NT 1 & NT 2 v Google LLC [2018] EWHC 799 (QB)

[2018] EWHC 799 (QB)Case No HQ15X04128Case No HQ15X04127IN THE HIGH COURT OF JUSTICEQUEEN'S BENCH DIVISIONMEDIA AND COMMUNICATIONS LISTVenue Royal Courts of Justice, Strand, London, WC2A 2LLDate Date: 13/04/2018
Before
MR JUSTICE WARBY
Between
NT 1- and -NT 2 ClaimantsGOOGLE LLC Defendant-and-THE INFORMATION COMMISSIONER Intervenor
Hugh Tomlinson QC & Jonathan Barnes (instructed by Carter-Ruck) for ClaimantsAntony White QC and Catrin Evans QC (instructed by Pinsent Masons LLP) for DefendantAnya Proops QC & Rupert Paines (instructed by in-house lawyers for InformationCommissioner) for IntervenorHearing Hearing dates: 27-28 February, 1, 6-7, 12, 14 March 2018
Approved JudgmentI direct that pursuant to CPR PD 39A para 6.1 no official shorthand note shall be taken of this Judgment and that copies of this version as handed down may be treated as authentic..............................MR JUSTICE WARBYMr Justice Warby :INTRODUCTION
[1]These two claims are about the “right to be forgotten” or, more accurately, the right to have personal information “delisted” or “de-indexed” by the operators of internet search engines (“ISEs”).[2]The claimants are two businessmen who were convicted of criminal offences many years ago. The defendant, (“Google”), needs little introduction. It operates an ISE called Search which has returned and continues to return search results that feature links to third-party reports about the claimants’ convictions. The claimants say that the search results convey inaccurate information about their offending. Further, and in any event, they seek orders requiring details about their offending and their convictions and sentences to be removed from Google Search results, on the basis that such information is not just old, but out of date, and irrelevant, of no public interest, and/or otherwise an illegitimate interference with their rights. They also seek compensation for Google’s conduct in continuing to return search results disclosing such details, after the claimants’ complaints were made. Google resists both claims, maintaining that the inclusion of such details in its search results was and remains legitimate.[3]This public judgment is given after the trial of both claims. In this judgment the claimants are anonymised, for reasons which will probably be obvious from this short summary of the cases, but are explained in more detail in judgments given at the PreTrial Reviews: [2018] EWHC 67 (QB) (“the First PTR Judgment”) and [2018] EWHC 261 (QB) (“the Second PTR Judgment”). In short, anonymity is required to ensure that these claims do not give the information at issue the very publicity which the claimants wish to limit. Other individuals and organisations have been given false names in this judgment for the same reason: to protect the identities of the claimants.[4]I have prepared a separate, private judgment in each case containing details that may be important to help the parties and any Court that has to review this case in future, but which tend to identify the claimants. The contents of the private judgments may not be published. That is because, whatever the outcome of these claims, it is not necessary or proportionate for the Court to place on the public record personal data which either is or may at some stage become private, and which in any event is not so generally accessible that the Court should proceed on the basis that its judgment can add nothing to the impact on the claimant. Cf L v The Law Society [2010] EWCA Civ 811 [2] (Sir Anthony Clarke MR).

THE CASES IN A NUTSHELL

[5]The essential facts of NT1’s case are that in the late 1980s and early 1990s, when he was in his thirties, he was involved with a controversial property business that dealt with members of the public. In the late 1990s, when he was in his forties, he was convicted after a trial of a criminal conspiracy connected with those business activities, and sentenced to a term of imprisonment. He was accused of but, never tried for, a separate conspiracy connected with the same business, of which some of its former staff were convicted. There was media reporting of these and related matters at that time. Links to that reporting were made available by Google Search, as were other links, including some to information on a parliamentary website. NT1 was released on licence after serving half his sentence in custody. The sentence came to an end in the early 21st century. Some years later it became a “spent” conviction, a term I shall explain. The reports remained online, and links continued to be returned by Google Search. In due course, NT1 asked Google to remove such links.[6]His first “de-listing” request was submitted to Google on 28 June 2014. It asked for the removal of six links. Google replied on 7 October 2014, agreeing to block one link, but declining to block any of the other five. NT1 asked Google to reconsider, but it stood by its position. On 26 January 2015, NT1’s solicitors wrote to Google requiring them to cease processing links to two media reports. In April 2015, Google replied with a refusal. On 2 October 2015, NT1 brought these proceedings, seeking orders for the blocking and/or erasure of links to the two media reports, an injunction to prevent Google from continuing to return such links, and financial compensation. In December 2017, NT1 expanded his claim to cover a third link, relating to a book extract covering the same subject-matter, in similar terms.[7]The facts of NT2’s case are quite separate from those of NT1. The only connections between the two cases are that their factual contours have some similarities, they raise similar issues of principle, and they have been tried one after the other with the same representation. In the early 21st century, when he was in his forties, NT2 was involved in a controversial business that was the subject of public opposition over its environmental practices. Rather more than ten years ago he pleaded guilty to two counts of conspiracy in connection with that business, and received a short custodial sentence. The conviction and sentence were the subject of reports in the national and local media at the time.NT2served some six weeks in custody before being released on licence. The sentence came to an end over ten years ago. The conviction became “spent” several years ago. The original reports remained online, and links continued to be returned by Google Search. NT2’s conviction and sentence have also been mentioned in some more recent publications about other matters, two of them being reports of interviews given by NT2. In due course, NT2 asked Google to remove such links.[8]The first de-listing request on NT2’s behalf was submitted by his solicitors on 14 April 2015. It related to eight links. Google responded promptly by email, on 23 April 2015. It declined to de-list, saying that the links in question “relate to matters of substantial public interest to the public regarding [NT2’s] professional life”. On 24 June 2015, NT2’s solicitors sent a letter of claim and on 2 October 2015 they issued these proceedings, claiming relief in respect of the same eight links as NT2 originally complained of by NT2. In the course of the proceedings, complaints about a further three links have been added to the claim. The claim advanced by NT2 therefore relates to eleven items. NT2 claims the same heads of relief as NT1.[9]The main issues in each case, stated broadly, are(1) whether the claimant is entitled to have the links in question excluded from Google Search results either (a) because one or more of them contain personal data relating to him which are inaccurate, or (b) because for that and/or other reasons the continued listing of those links by Google involves an unjustified interference with the claimant’s data protection and/or privacy rights; and(2) if so, whether the claimant is also entitled to compensation for continued listing between the time of the delisting request and judgment. Put another way, the first question is whether the record needs correcting; the second question is whether the data protection or privacy rights of these claimants extend to having shameful episodes in their personal history eliminated from Google Search; thirdly, there is the question of whether damages should be paid.[10]Those are novel questions, which have never yet been considered in this Court. They arise in a legal environment which is complex, and has developed over time. Many of the legislative provisions date back to before the advent of the internet, and well before the creation of ISEs. As often happens, statute has not kept pace with technical developments. I have however had the benefit clear and helpful submissions not only from Mr Tomlinson QC and Mr Barnes for NT1 and NT2, and Mr White QC and Ms Evans QC for Google, but also from Ms Proops QC and Mr Paines on behalf of the Information Commissioner (“ICO”), whom I allowed to intervene in the case: see the Second PTR Judgment at [9-11]. During the trial process some of the complexities that appeared to loom large at the outset have either disappeared, or receded into the background. The trial has ended with quite a large measure of agreement as to the principles I should apply, albeit not as to the answer I should reach by doing so. Mr Tomlinson and Mr White both submitted that on the facts their respective clients’ cases were “overwhelming”. I find the matter more finely balanced.[11]I have heard factual evidence from three witnesses. I heard from NT1 and NT2 themselves, and from Stephanie Caro, a “Legal Specialist” at Google. Ms Caro is not a lawyer. Her primary responsibility is to assess or oversee the assessment of delisting requests. All three witnesses gave oral evidence and were cross-examined. Ms Caro gave evidence once only. By agreement, the oral evidence she gave in the NT1 stands as her evidence in the NT2 action, in addition to her two witness statements in that case. I also have two witness statements that were undisputed, and a wealth of documentary evidence. There is, in particular, extensive historic documentation relating to the case of NT1, to which detailed reference has been made.[12]The conclusions I have reached are summarised at the end of this judgment: see [229], [230]. What follows explains the legal context, the facts in outline, and the process of reasoning by which I have arrived at my conclusions. This is inescapably a rather lengthy process. THE LEGAL FRAMEWORK 13. Ten key features

THE LEGAL FRAMEWORK

[13]It is convenient to begin by sketching in ten key features of the existing legal framework, taking the enactments and the corresponding common law developments in chronological order. They are:(1) The European Convention on Human Rights, 1951 (“the Convention”), of which the United Kingdom was a founding signatory. Of particular relevance are the qualified rights to respect for private and family life (Article 8) and freedom of expression (Article 10).(2) The European Communities Act 1972 (“the 1972 Act”), by which the United Kingdom Parliament decided that the Treaty of Rome (25 March 1957) and other constitutional instruments of what was then the European Economic Community should be given direct legal effect in the UK without further enactment. As a result, domestic law has since 1973 been subject to European Union law as contained in Directives and, later on, Regulations of the EU as interpreted by the European Court of Justice, now known as the Court of Justice of the European Union (“CJEU”). Section 3 of the 1972 Act requires UK courts to make decisions on matters of EU law “in accordance with … any relevant decision of the [CJEU]…”.(3) The Rehabilitation of Offenders Act 1974 (“the 1974 Act”) which provides by ss 1, 4 and 5 that some convictions become “spent” after the end of a specified rehabilitation period. Whether a conviction becomes spent and if so when depends on the length of the sentence. The 1974 Act contains provisions specifying the legal effects of a conviction becoming spent. Those effects are subject to certain specified exceptions and limitations.(4) Directive 95/46 EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, of 24 October 1995, aka the Data Protection Directive (or “the DP Directive”). The purposes of the DP Directive included safeguarding individuals’ fundamental rights and freedoms, notably the right to privacy, to an equivalent extent within the Member States of the EU. Provisions of particular relevance are contained in Articles 2, 6, 8, 9, 12, 14, 23 and 29.(5) The Data Protection Act 1998 (“the DPA”), enacted on 16 July 1998 in order to implement the DP Directive. Of particular relevance are DPA ss 1, 2, 4, 10, 13, 14 and 32; the first, fourth, sixth and seventh Data Protection Principles in Schedule 1; Schedule 2 paragraph 6; Schedule 3 paragraphs 5, 6(c) and 7A; and paragraph 3 of the Schedule to certain regulations made under DPA s 10, namely the Data Protection (Processing of Sensitive Personal Data) Order 2000 (SI 2000/417) (“the 2000 Order”).(6) The Human Rights Act 1998 (“the HRA”), enacted on 9 November 1998, by which the rights and freedoms enshrined in the Convention became directly enforceable before the Courts of the the United Kingdom. Sections 2 and 6 of the HRA impose on the Court duties to interpret and apply domestic legislation in accordance with the Convention Rights, and not to act incompatibly with the Convention.(7) The 2004 decisions of the House of Lords in Campbell v MGN Ltd [2004] UKHL 22 [2004] 2 AC 457 (“Campbell”) and In re S (A Child) [2004] UKHL 47 [2005] 1 AC 593 (“Re S”), in which the House recognised the development, under the influence of the HRA, of a common law right to protection against the misuse of private information, and established the methodology to be adopted in reconciling the competing demands of Articles 8 and 10 of the Convention.(8) The Charter of Fundamental Rights of the European Union 2000/C 364/01 (“the Charter”), by which the EU recognised and sought to strengthen the protection for certain fundamental rights resulting from the Convention and from constitutional instruments of the EU. Of relevance are Articles 7 (respect for private life), 8 (protection of personal data), 11 (freedom of expression and information) 16 (freedom to conduct a business) and 47 (right to an effective remedy). The Charter was proclaimed by the European Parliament in December 2000, but only took full legal effect on the entry into force of the Lisbon Treaty on 1 December 2009. Member States are required to act compatibly with the Charter when implementing EU law: Rugby Football Union v Viagogo Ltd [2012] UKSC 55 [2012] 1 WLR 3333 [26-28]. This means, among other things, that the DP Directive must be interpreted and applied in conformity with the Charter rights: Lindqvist v Aklagarkammaren I Jonkoping (C-101/01) November 6, 2003[87].(9) The May 2014 decision of the CJEU in Google Spain SL & another v Agencia Espanola de Proteccion de Datos (AEPD) and another Case C-131/12 [2014] QB 1022(“Google Spain”), in which the CJEU interpreted the DP Directive and the Charter as creating a qualified right to be forgotten. The Court went on to apply that right to the facts before it, by holding that the individual complainant was entitled to have Google de-list information of which he complained. It is this decision that prompted the original complaints by NT1 and NT2, and hundreds of thousands of other de-listing requests. Google’s evidence, contained in a “Transparency Report” is that between the Google Spain decision and 4 October 2017 – a period of some 3 ½ years - it had been asked to de-list almost 1.9m links or URLs (Universal Resource Locators).(10) Regulation (EU) 2016/679, aka the General Data Protection Regulation (“the GDPR”). This is a legislative measure of the EU enacted on 27 April 2016, with the stated purposes among others of “strengthening and setting out in detail the rights of data subjects and the obligations of those who process … personal data ...” (Recital (11)). The GDPR came into force on 25 May 2016 and will have direct effect in Member States, including the UK, from 25 May 2018. Article 17 of the GDPR is headed “Right to erasure (‘right to be forgotten’)” and is relied on by Google as a “setting out in detail” of the right, which should guide my decision.[14]Some of these points, and their relevance, need further explanation at this stage. The 1974 Act[15]This was an Act “to rehabilitate offenders who have not been reconvicted of any serious offence for periods of years.” Section 1(1) provides that in certain events a person who has been convicted of an offence “shall for the purposes of this Act be treated as a rehabilitated person in respect of the … conviction and that conviction shall for those purposes be treated as spent.” The provisions as to when those consequences follow are reasonably complex, but for present purposes it is enough to say that the key conditions are that the sentence imposed is not one which is excluded from rehabilitation under the Act; that the offender has served the sentence; and that the “rehabilitation period” that applies to the sentence has expired without the offender having another sentence passed upon him which is excluded from rehabilitation.[16]The rehabilitation periods that apply are set out in s 5 of the Act. With one immaterial exception they depend on the length of the sentence, and take effect from the end of the sentence. The scheme does not depend in any way on the nature of the offence for which the sentence was imposed. It does depend on the age of the offender; rehabilitation periods for most custodial sentences are halved for those under 18. The scheme has been modified from time to time, and differs as between England & Wales on the one hand and Scotland on the other. For the purposes of this case, it is sufficient to note the following.(1) The sentence imposed on NT1 was one of four years’ imprisonment. Under the law of England & Wales as it stood until 10 March 2014, any sentence of more than 30 months’ imprisonment was excluded altogether from rehabilitation. Amendments made by s 139 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 (“LASPO”) enlarged the range of sentences that could become spent, embracing any sentence of 48 months or less. The amendments provided for a sentence of between 30 and 48 months to become spent after 7 years.(2) The sentence imposed on NT2 was one of six months’ imprisonment. Such a sentence was always capable of becoming spent. Until 10 March 2014, the rehabilitation period for such a sentence was 7 years. The amendments introduced by LASPO reduced that period to 2 years.(3) LASPO s 141(2) provided that the 1974 Act applies “as if [these] amendments … had always had effect”. The consequence is that some old convictions, including those of NT1 and NT2, are now to be treated as having become spent before the amendment was made.[17]Section 4 of the 1974 Act is headed “Effect of rehabilitation” and begins as follows:- “(1) Subject to sections 7 and 8 below, a person who has become a rehabilitated person for the purposes of this Act in respect of a conviction shall be treated for all purposes in law as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of that conviction …” The emphasis is mine. It highlights wording of exceptional breadth that might at first sight be thought to provide a complete and ready answer to these claims. But nobody suggests that this is its effect. All parties have treated s 4(1) as embodying a legal policy to which the Court should have regard in resolving the issues before it. The weight to be given to that policy generally, and in this case in particular, is controversial. I shall come to the arguments of the parties and the ICO in these respects.[18]But I should mention at this stage a point made by Mr Tomlinson, which is that evidence to prove his clients’ offending, conviction and sentence is only before the Court by way of exception to a general rule against the admission of such evidence. Section 4(1) of the 1974 Act goes on to set out a conditional prohibition on the admission before a judicial authority of any “evidence … to prove that … [a] person has committed or been charged with or prosecuted for or convicted of or sentenced for any offence which was the subject of a spent conviction” and on any question being asked which cannot be answered without acknowledging or referring to such a conviction. This prohibition is subject to s 7. It does not apply to proceedings in which the person is a party or witness, if he consents to the admission of the evidence (s 7(2) (f)). Nor does it apply to a case in which the Court is satisfied that justice cannot be done except by admitting such evidence (s 7(3)). Mr Tomlinson’s analysis is that evidence to prove the conviction is before me by consent, though he concedes that it would otherwise have been admitted under s 7(3). It seems to me that Mr Tomlinson’s analysis is correct.[19]Google attaches importance to another of the express limitations on the statutory right to rehabilitation. Section 8 is headed “Defamation actions”. Section s 8(1) provides that the section applies to “… any action for libel or slander begun after the commencement of this Act by a rehabilitated person and founded upon the publication of any matter imputing that the plaintiff has committed or been charged with or prosecuted for or convicted of or sentenced for an offence which was the subject of a spent conviction.”[20]The section, in its current form, goes on to say as follows:
“(3) Subject to subsections (5) and (6) below, nothing in section 4(1) above shall prevent the defendant in an action to which this section applies from relying on any defence of justification or fair comment or [under section 2 or 3 of the Defamation Act 2013 which is available to him or any defence] of absolute or qualified privilege which is available to him, or restrict the matters he may establish in support of any such defence. (4) Without prejudice to the generality of subsection (3) above, where in any such action malice is alleged against a defendant who is relying on a defence of qualified privilege, nothing in section 4(1) above shall restrict the matters he may establish in rebuttal of the allegation. (5) A defendant in any such action shall not by virtue of subsection (3) above be entitled to rely upon the defence of justification [a defence under section 2 of the Defamation Act 2013] if the publication is proved to have been made with malice.”
[21]In summary, a defendant who is sued for defamation in respect of a publication imputing the commission by the claimant of a criminal offence which is the subject of a spent conviction can rely on any reporting privilege that may exist and/or on a defence of truth or honest opinion, unless the publication is proved to have been made with malice. In defamation, a conviction is conclusive proof of guilt, against a claimant: Civil Evidence Act 1968, s 13. So in any such claim the real issue will be malice, which appears to mean an irrelevant, spiteful, or improper motive: Herbage v Pressdram & Ors [1984] 1 WLR 1160 (CA). These are not defamation claims, but Google invites me to regard this aspect of the 1974 Act as also embodying an important legal policy to which I should give effect in rejecting the claimants’ claims. Some key points of data protection law[22]The DP Directive and the DPA impose duties on “data controllers”, that is to say those who make decisions about how and why “personal data” relating to “data subjects” is “processed”. “Personal data” is a broad notion, comprising a wide range of information which relates to an individual and is processed by computer. “Processing” is a very widely defined concept, encompassing almost any dealings with personal data, including holding the data and disclosing it or the information in it: see DPA s 1(1). The statutory duty imposed on a data controller by DPA s 4(4) is, subject to section 27(1), “… to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.”[23]The data protection principles are listed in DPA Schedule 1. The principles relied on by the claimants are the First, Second, Third, Fourth, Fifth and Sixth (of eight): “1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—(a) at least one of the conditions in Schedule 2 is met, and(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4. Personal data shall be accurate and, where necessary, kept up to date 5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. 6. Personal data shall be processed in accordance with the rights of data subjects under this Act.” (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.[24]The term “sensitive personal data”, which appears in the First Principle, is defined by DPA s 2 and includes:- “… personal data consisting of information as to ... the data subject [‘s] — … (e) … physical or mental health or condition … … (g) the commission or alleged commission by him of any offence, or (h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.” The claimants each contend that by returning against an internet search of his name the URLs complained of Google is and has been making available to internet users the information contained in the third party publications and thereby processing the claimant’s personal data, some or all of which is sensitive personal data within the categories set out above. The claimants contend that the processing has been carried on by Google in breach of the duty imposed by DPA s 4(4), because it is noncompliant with one or more of the six data protection principles cited above. The claimants’ case is that in breach of these principles the information returned by Google is in some respects inaccurate, and in any event “way out of date and … being maintained for far longer than is necessary for any conceivable legitimate purpose …”.[25]Google denies the allegations of breach in any event, but it relies on a carve-out from the duty imposed by DPA s 4(4). As already noted, that duty is expressed to be “subject to s 27(1)”. Section 27(1) provides that “References in any of the data protection principles or any provision of Parts II and III [of the Act] to personal data or to the processing of personal data do not include references to data or processing which by virtue of [Part III of the DPA] are exempt from that principle or other provision.” One set of exemptions provided for in Part III is to be found in s 32, headed “Journalism, literature and art”. Those three activities are defined in DPA s 2 as “the special purposes”. I shall refer to s 32 as “the Journalism Exemption”. Google’s right to rely on the Journalism Exemption is contested by the claimants, and the ICO.[26]The claimants each seek three remedies: an order for the blocking and/or erasure by Google of their personal data, an injunction to prevent its further processing, and damages.[27]The claims for blocking and/or erasure rely on DPA ss 10 and 14. Section 10 gives data subjects a right to object to processing that is likely to cause damage or distress and a corresponding right, if the data controller does not stop the processing complained of, to seek a Court order prohibiting such processing. At one stage, Google was contending that NT1’s “section 10(1) notice” was non-compliant with the statute, but Mr White has not in the end pressed that point so it is sufficient to set out the provisions relating to the Court’s powers, which are contained in s 10(4):
“If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit”
(emphasis added). This wording falls to be interpreted and applied in the light of the corresponding Article of the DP Directive, Article 14, which requires Member States to grant data subjects the right to object to what may otherwise be lawful processing “on compelling legitimate grounds relating to his particular situation”, and provides that “Where there is a justified objection, the processing … may no longer involve those data.”[28]Section 14 of the DPA provides:
“Rectification, blocking, erasure and destruction (1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.”
Neither of the claimants has claimed “rectification” of any of the data, only its blocking or erasure.[29]The wording of s 14 would seem to be narrower in scope than that of the corresponding Article of the DP Directive. Article 12(b) requires Member States to guarantee every data subject the right to obtain “as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data” (emphasis added). But any discrepancy appears to be immaterial for present purposes, as Google takes no point on it.[30]The claimants’ claim for compensation relies on s 13 of the DPA, which provides:
“13. Compensation for failure to comply with certain requirements (1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage. (2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if— (a) the individual also suffers damage by reason of the contravention, or (b) the contravention relates to the processing of personal data for the special purposes. (3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”
[31]I have placed s 13(2) in italics because, as the Court of Appeal held in Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] QB 1003, the sub-section fails effectively to implement Article 23 of the DP Directive, and has to be disapplied because it is incompatible with the Charter. Accordingly, compensation is recoverable under the DPA for non-material damage, as well as material loss. It is helpful, in view of one of the arguments I have to consider, to set out the steps in the Court of Appeal’s conclusion:
“79. … article 23 of the Directive does not distinguish between pecuniary and non-pecuniary damage. There is no linguistic reason to interpret the word “damage” in article 23 as being restricted to pecuniary damage. More importantly, for the reasons we have given such a restrictive interpretation would substantially undermine the objective of the Directive which is to protect the right to privacy of individuals with respect to the processing of their personal data. … 84. …. if interpreted literally, section 13(2) has not effectively transposed article 23 of the Directive into our domestic law. It is in these circumstances that the question arises whether it is nevertheless possible to interpret section 13(2) in a way which is compatible with article 23 so as to permit the award of compensation for distress by reason of a contravention of a requirement of the 1998 Act even in circumstances which do not satisfy the conditions set out in section 13(2) (a) or (b). … 94. We cannot … interpret section 13(2) compatibly with article 23. 95. Mr Tomlinson and Ms Proops [Counsel for the claimants and the ICO] submit that section 13(2) should be disapplied on the grounds that it conflicts with the rights guaranteed by articles 7 and 8 of the Charter. We accept their submission. … 96. Article 47 of the Charter provides: “Right to an effective remedy and to a fair trial. Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this article. 97. Article 7 provides that “Everyone has the right to respect for his or her private and family life, home and communications”
. Article 8(1) (as we have earlier noted) provides that “Everyone has the right to the protection of personal data concerning him or her”. 98. As this court stated in the Benkharbouche case [2016] QB 347, paras 69—85, (i) where there is a breach of a right afforded under EU law, article 47 of the Charter is engaged; (ii) the right to an effective remedy for breach of EU law rights provided for by article 47 embodies a general principle of EU law; (iii) (subject to exceptions which have no application in the present case) that general principle has horizontal effect; (iv) in so far as a provision of national law conflicts with the requirement for an effective remedy in article 47, the domestic courts can and must disapply the conflicting provision; and (v) the only exception to (iv) is that the court may be required to apply a conflicting domestic provision where the court would otherwise have to redesign the fabric of the legislative scheme.” Google Spain[32]The claimant was a Spanish national who wanted to remove two links on Google Search to an auction notice posted on a Spanish newspaper’s website, following his bankruptcy. He complained that the auction notice was many years out of date and was no longer relevant. When the newspaper and Google declined to remove the links to the notice, he brought a complaint to the Spanish data protection authority against the newspaper, Google, and Google Spain SL, its Spanish subsidiary.The CJEU held that Google was bound by the DP Directive because it had set up a subsidiary in an EU member state which was intended to promote and sell advertising space offered by Google Search and which orientated its activity towards the inhabitants of that state. The CJEU proceeded to hold as follows:(1) In making available information containing personal data published on the internet by third parties an entity operating an ISE is processing personal data for the purposes of the DP Directive, and is a data controller in respect of that processing, with an obligation to ensure “within the framework of its responsibilities, powers and capabilities”, that the data subject’s rights are protected in accordance with the DP Directive: see in particular [28], [33-34], [38].(2) There is a “right to be forgotten”: a data subject's fundamental rights under articles 7 and 8 of the Charter entitle them to request that information no longer be made available to the general public by means of a list of results displayed following a search made by reference to their name, and their rights may override the rights and interests of the ISE and those of the general public. It is unnecessary for the data subject to show that the inclusion of the information in the search results caused prejudice. See in particular [94], [96].(3) Upon application by a data subject a national authority or court can therefore, in an appropriate case, order the operator under Article 12(b) and/or 14(1)(a) of the DP Directive to remove, from search results displayed following a search made on a person's name, links to web pages published by third parties containing information relating to that person; this may be so, even if that name or information has not been erased beforehand or simultaneously from those web pages, and even where the publication of the information on those web pages is lawful: see in particular [81], [85], [94], [99].[33]It is worthy of note that the Court drew distinctions between the processing of information for journalistic purposes on the one hand, and its processing by ISEs on the other, suggesting that the rights of data subjects will vary accordingly. The following features of the Court’s reasoning are important:(1) The impact of processing by an ISE will tend to have a more significant impact on the privacy and data protection rights of individuals than other forms of processing. Such processing “… is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual's name, since that processing enables any Internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the Internet—information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty—and thereby to establish a more or less detailed profile of him. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important role played by the Internet and search engines in modern society, which render the information contained in such a list of results ubiquitous: see to this effect eDate Advertising GmbH v X (Joined Cases C-509/09 and C-161/10) [2012] QB 654; [2011] ECR I-10269, para 45” ([80]).”(2) ISEs did not appear to the Court to be processing information “solely for journalistic purposes”, so as to benefit from the privileges enjoyed by the latter: “… the processing by the publisher of a web page consisting in the publication of information relating to an individual may, in some circumstances, be carried out ‘solely for journalistic purposes’ and thus benefit, by virtue of Article 9 of Directive 95/46, from derogations from the requirements laid down by the directive, whereas that does not appear to be so in the case of the processing carried out by the operator of a search engine. It cannot therefore be ruled out that in certain circumstances the data subject is capable of exercising the rights referred to in Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 against that operator but not against the publisher of the web page”. ([85] emphasis added).(3) A delisting request relating may therefore be made, and upheld, in respect of “links to web pages published lawfully by third parties and containing true information in relation to him personally …” if the inclusion of those links in the list of search results returned by the ISE nonetheless “appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine” ([94], emphasis added).(4) A delisting request should be assessed by reference to the circumstances which obtain at the time when the request is made: [94], [96].[34]The Court held that the seriousness of the potential effects of listing by an ISE meant that it “cannot be justified by merely the economic interest which the operator of such an engine has in that processing”. That was a reference to Google’s rights under Article 16 of the Charter. The validity of a delisting request should be determined, said the Court, by striking “a fair balance” between “the legitimate interest of internet users potentially interested in having access” to the information and “the data subject's fundamental rights under articles 7 and 8 of the Charter”: [81]. At [81], and again at [97], the Court observed that the latter rights would “as a general rule” override not only “the economic interest of the operator of the search engine but also the interest of the general public in finding that information on a search relating to the data subject’s name”. Whether it did so in an individual case would depend however on such factors as “the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life… ”. That role might be a reason for concluding “that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question.”[35]The information complained of in Google Spain had initially been published 16 years earlier, and was drawn from the on-line archives of a part of the newspaper containing official announcements. On the facts, the CJEU held that having regard to the sensitivity of the data, and since there did not appear to be “particular reasons substantiating a preponderant interest of the public” in having access to that information “in the context of such a search”, Articles 12 and 14 of the DP Directive required the removal of the links from the list of results: [98]. The Article 29 Working Party Guidelines[36]Article 29 of the DP Directive established a Working Party on the Protection of Individuals with regard to the Processing of Personal Data (“the Working Party”). Its membership includes a representative from the regulatory authority of each Member State. The functions of the Working Party are described in Articles 29 and 30 of the DP Directive and Article 15 of Directive 2002/58/EC. In summary, it is empowered to examine and make recommendations on matters relating to data protection in the EU, and has “advisory status”. On 26 November 2014 the Working Party adopted and published “Guidelines on the Implementation of [Google Spain]”. The document falls into three parts: An Executive Summary; Part I entitled “Interpretation of the CJEU Judgment”; and Part II, entitled “List of common criteria for the handling of complaints by European data protection authorities”. I have considered all three parts of the Guidelines document.[37]The Executive Summary helpfully identifies four salient features of the Google Spain decision:
“1. Search engines as data controllers The ruling recognises that search engine operators process personal data and qualify as data controllers within the meaning of Article 2 of Directive 95/46/EC. The processing of personal data carried out in the context of the activity of the search engine must be distinguished from, and is additional to that carried out by publishers of third-party websites. 2. A fair balance between fundamental rights and interests In the terms of the Court, “in the light of the potential seriousness of the impact of this processing on the fundamental rights to privacy and data protection, the rights of the data subject prevail, as a general rule, over the economic interest of the search engine and that of internet users to have access to the personal information through the search engine”
. However, a balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life. 3. Limited impact of de-listing on the access to information In practice, the impact of the de-listing on individuals’ rights to freedom of expression and access to information will prove to be very limited. When assessing the relevant circumstances, DPAs will systematically take into account the interest of the public in having access to the information. If the interest of the public overrides the rights of the data subject, de-listing will not be appropriate. 4. No information is deleted from the original source The judgment states that the right only affects the results obtained from searches made on the basis of a person’s name and does not require deletion of the link from the indexes of the search engine altogether. That is, the original information will still be accessible using other search terms, or by direct access to the publisher’s original source.”[38]Point 2 highlights the fact that the CJEU regarded the sensitivity of the data in question as an important element in striking the balance. Point 4 explains why it may be misleading to label the right asserted by these claimants as the “right to be forgotten”. They are not asking to “be forgotten”. The first aspect of their claims asserts a right not to be remembered inaccurately. Otherwise, they are asking for accurate information about them to be “forgotten” in the narrow sense of being removed from the search results returned by an ISE in response to a search on the claimant’s name. No doubt a successful claim against Google would be applied to and by other ISEs. But it does not follow that the information at issue would have to be removed from the public record, or that a similar request would have to be complied with by a media publisher on whose website the same information appeared. In these proceedings the claimants are not asking for any such remedy. It is also worth noting here a point that I shall come back to: a successful delisting request or order in respect of a specified URL will not prevent Google returning search results containing that URL; it only means that the URL must not be returned in response to a search on the claimant’s name.[39]Part II of the Working Party’s Guideline document sets out 13 “common criteria” for the handling of complaints by data protection authorities (known in the document as “DPAs”). Each criterion is accompanied by an extensive commentary. All parties are agreed that it is this Part of the Guideline document that will be of the greatest use to me in assessing the claims. Although not all of the “common criteria” are relevant to the present cases, most of them have at least some relevance. I shall refer to the applicable criteria and relevant commentary when assessing the claims. At this stage it is useful to note the status and role of these criteria, which are explained in the Guidelines document in this way:
“... the list of common criteria which the DPAs will apply to handle the complaints, on a case-by-case basis ... should be seen as a flexible working tool which aims at helping DPAs during the decision-making processes. The criteria will be applied in accordance with the relevant national legislations. No single criterion is, in itself, determinative. The list of criteria is non-exhaustive and will evolve over time, building on the experience of DPAs.”
[40]Part II itself further explains that the criteria are based on “a first analysis of the complaints so far received from data subjects whose delisting requests were refused by the search engines”. It goes on to say that:-. “... In most cases, it appears that more than one criterion will need to be taken into account in order to reach a decision. In other words, no single criterion is, in itself, determinative. Each criterion has to be applied in the light of the principles established by the CJEU and in particular in the light of the “the interest of the general public in having access to [the] information””. The GDPR[41]Article 17 is in the following terms:
“1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e). for the establishment, exercise or defence of legal claims.”
Misuse of private information[42]The second cause of action relied on in these cases is misuse of private information. As appears from, among other cases, Campbell, McKennitt v Ash[2006] EWCA Civ 1714 [2008] QB 73 [11] and Vidal-Hall, this is a tort which emerged from the equitable wrong of breach of confidence under the influence of the HRA, and has two essential ingredients:(1) the claimant must enjoy a reasonable expectation of privacy in respect of the information in question; if that is established, the second question arises(2) in all the circumstances, must the Article 8 rights of the individual yield to the right of freedom of expression conferred on the publisher by article 10? The latter inquiry is commonly referred to as the balancing exercise. It falls to be undertaken in the way set out by Lord Steyn in Re S at [17]:
“First, neither article has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each. For convenience I will call this the ultimate balancing test.”
[43]The authorities provide numerous illustrations of this balancing process, which is of course highly fact-sensitive. The relationship between the laws of misuse of private information and data protection has been discussed on occasion. They are often considered to lead to the same conclusion, for much the same reasons: see, for instance, the Campbell v MGN Ltd litigation, Murray v Express Newspapers plc [2007] EWHC 1908 (Ch) [2008] EMLR 22; but this is not always so: see Mosley v Google Inc [2015] EWHC 59 (QB) [2015] EMLR 11[8]-[9] (Mitting J). In this case, it is agreed that both deserve consideration. Convictions, confidentiality and privacy[44]Criminal trials take place in public, and the verdicts returned and sentences imposed are public acts. Historically, it has been lawful to report these matters at the time and subsequently with the benefit of either absolute or qualified immunity from liability, at least in defamation and contempt of court. Statute has imposed or allowed for reporting restrictions in certain circumstances, either to protect privacy interests, or the due administration of justice, or both: see, eg, s 2 of the Sexual Offences Amendment Act 1992, and s 4(2) of the Contempt of Court Act 1981 (“the 1981 Act”). Subject to laws or orders of this kind, however, privileges or immunities for fair and accurate reports have existed at common law, under the Defamation Act 1952, and now the Defamation Act 1996, as well as under s 5 of the 1981 Act. Section 8 of the 1974 Act is an example of a qualified privilege or immunity.[45]The question of whether and if so when information about a conviction can count as an item of confidential information and/or an aspect of an individual’s private or family life, the use or disclosure of which may be actionable, has been considered on a number of occasions in the Courts of the United Kingdom since 1974. It has not so far been held capable of being confidential information. It is not until quite recently that there has been an acknowledgment that information of this kind can fall within the ambit of an individual’s private life.[46]In Elliott v Chief Constable of Wiltshire, (The Times, 5 December 1996), Sir Richard Scott V-C struck out a claim in breach of confidence, describing the suggestion that a conviction announced in open court could be confidential as “absurd”. In R (Pearson) v DVLA [2002] EWHC 2482 (Admin) Maurice Kay J rejected a submission that continued reference to a spent conviction on the paper driving licence of a professional lorry driver represented an interference with his rights under Article 8(1) of the Convention. The Judge held that Article 8 was not even engaged (and that if it was, the applicable regime was justified in pursuit of the legitimate public policy aim of enhancing the efficiency and effectiveness of sentencing in respect of repeat offences). The 1974 Act was held to create no more than “a limited privilege, provided not under the Convention but by domestic legislation.”[47]In L v Law Society(above)at [24]-[25]the Master of the Rolls rejected a submission that the protection afforded by the 1974 Act renders details of spent convictions confidential. At [37]-[44] he rejected a submission that the proceedings should be held in private to protect the appellant against disclosure of his “private life” within the meaning of Article 8 of the Convention. As to confidentiality, agreeing with Maurice Kay J in Pearson, Sir Anthony Clarke MR held that the Act “… does not attempt to go beyond the grant of those limited privileges to provide a right of confidentiality in respect of spent convictions. While the 1974 Act in some respects may place an individual with spent convictions in the same position as someone with no convictions, it does not do so by rendering the convictions confidential; it does so simply by putting in place a regime which protects an individual from being prejudiced by the existence of such convictions.” prejudiced by the existence of such convictions.”[48]A number of public law cases decided over the last 8 years have recognised that a conviction may, with the passage of time, so recede into the past as to become an aspect of an individual’s private life. Three cases in the Supreme Court, one in the Northern Ireland Court of Appeal, and one in the Court of Appeal of England and Wales have touched on the issue.(1) R (L) v Comr of Police for the Metropolis (Secretary of State for the Home Dept intervening) [2009] UKSC 3 [2010] 1 AC 410 (“L”) was a case about cautions. At [27] Lord Hope suggested (obiter) that Strasbourg authority showed that information about convictions “which is collected and stored in central records can fall within the scope of private life within the meaning of article 8(1), with the result that it will interfere with the applicant’s private life when it is released.” Although in one sense public information because the convictions took place in public “… As it recedes into the past, it becomes a part of the person’s private life which must be respected”.(2) R (T) v Chief Constable of Greater Manchester Police [2014] UKSC 35[2015] AC 49 (“T”) was also about cautions. As Lord Wilson said at [18], the appeals did “not relate to the disclosure of a spent conviction that will have been imposed in public”, but he referred to Lord Hope’s observation in L and adopted the suggestion of Liberty, an intervenor, that “the point at which a conviction … recedes into the past and becomes part of a person’s private life will usually be the point at which it becomes spent under the 1974 Act”. The rest of the Justices agreed at [158].(3) In Gaughran v Chief Constable for the Police Service of Northern Ireland [2015] UKSC 29[2016] AC 345 [37] the majority held that “the fact that a conviction may become spent is a potentially relevant but by no means decisive factor in considering where the balance lies”, between the privacy rights of convicted persons and the public policy justifications for retaining biometric data.(4) In CG v Facebook Ireland Ltd [2016] NICA 54 [2017] EMLR 12 [44] the NICA referred to T and agreed that with the passage of time the protection of an offender by prohibiting the disclosure of previous convictions may be such as to outweigh the interests of open justice. On the facts that information, in conjunction with other information, gave rise to a reasonable expectation of privacy. The Court held, however, that the open justice principle and the public’s right to know about convictions and have information about what happened in open court could “only be outweighed in the most compelling circumstances” by the Article 8 rights of the individual in freedom from intrusion. It is right to mention that this was a case about disclosures on Facebook in 2013 of convictions for sexual offending in 2007 for which the claimant had been sentenced to 10 years’ imprisonment. The rehabilitation regime was not in play.(5) In R(P) v Secretary of State for the Home Department [2017] EWCA Civ 321 [2017] 2 Cr App R 12 the Court of Appeal considered the lawfulness of the scheme for the disclosure of convictions, in its revised form following the Supreme Court’s decision in T. The Court concluded that the vice identified by the Supreme Court was that the scheme required the indiscriminate disclosure of convictions, without proper safeguards to allow adequate examination of the proportionality of the interference with Article 8 rights that it involved. The balance that the law requires was identified by the the Court of Appeal at [63]: the “balance between the rights of individuals to put their past behind them, and what is necessary in a democratic society”. Factors identified as relevant in striking that balance included "the nature of the offence, the disposal in the case, the time which has elapsed since the offence took place, or the relevance of the data to the employment sought”: [41].[49]So much for the potential for information about convictions to be or become confidential or private. The question of whether the common law of misuse of private information should afford reporting privileges akin to those established by the common law, and extended by statute, in defamation and contempt of court has been discussed in at least one text, which has suggested that the law would be likely to follow the same contours (see Tugendhat and Christie, The Law of Privacy and the Media, 3rd edition at paras 11.64ff). Some cases have come close to addressing the question (see not only CG but also Crossley v Newsquest (Midlands South) Ltd [2008] EWHC 3054 (QB) [58] (Eady J), citing R v Arundel Justices ex parte Westminster Press [1985] 1 WLR 708), but the issue has never arisen directly for decision by the Court in a context such as the present. The E-Commerce Directive and Regulations[50]There is one other feature of the legal landscape that I should mention, if only to clear it out of the way for the record: Directive 2000/31/EC on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, of 8 June 2000 (“the E-Commerce Directive”), and its corresponding domestic implementing legislation, The Electronic Commerce (EC Directive) Regulations 2002 (SI 2002/2013) (“the E-Commerce Regulations”). At the start of this trial it was Google’s case that the activities undertaken by Google Search amount to “caching” so that it was entitled to an exemption from any obligation to pay compensation unless and until the underlying material had been removed from the third-party website or the Court had ruled on the issue, pursuant to Article 13 of the Directive and the corresponding Regulation 18. That was disputed by the claimants and the ICO, and was to be one of the issues for resolution by me. But after hearing the ICO’s submissions on this issue Google withdrew its reliance on those provisions in this case. Mr White explained that whilst the company still considered the argument to be correct in law, it had considered in particular the submissions of Ms Proops as to the burden of regulatory oversight which Google’s legal analysis would place on the ICO. It had decided that it should give further consideration to the issue, and in particular the relationship between these provisions of the E-Commerce Directive and Regulations and s 13 of the DPA.

THE NT1 CASE The issues

[51]It is now possible to define more precisely the claims and issues. Data protection[52]The claimant contends that by operating its Search facility in such a way as to return the offending URLs Google acts as the data controller of information that is personal data relating to the claimant, and is processing such personal data within the meaning of the Directive and DPA. Accordingly, says the claimant, Google owes him the statutory duty provided for in s 4(4) of the DPA.[53]Google admits that its presentation of search results as a consequence of a search being carried out on the name of the data subject involves the processing of personal data of which it is the data controller, and that it owes this statutory duty in respect of such processing. Google makes no admissions in respect of any operations prior to presentation of search results, such as finding or indexing information. For the purposes of this action, and the claim of NT2, it is unnecessary to go further. Nor is it necessary to determine an issue raised by Google as to when its activities involve the processing of sensitive personal data. Google admits that the offending URLs contain information that falls within the categories of sensitive personal data mentioned above, and that its post-notification activities involve the processing of such data. Subject to an issue I shall come to, concerning the Journalism Exemption, Google accepts that upon receipt of a delisting request it is obliged to conduct the balancing exercise prescribed by Google Spain. As already noted, the issue that did arise as to the formal or substantive validity of NT1’s original request under s 10 of the DPA has fallen away.[54]The main issues as to liability in relation to the data protection claims can be defined under two heads as follows:(1) “The Inaccuracy Issues”. Is there information in any of the three third-party publications which is inaccurate, in breach of the Fourth Data Protection Principle, in a way or to an extent that requires or should lead the Court to grant the blocking, erasure and injunctive remedies sought?(2) “The Privacy Issues”. The arguments give rise to four inter-related questions, which it will be convenient to consider in the following[55]I can shortly summarise the issues in this respect (“the Misuse Issues”):(1) Does the claimant enjoy a reasonable expectation of privacy in respect of any of the information at issue?; if so(2) how, on the particular facts of the case, should the balance between the rights of privacy and freedom of expression be struck? Damages[56]If the claimant succeeds on liability in respect of the Inaccuracy and/or Privacy Issues, and/or misuse of private information the question arises of what damages or compensation should be awarded (“The Damages Issue”).

The Abuse Issue

[57]Logically prior to all of the above is the issue that arises from one of Google’s submissions: is this action in substance a claim to protect reputation, cast as a claim under the DPA and/or the law of misuse of private information, in an illegitimate attempt to circumvent the procedural and substantive law that applies to claims in defamation? (“The Abuse Issue”). The Abuse Issue[58]Google submits that NT1’s claims are an abuse of the Court’s process as they “amount in substance to claims for damage to reputation which are intended to outflank the limits on reputation claims in the law of defamation and section 8” of the 1974 Act. Although this is advanced as a “further reason” for dismissing the claims, it is in reality a threshold issue. If the point is sound, it should result in the dismissal of the claims.[59]At the heart of Google’s argument is the proposition that the claims are “in essence” complaints about the damage caused to NT1’s reputation by the continued availability of the URLs complained of. From that starting point, it is argued that a claimant such as NT1 has no right to by-pass the protections which the law of defamation affords to the right of freedom of expression by framing his case in a cause of action other than defamation, and using this as a vehicle for recovering essentially the same relief on the same grounds. In support of his argument, Mr White relies on some of the wellknown jurisprudence in this area, which includes Woodward v Hutchins [1977] 1 WLR 760, Gulf Oil v Page [1987] Ch 327, Lonrho v Al Fayed (No 5) [1993] 1 WLR 1489, Service Corporation International plc v Channel Four Television[1999] EMLR 83, 89, McKennitt v Ash ([42] above), Terry (previously LNS) v Persons Unknown [2010] EMLR 16 [95] and Tillery Valley Foods Ltd v Channel Four Television Corpn[2004] EWHC 1075 (Ch) [21].[60]Mr White also emphasises that on two recent occasions the Supreme Court has warned against using torts other than defamation to obtain relief that would not be available in that tort. In O (A Child) v Rhodes [2015] UKSC 32 [2016] AC 219 [111] Lord Neuberger cautioned against attempts to “extend or supplement” defamation law by resort to a different tort (in that case, intentional infliction of psychological harm). In Khuja v Times Newspapers Ltd [2017] UKSC 49 [2017] 3 WLR 351 Lord Sumption took the point further, emphasising the need for “coherence” in the law. The claimant, who had been anonymised as “PNM”, sought to prevent publication of information disclosed in open court at a criminal trial. For that purpose, he relied on the tort of misuse of private information, emphasising the impact that publication would have on private and family life, and in particular the effect on his immediate family. The Supreme Court upheld the decision of the judge at first instance and the Court of Appeal to refuse an injunction. Giving the judgment of the majority, Lord Sumption said at [34(3)]:
“A party is entitled to invoke the right of privacy to protect his reputation but, as I have explained, there is no reasonable expectation of privacy in relation to proceedings in open court. The only claim available to PNM is based on the adverse impact on his family life which will follow indirectly from the damage to his reputation. It is clear that in an action for defamation no injunction would issue to prevent the publication of a fair and accurate report of what was said about PNM in the proceedings. It would be both privileged and justified. In the context of the publication of proceedings in open court, it would be incoherent for the law to refuse an injunction to prevent damage to PNM's reputation directly, while granting it to prevent the collateral impact on his family life in precisely the same circumstances.”
[61]I am not persuaded that these high authorities, or the earlier cases I have cited, provide a justification for dismissing the claims of NT1 as an abuse of process. As a general rule, it is legitimate for a claimant to rely on any cause of action that arises or may arise from a given set of facts. This is not ordinarily considered to be an abuse just because one or more other causes of action might arise or be pursued instead of, or in addition to, the claim that is relied on. Indeed, the Supreme Court did not hold that Mr Khuja’s application was an abuse of process, but rather that it failed because he could offer nothing that would outweigh the importance of free reporting of proceedings in open court. His own reputation could not, in that context, support his claim to enjoy a reasonable expectation of privacy; although the impact on his family life could serve that purpose, it could not suffice. As Lord Sumption said at [34(2)]:
“[PNM] … is entitled to rely on the impact which publication would have on his relations with his family and their relations with the community in which he lives. I do not underestimate that impact. … But … the impact on PNM’s family life of what was said about him at the trial is no different in kind from the impact of many disagreeable statements which may be made about individuals at a high profile criminal trial … the collateral impact that this process has on those affected is part of the price to be paid for open justice and the freedom of the press to report fairly and accurately on judicial proceedings held in public.”
[62]These are powerful considerations that might have provided an overwhelming answer to the present claims if they lacked their defining characteristic, namely that NT1’s conviction is spent. But these considerations would still not have rendered the present claims an abuse of process. The touchstone for identifying this kind of abuse was perhaps best expressed by Buxton LJ in McKennitt. That was a claim for breach of confidence which the defence characterised as an abuse because the Court had held the information in question to be false. At [79], Buxton LJ said this (emphasis added): “79 If it could be shown that a claim in breach of confidence was brought where the nub of the case was a complaint of the falsity of the allegations, and that that was done in order to avoid the rules of the tort of defamation, then objections could be raised in terms of abuse of process. That might be so at the interlocutory stage in an attempt to avoid the rule in Bonnard v Perryman [1891] 2 Ch 269: a matter, it will be recalled, that exercised this court in Woodward v Hutchins [1977] 1WLR 760. 80 That however is not this case. …”.[63]In the present case, I accept that the protection of reputation is a significant and substantial element of NT1’s claim and of his motivation. That is an inevitable conclusion, given his pleaded case and his own evidence as to the damage which concerns him. Paragraph 12.1 of NT1’s Final Amended Particulars of Claim asserts that he “ has been and continues to be treated as a pariah in his personal, business and social life”, and complains that he lives in fear that anyone he meets will find the URLs via Google “and subsequently and as a result shun him.” NT1’s witness statement reaffirms these points, talking of his being a “pariah” who is and has been “shunned”. This is undoubtedly the classic language of reputational harm. That said, it would be wrong to draw too sharp a distinction between the protection of reputation on the one hand and private life on the other. The authorities show that injury to reputation can engage the protection of Article 8 of the Convention: see, for instance, McKennitt [80], Gulati v MGN Ltd [2015] EWHC 1482 (Ch) [168] (Mann J) (appeal dismissed, [2015] EWCA Civ 1291), and Khuja ([61] above).[64]Nor do I consider that the protection of reputation is the claimant’s only objective or, to use the words of Buxton LJ “the nub” of the claims. The pleading and the evidence in support of his case rely on factors which go beyond mere reputation, and cross over into areas of private life which are distinct from matters of reputation. I do not find that NT1 is seeking to exploit data protection law or the tort of misuse of private information to “avoid the rules” – to get round the obstacles that defamation law would place in his way. He is relying on the new law pronounced by the CJEU. As Mr Tomlinson submits, the Court should not be too liberal in its labelling of prejudice as “injury to reputation”, lest it undermine the Google Spain regime.[65]Further, in my judgment it is possible and legitimate to take account in other ways of the fact and extent of the reputational concerns that feature so prominently in NT1’s case. As will become clear, I believe they can properly be brought into account when assessing the Inaccuracy Issues, the Google Spain Issue, and the Misuse Issues. All of this applies equally to the impact of s 8 of the 1974 Act, and the policy that underpins that provision: those are factors to which I can have regard, as appropriate, when determining the issues of liability. The Inaccuracy Issues 68. The essential facts[66]To set out the facts in detail here would be inconsistent with the aims behind my RRO. The detail is set out in the private judgment. Here, I can only summarise, using ciphers as explained above. Inevitably, something is lost.[67]In the 1980s, when working in sales, NT1 met a Mr Steinbeck. They saw an opportunity in a sometimes controversial business of offering services and credit to consumers and companies in connection with property. Together, they established a company, Alpha, to exploit that opportunity. They had equal shares in the business. The business was successful, NT1 running its marketing and sales operation. A Mr Fitzgerald was the marketing and sales director, with a modest shareholding. After some years, the business having progressed, NT1 decided to move abroad with his family. His evidence was that he left Mr Steinbeck to take over day to day running of Alpha’s business. Within a matter of months NT1 became aware of what he calls “a number of issues” with the business. At around this time there were indeed press reports of problems with the sales practices of Alpha, and reports that the Trade Association had fined it a substantial sum. It was also reported that a state regulator had received complaints. NT1 visited the UK to assess the position, and what he saw led him to return permanently.

