News / 15-10-2019

We would be lost without Google. It gives us access to all of the articles and websites we could ever want based on a few keywords. However – what if those keywords include your name? What if the articles that appear following that search happened so long ago that you want to put it behind you? We all have access to Google. Is it possible for the world to forget when we have such a vast encyclopedia at our fingertips?

Courts in England and Wales and the European Union have been grappling with these issues in recent weeks and two important decisions have emerged:

First - on 24 September 2019, the Court of Justice of the European Union (“CJEU”) ruled on an appeal between Google Inc and Commission Nationale de l’Informatique et des Libertes (CNIL). Google won. The ruling means that if a citizen of the EU requests that search results should be removed on the basis that they are outdated or irrelevant; Google is obliged to remove the associated links from search results returned to European Union based users (note – only to European Union based users – not the world’s users).

Google raised this appeal based on its legitimate concern that a requirement for it to remove the ability for users to search content worldwide could be abused by authoritarian governments. Google’s win is not bad news for those that want to be forgotten; the organisation has been obliged for some time to remove links to private information when asked; provided that the information is no longer relevant. It does mean, unfortunately, that a user could change the location of their browser and the undesirable search results would be returned. That is a far from perfect outcome.

The right to be forgotten was first explored in a case called Google Spain v Gonzales. That decision followed a claim for the right to have personal information “delisted” and “de-indexed” to prevent the return of search results relating to a spent conviction. Pursuant to an individual’s right to a private and family life, the Court held that once the public interest in having access to certain information had been extinguished, there is no longer a justification for infringing an individual’s private and family life.

The recent “CNIL” case therefore reaffirms the position, however it also provides an indication of the limits Google are compelled to achieve. As is always the case with online publications, there is a careful balance to be achieved between freedom of expression and an individual’s privacy. Legislation can only go so far and therefore case law, such as the cases outlined above, are critical in setting out an organisation’s obligations. As Google and Facebook have become a feature in day-to-day life and have an incredibly large audience, Court decisions provide needed guidance and a clear way to enforce user rights.

The second of the important decisions occurred a few days ago on 3 October 2019. The CJEU handed down judgment following its hearing of Glawischnig-Piesczek v Facebook Ireland Limited. This case related to a post on Facebook which was harmful to an individual’s reputation. The Court held that in the event that Facebook becomes aware of the illegal nature of the post, it must remove it. That is not dissimilar to Facebook’s pledge under its Community Guidelines. The case went further, however, to say that where Facebook has knowledge of the illegal nature of a post; it must act quickly to remove or disable access to that information. The case also provided that Facebook can be ordered by a Court to remove information which is either identical or equivalent to the content of the post which has already been identified as illegal.

The judgment marks a promising shift in the online legal landscape. In a similar vein to removing returned search terms on Google; if the conduct complained of is widespread or has been shared, it is insufficient to remove the source of the issue alone. Facebook must do more and this judgment shows the judiciary’s thinking.

This is a growing area in which we can expect more civil actions to seek clarification from tech giants. It would be remiss not to briefly touch on the case of Lloyd v Google which was handed down as recently as 8 October. In this instance, Google lost. Google has been accused of using what is known as a “DoubleClick cookie.” The program’s function is to provide Google with the ability to target advertising to its users. The issue, however, is that it resulted in Google monitoring customer internet activity without consent; an act which the Court held falls foul of the data protection regime. This decision may result in damages payments to a large number of users who were effected during the relevant period between 2011 and 2012.

What impact do the CJEU decisions have on UK law? How will Brexit change that?

At the time of writing, the CJEU’s decisions are binding in the UK by virtue of section 3 of the European Communities Act 1972 (“the ECA Act”). The European Union (Withdrawal) Act 2018 provides that the ECA Act will be repealed on the day that the UK exits the EU. With that repeal, follows the CJEU’s ability to make future binding rulings in the UK.

Section 3 of the European Union (Withdrawal) Act 2018 provides that “a Court of Tribunal [of the UK] is not bound by any principles laid down, or any decisions made, on or after exit day by the European Court”.

The CJEU cases named above will therefore remain binding in the UK until distinguished, overturned or varied by a subsequent decision(s) in a domestic Court.

If you are the victim of reputational issues online, Ince can help.