no triable issue in relation to any allegation that the personal data was not processed in accordance with the rights of the data subject under the 1998 Act.
Whether a triable issue as to the plaintiff's entitlement to rely on the section 10 data subject notice
The plaintiff contends that he has sustained substantial distress due to the processing of personal data by Google Inc. in relation to his criminal convictions for sexual offences whilst under 18. The issue as to whether this distress was caused by Google Inc.'s processing of personal data or was caused by reason of the plaintiff's general notoriety would be an issue for trial. However, the plaintiff has also to establish that the distress is unwarranted which balances the competing interests. As I have indicated it is clear that the processing was not unwarranted and accordingly there is no triable issue in relation to any allegation that the plaintiff is entitled to rely on a section 10 data subject notice.
Conclusion in relation to the data protection gateway
There is no triable issue in relation to Google Inc.'s compliance with the data protection principles. There is no triable issue in relation to the section 10 data subject notice. Accordingly, there is no triable issue in relation to any breach by Google Inc. of the 1978 Act. That conclusion is reached without reliance on the special purpose of journalism exception or on any defence available to Google Inc. as an ISS under the 2002 Regulations. The application to serve notice of the Writ of Summons out of the jurisdiction on Google Inc. under Order 11 Rule 1(1)(f) on the basis of breach of the 1998 Act is refused.
The injunction gateway
In order to come within Order 11 Rule 1(1)(b) the plaintiff has to establish that in the action begun by writ an injunction is sought ordering the defendant to do or refrain from doing anything within the jurisdiction. The sub-paragraph refers to "the action" in which a particular kind of relief "an injunction" is sought. This pre-supposes the existence of a cause of action on which to found "the action" (see The Siskina [1977] 3 All ER 803 at 824 at letter (f) ). Accordingly, in order to come within Rule 1(1)(b) the injunction sought in the action has to be part of the substantive relief to which the plaintiff's cause of action entitles him and the thing that it is sought to restrain Google Inc. from doing in Northern Ireland has to amount to an invasion of some legal or equitable right belonging to the plaintiff in Northern Ireland and enforceable there by a final judgment for an injunction. The lack of a serious issue to be tried in relation to the plaintiff's causes of action has the consequence that the claim for an injunction does not fall within Rule 1(1)(b). This approach can also be discerned from the decision of the Court of Appeal in Watson & Sons v Daily Record (Glasgow) Limited [1907] 1 KB 853. Cozens-Hardy LJ delivering the judgment of the court stated that:
"If the court is satisfied that, even assuming the plaintiff to have a good cause of action, there is no reasonable probability that he will obtain an injunction, the court ought not to consider the insertion of a claim for an injunction as sufficient to justify service on a person resident out of the jurisdiction."
There has to be an assumption of a good cause of action amounting at least to a serious issue to be tried.
I have held that there is no triable issue as to the invasion of any of the plaintiff's legal or equitable rights. The application to serve notice of the Writ of Summons out of the jurisdiction on Google Inc. under Order 11 Rule 1(1)(b) on the basis that in the action begun by writ an injunction is sought is refused.
Conclusion
I refuse the plaintiff's application for leave to serve notice of the writ out of the jurisdiction on Google Inc.
I will hear counsel in relation to costs.
I will hear submissions as to whether the anonymity and reporting restriction orders should be set aside.
BAILII: