High Court considers the Google Spain decision for the first time
1 May 2018
For much of the past decade, and with increasing regularity, internet intermediaries such as Google have been facing legal challenges which have sought to make it responsible for the content that they link, host or publish, depending on the nature of their various function. It is a challenge being faced on a global scale, from Canada1 to Australia2, Japan3 to Spain4.
And while the English courts are currently engaged in their first substantive consideration5 of the seminal judgment in Google Spain6 (the decision in NT1 & NT2 v Google LLC [2018] EWHC 799 (QB), discussed here) it is an opportune time to consider the recent judgment in Savage v Data Protection Commissioner, which stands as authority for such a consideration in this jurisdiction.
Background
Mark Savage ran as a candidate in the North County Dublin local elections in 2014. As part of his campaign he produced election literature which criticised members of the gay community who, he claimed, had been engaging in homosexual activity on Donabate beach. This material provoked a discussion thread on Reddit.com, the heading of which was“Mark Savage, North County Dublin’s homophobic candidate.” Much of the commentary criticised Mr. Savage’s opinions in a predictably colourful manner.
On 31 August 2014, Mr. Savage made a complaint to the Data Protection Commissioner on the basis that when his name was entered into Google’s search engine facility, one of the first results produced consisted of (a) the heading of the Reddit thread, reproduced word for word, appearing as the URL, (b) the web address of the Reddit page on which the discussion took place, and (c) a snippet from the thread.
The Commissioner informed Mr. Savage that he must first contact Google Ireland, seeking the voluntary de-listing of the information, which he duly did. On 21 October 2014, Google Ireland responded to Mr. Savage, rejecting his request. Mr. Savage appealed Google Ireland’s decision to the the Data Protection Commissioner, claiming that the search engine result constituted a statement of fact that he was homophobic, an allegation which he denied. As such, it should be considered to be inaccurate data for the purposes of the Data Protection Acts 1988-2003.
On 26 March 2015, the Data Protection Commissioner rejected his complaint. While basing this decision partly on Mr. Savage’s voluntary placing of himself into public life, the Commissioner also dealt with one of the primary considerations of the Data Protection Acts, namely whether the data is “accurate”. She decided that “accurate means accurate as a matter of fact, and this link remains accurate in that it represents the opinions expressed of you by a user of the relevant forum.” The Commissioner was satisfied that, by clicking on the URL link and being brought to the Reddit discussion, the user would be made aware that the statement in question was simply an expression of opinion on the part of a contributor. It was, therefore, not a verified fact for the purposes of the Acts.
Mr. Savage appealed the decision to the Circuit Court7, with Google Ireland being joined as a Notice Party. The Court considered in detail (for the first time in this jurisdiction) the seminal CJEU case of Google Spain. It overturned the Data Protection Commissioner’s decision on what it described as a “narrow premise”, namely the Commissioner’s finding that the accuracy of the link should be judged by whether it accurately represents the opinions expressed on Reddit.
In relation to the URL, the Court instead found that “it is not accurate by virtue of the fact that it is simply not clear that it is the original poster expressing his or her opinion, but rather bears the appearance of a verified fact.”8 The Court ordered that the URL be edited by Google through the insertion of quotation marks around the offending words. This, it felt, would make it clear that the offending comment was a statement of opinion.
High Court proceedings
The Data Protection Commissioner and Google appealed this decision on several points of law contending. They submitted that the Circuit Court had erred in its interpretation of the Google Spain decision, and that it had erred in law in determining that the URL was a matter of fact rather than an expression of opinion. The further claimed that the Court had erred in finding that the URL could be considered in isolation without reference to the underlying webpage linked to it by that URL.
In delivering his judgment, Mr. Justice White referred to the Google Spain decision. He noted its finding that a fair balance should be sought between the interests of internet users in obtaining information, and the data subject’s rights to private and family life under Article 7 of the Charter of Fundamental Rights, and protection of personal data under Article 8. The Court accepted the Appellants’ submissions that Google Spain was authority for the proposition that the Circuit Court judge had fallen into error by considering the search engine result in isolation, finding that such an approach was ‘incorrect in law.”9
It also accepted that the editing of the search engine result ordered by the Circuit Court was not a remedy available under the authority of Google Spain. The High Court referred to the “automated process” by which Google produces its search engine results, and found that the Order of the Circuit Court would “oblige Google to engage in an editing process not envisaged by Google Spain. The only responsibility placed on the data controller by that judgment is to delist the search once appropriate criteria was considered.”10
Discussion
The High Court judgment can be seen as a significant victory for Google. An upholding of the lower Court’s decision could have had major implications for the manner in which Google operates its search engines. Certain aspects of the judgment, however, merit further attention.
At the outset, it is worth drawing attention to a fundamental aspect of the decision in Google Spain. It was was considered extensively by the Data Protection Commissioner, the Circuit Court and the High Court, and is now synonymous with the so-called “Right to be Forgotten.” A central issue which distinguishes Savage from Google Spain is that while Mr. Savage sought de-listing of the Google search engine data pertaining to him because it was inaccurate, Mr. Gonzalez had no such issue with the data’s accuracy in Google Spain.
The CJEU’s landmark decision concerned Mr. Gonzalez’s claim that a reference to his previous tax difficulties, which had required attachment proceedings to be brought, was no longer relevant as his debt to the authorities had long since been settled. The information produced by Google was, per se, accurate, as it did no more than list the name and edition of a newspaper which contained an article about him. Mr. Gonzalez’s issue was that it was no longer relevant.11
Mr. Savage, on the other hand, was not looking for accurate information about him to be “forgotten”. Instead, he was looking for inaccurate information to be removed. His claim that his data protection rights were breached was based entirely on the URL produced by Google’s search engine, and his contention that it stated, as a verified fact, that he was homophobic.
It is perhaps regrettable that, as a lay litigant, Mr. Savage devoted energies on a semantic analysis of the term “homophobic” and a perception of bias against him by the Notice Party. Such a focus should not, it is suggested, have diverted the Court from a detailed consideration of the underlying issue described above.
In simple terms, Savage does not fit neatly under the “Right to be Forgotten” jurisprudence of Google Spain, and it is questionable as to why so much weight was given to the CJEU judgment. The central issue of Mr. Savage’s case was whether the result produced by Google’s search engine could be considered to be an independent processing of data for the purposes of the Act, or whether it needed to be considered in conjunction with the underlying article to which it linked. This core issue was dealt with in a relatively crisp manner in the Court’s judgment, which found that “in applying the jurisprudence of Google Spain, (it) had a duty to consider the underlying article the subject of the search … if the court had considered the underlying discussion thread it could not have come to the conclusion that it was inaccurate data and factually correct.”
While Google Spain did involve a consideration of the underlying article, it is questionable whether the CJEU’s judgment obliges a court to do so, as suggested by the High Court. In Mr. Gonzalez’s case, the underlying article was considered by the domestic courts because he had requested that both it, and the search engine link which referenced it, be deleted. Mr. Savage made no such request of the Data Commissioner, limiting his request to the correction of the search engine result.
Far from obliging a joint consideration of both the search engine result and the underlying article, it is suggested that the CJEU found in Google Spain that they could in fact be treated separately. Notwithstanding the fact that an underlying article may not fall foul of the Data Protection Directive12, a search engine result which referenced it may well do. Significantly, the CJEU stressed that:“It cannot … be ruled out that in certain circumstances the data subject is capable of exercising (the data’s subject’s right to object) against that (search engine) operator but not against the publisher of the web page.”13
Furthermore, the CJEU emphasised the influential role that search engine results have in the moulding of public opinion, and the often greater prominence they give to dissemination of information than the web page which publishes it in the first place. This suggests that search engine results may in fact be subject a heightened degree of scrutiny.14
If the High Court had found that the search engine result could be treated without reference to the underlying article, it would then have had to deal square on with the core issue of Mr. Savage’s complaint. This issue was that the snippet was clearly a statement of fact, and must therefore be considered in relation to its accuracy, or whether it was clearly a statement of opinion. This may have involved a consideration of the guidelines issued by the EU’s Article 29 Data Protection Working Party,15 which deals square on with such an issue. The guidelines suggest that “DPAs (Data Protection Authorities) recognise that some search results will contain links to content that may be part of a personal campaign against someone, consisting of ‘rants’ and perhaps unpleasant personal comments. Although the availability of such information may be hurtful and unpleasant, this does not necessarily mean that DPAs will consider it necessary to have the relevant search result de-listed. However, DPAs will be more likely to consider the de-listing of search results containing data that appears to be verified fact but that is factually inaccurate.”16
Unfortunately, the degree to which a search engine result must clearly be a link to an expression of opinion is not expanded upon, and therefore this very central issue from Savage is left unanswered. Even if this is authority for Google’s submission that links to expressions of opinion cannot be treated as inaccurate data, however, it is worth pointing out that the basis of this authority is the Article 29 Working Party Guidelines, and not the Google Spain judgment itself.
The High Court was also critical of the fact that “the learned Circuit Court Judge did not carry out any balancing tests as envisaged in the Google Spain judgment…”17 This balancing test, suggested in Google Spain and fleshed out in the Article 29 Work Party Guidelines, relates to the requirement to weigh the applicant’s right to privacy against the respondent’s right to freedom of expression. An important consideration in this test is the degree to which the applicant may have played a role in public life, which would legitimise a greater scrutiny of their opinions and beliefs.
As regards what constitutes a public figure, the Article 29 Working Party guidelines offers the definition that “Public figures are persons holding public office and/or using public resources and, more broadly speaking, all those who play a role in public life, whether in politics, the economy, the arts, the social sphere, sport or in any other domain.”18 Mr. Savage ran in a local election and, by his own admission, garnered a rather underwhelming tally of 125 first preference votes. While Google Ireland submitted that he may run again in the next election, Mr. Savage’s modest showing rather suggests that his tilt at a political career will have been a relatively short-lived one. The extent to which this makes Mr. Savage a “public figure” does not, unfortunately, appear to have been ventilated to any great degree.
Finally, it is possible to question the High Court’s finding that in Google Spain “the only responsibility placed on the data controller … is to delist the search.”19 The implication, it is suggested, is that no other course of action should be open to a claimant against Google. While delisting was the only remedy considered in Google Spain, that is surely because it was the only remedy that it was asked to consider. The judgment in Google Spain does not seem to explicitly rule out on any other form of remedy, such as altering or editing. Rather, it does not engage with any option, as it was not required to. In this regard, it should be noted that Article 12 of the Data Protection Directive, which underpins the Google Spain judgment, guarantees the right of data subjects to obtain from the data controller “as appropriate the rectification, erasure or blocking of data…”(my emphasis). The presence of the word ‘rectification’ seems to clearly suggest that editing of data, and not just its erasure, is available as a remedy.
Future considerations
The judgment in Savage is particularly interesting given the previous decisions in Australia and New Zealand, albeit in the context of cases grounded in defamation, which have considered the liability of Google for its search engine results.
The High Court stated in unequivocal fashion that “(Google) does not carry out any editing function in respect of its activities. It is an automated process where individual items of information are collated automatically and facilitate the user searching particular topics or names.”20 The courts in other jurisdictions, however, have questioned whether the manner in which Google produces such results can be considered to be truly “automated.” In 2012, the High Court in New Zealand21 tentatively questioned the potential liability of Google as a publisher for its search engine results, stating that “Whether or not search engines are “publishers” is a novel issue in New Zealand … There may be need to consider whether there is “a stamp of human intervention” in the way that the search engine programme is written…”22
More significantly, a decision by the Supreme Court of South Australia23 found Google to be the publisher of the results that its search engine produces, and questioned the degree to which such results are truly automated. “Google established the algorithm and programmes of its search engine and made that search engine available to all users of the internet. At the time of a search Google, by the mechanism of its search engine, produces the snippet paragraphs, albeit at the request of the user … Google participated in the publication of the paragraphs about Dr Duffy produced by its search engine because it intended its search engine to do what it programmed it to do.”24
A final aspect of note in Mr. Justice White’s judgment in Savage is not the finding as regards the Plaintiff’s data protection rights, but rather the off-topic comments at the end of his judgment. The Court referred to a submission made by Mr. Savage that it should consider the findings of the Australian case of Hockey v Fairfax25, in which the Plaintiff successfully argued that the contents of a Tweet, which referred to a newspaper article, was of itself defamatory without any recourse to the underlying article.26 Mr. Justice White stressed that he was not dealing with a case of defamation, and while commenting that the jurisprudence of Hockey did not reflect the law of defamation in this jurisdiction, he suggested that this“may well change in the future when the superior courts consider Tweets, or for that matter the results of search engines, in the context of the laws of defamation.”27
It will be interesting to see how long it will be before the Irish courts, as foreseen by Mr. Justice White, are called upon to deal explicitly with this contentious and fast developing area of law.
Ends.
(This article was first published in the Bar Review, April 2018. See here)
1 Equustek Solutions Inc. v. Jack, 2014 BCSC 1063
2 Google v Duffy [2017] SASCFC 130
3 Supreme Court in Japan rules on right to be forgotten, Data Protection Ireland, DPI 10 2 (17) 1 April 2017
4 Google Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos and Mario Costeja Gonzalez, Case C-131
5 NT1 v Google LLC and NT2 v Google LLC [2018] EWHC 799 (QB)
6 Google Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos and Mario Costeja Gonzalez, Case C-131
7 Pursuant to section 26 of the Data Protection Act 1988.
8 Mark Savage v Data Protection Commissioner and Google Ireland, record no. 2015/02589, at para 46.
9 Savage v Data Protection Commissioner and Google Ireland (High Court, unreported judgment of Mr. Justice White delivered 9thFebruary 2018) at para 29.
10 Ibid, at para 33.
11 By far the most common basis on which Google Spain has been considered is with regard to “spent conviction” cases, wherein the data being published by Google is sought to be delisted not because it is inaccurate, but rather because it publicises an aspect of a person’s past life which they consider no longer to be relevant. The joined cases of NT1 v Google LLC and NT2 v Google LLC fall into this category.
12 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
13 Google Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos and Mario Costeja Gonzalez, Case C-131, at para 85
14 Ibid, at para 87.
15 Guidelines on the implementation of the Court of Justice of the European Union Judgment on “Google Spain Inc v Agencia Espanola de Proteccion de datos (AEPD) and Mario Costeja Gonzalez” C-131/12 (Adopted 26thNovember 2014)
16 Ibid, Part II(5)(c)
17 Savage v Data Protection Commissioner and Google Ireland (High Court, unreported judgment of Mr. Justice White delivered 9thFebruary 2018) at para 31.
18 Guidelines on the implementation of the Court of Justice of the European Union Judgment on “Google Spain Inc v Agencia Espanola de Proteccion de datos (AEPD) and Mario Costeja Gonzalez” C-131/12 (Adopted 26thNovember 2014), Part II(2)
19 Savage v Data Protection Commissioner and Google Ireland (High Court, unreported judgment of Mr. Justice White delivered 9thFebruary 2018) at para 33.
20 Ibid.
21 A v Google New Zealand Ltd [2012] NZHC 2352.
22 Ibid, at 68.
23 Google v Duffy [2017] SASCFC 130
24 Ibid, at para 155
25 Hockey v Fairfax (2015) FCA 652
26 It should be stressed than in Hockey, liability for the content of the tweets in question was fixed not on Twitter, but rather on the operator of the account who had created the tweets.
27 Savage v Data Protection Commissioner and Google Ireland (High Court, unreported judgment of Mr. Justice White delivered 9thFebruary 2018) at para 34.