The Inaccuracy Issues

[68]Over the 18 months that followed his return, a number of payments were made by Alpha to Romeo Ltd and Sierra Ltd, offshore companies of which NT1 was the beneficial owner. The total sum involved was well into seven figures. Ostensibly, the payments were made against invoices for services rendered by the two companies. Later, the Inland Revenue alleged that the invoices were bogus and that the payments were made pursuant to a conspiracy to account falsely, with the purpose of evading tax. NT1 and Mr Fitzgerald were charged with participation in that conspiracy. Both pleaded not guilty. Neither gave evidence. Both were convicted. NT1’s statement says “However, a jury accepted the prosecution’s case and I was convicted” (emphasis added). He admits to finding the sentencing ruling painful to read, as the Judge found he had acted unlawfully and dishonestly. He claims to have “accepted” the findings of the jury but his statement nowhere admits his guilt, and in the witness box he appeared reluctant to concede that the Court’s decision in this, and in other respects, was correct. However, the conviction is evidence that NT1 was guilty (Civil Evidence Act 1968, s 11(2)). It may be best to make clear that I am satisfied that he was guilty, as was Mr Fitzgerald, who was also convicted.[69]During this period, about six months into the false accounting conspiracy, NT1 bought out his partner, Mr Steinbeck. He thereby became the owner of nearly all the shares in Alpha. This was done indirectly, via Sierra Ltd.[70]There was an overlapping dishonest conspiracy, of which Alpha customers were the victims. It had begun some six months before the start of the false accounting conspiracy, and it went on well beyond the end of that conspiracy. Some years later, NT1 and Mr Fitzgerald were both indicted in respect of this conspiracy, along with a number of others. The prosecution did not proceed against NT1, and the charge was ordered to lie on the file. Mr Fitzgerald was tried and convicted. Another Alpha employee pleaded guilty.[71]Over the years between NT1’s buy-out of Mr Steinbeck and the mid-1990s, Alpha’s business suffered a series of setbacks. A substantial number of consumer complaints were made to Alpha and its subsidiaries, to a trade body, and to regulators including state regulators, about its business conduct. A substantial number of these were considered to be well-founded. Civil claims were brought. Subsidiaries of Alpha were subjected to regulatory sanctions by the state. Alpha’s offices and NT1’s home were raided by the police. Alpha was then placed in compulsory winding-up, on the petition of November Ltd and a supporting creditor. NT1 and Mr Fitzgerald were individually required to and did give extensive formal undertakings as to their future conduct. Some of these events were the subject of comments in Parliament.[72]NT1 (via Sierra Ltd) and Mr Fitzgerald put up some money (“the Fund”) to pay off November Ltd and any other creditors of Alpha and get the company out of liquidation. A third party intervened with an application to freeze the Fund so that its provenance could be scrutinised. The Fund was alleged to represent or include the proceeds of the second conspiracy. The application failed for legal reasons. In due course the winding up came to an end with payments out of the Fund to November Ltd and other creditors.[73]At around the same time, NT1 was arrested and charged. Funds held by him in foreign banks were frozen at the instigation of the Crown Prosecution Service. The Inland Revenue’s claims were settled, but NT1 and Mr Fitzgerald were prosecuted, as I have said. NT1 did not give evidence at his trial. He and Mr Fitzgerald both appealed unsuccessfully against conviction. Sentence was adjourned to await the outcome of the trial in respect of the second conspiracy. Reporting restrictions were imposed meanwhile under s 4(2) of the 1981 Act. After Mr Fitzgerald’s conviction, the Judge sentenced him and then NT1. Mr Fitzgerald received a total of 5 years’ imprisonment, comprised of two consecutive sentences of 30 months each. NT1 received a sentence of four years’ imprisonment. Each also received a disqualification from acting as a company director and a costs order.[74]A detailed account of the Judge’s sentencing remarks is contained in the private judgment (at [49]-[56]). The remarks explain how the Judge arrived at his sentences, including his findings about the roles of the two men. Most of the detail cannot be given without imperilling NT1’s anonymity, but it is relevant to record two particular matters. One is that the Judge found NT1 to have been the boss, who had to shoulder the major share of the blame for the dishonest conspiracy. The second is that the Judge made clear that one specific matter of personal mitigation meant that the sentence was less than the Judge would otherwise have imposed.[75]The first third party publication complained of is a media report of the sentencing of NT1 and Mr Fitzgerald, consisting of a headline and 16 paragraphs of text. This (“the First Article”) was published in the financial pages of a national newspaper within a few weeks of the sentencing hearing. The second third party publication complained of also appeared in a national newspaper. This publication (“the Second Article”) first appeared some months later. It was an item within a longer column concerned with consumer affairs. It consists of a headline and 13 paragraphs of text. It begins with a query raised by a reader, the rest of it comprising the journalist’s response.[76]NT1 and Mr Fitzgerald both appealed unsuccessfully against sentence. The key parts of the Court of Appeal’s judgment are set out or summarised in the Private Judgment (at [59]-[66]), and cannot be repeated here lest they serve to identify NT1. But it is fair to say that the Court accepted the trial Judge’s view of the roles of NT1 and Fitzgerald, and found that NT1 was the principal actor in the false accounting conspiracy, which had involved “the corruption of others”. The Court of Appeal, reducing Mr Fitzgerald’s sentence, found that he had been a young second-incommand to NT1.[77]The third URL complained of by NT1 takes one to an extract from a book (“the Book Extract”) first published some two years after the Court of Appeal decision. The Book Extract comprises a headline and 6 paragraphs of text. The content is similar to that of the First and Second Articles.[78]A recent Google search, a copy of which is in the papers, throws up a snippet from each of the First Article, the Second Article and the Book Extract. Snippets from the Articles appear as items one and two on the first page of the search. A snippet of the Book Extract is item eight on page two. The snippets are set out in the Private Judgment (at [67]-[68]). They were the subject of some submissions by Mr Tomlinson in closing, but as the pleaded complaint is one of inaccuracy in the underlying publications, not the snippets, I do not consider it would be right to assess the snippets. The complaints[79]Six complaints of inaccuracy are made. They are not all in the same form, but the commonest format adopted is to pick out some word(s) or phrase(s) from one or more of the three URLs complained of and assert baldly that “The claimant did not ‘[QUOTE WORD(S)/PHRASE(S)]’”. The pleaded case does not identify which of the URLs contains the alleged inaccuracy. No particulars of inaccuracy are provided. This is not especially transparent or helpful. It has required me to carry out an analysis of where the alleged inaccuracies are to be found. That analysis suggests that there are three complaints about the First Article, five about the Second Article (three of which relate to that article only), and two about the Book Extract. The claimant’s approach also seems to beg the question of what sense a given word or phrase bears, when read in its context. I cannot help feeling that in a context such as the present – where the claimant sues in respect of media publications – he should be expected to specify the meaning(s) he attributes to particular words or phrase, and which he says is inaccurate. A claimant should also give particulars of inaccuracy. Those are wellestablished requirements of a statement of case in a defamation or malicious falsehood claim, which are surely appropriate in this context for the same reasons. It is after all NT1 who alleges inaccuracy, and so the burden of proof rests on him, as Mr Tomlinson accepts. The right approach in principle[80]NT1’s case is that there have been breaches of the first part of the Fourth Principle: the requirement that personal data “shall be accurate”. The requirement that data be “kept up to date” does not have any application in this context. There has been some dispute about how to decide whether a published article is “inaccurate” for this purpose. Two sources of law have been addressed.[81]First, there is data protection law itself. DPA s 70(2) contains a “supplementary definition” which explains that “For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.” This does not take the matter much further, though the reference to fact emphasises that this Principle is not concerned with matters of comment, opinion or evaluation. The reference to “misleading” indicates that the Court should not adopt too narrow and literal an approach. The Working Party’s comments on its criterion 4 are helpful:
“In general, ‘accurate’ means accurate as to a matter of fact. There is a difference between a search result that clearly relates to one person’s opinion of another person and one that appears to contain factual information. In data protection law the concepts of accuracy, adequacy and incompleteness are closely related. DPAs will be more likely to consider that de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual. When a data subject objects to a search result on the grounds that it is inaccurate, the DPAs can deal with such a request if the complainant provides all the information needed to establish the data are evidently inaccurate.”
[82]A second source of possible guidance is the domestic law of defamation. Although the DP Directive must be given an autonomous interpretation, it may be legitimate to draw on national legal traditions when implementing the broad principles established by European law. In a libel action, where truth is in issue, the Court will first determine the single natural and ordinary meaning which the words complained of would convey to the ordinary reasonable reader. It is that which the defendant must then prove to be true. A claim for libel cannot be founded on a headline or other matter, read in isolation from the related text; the Court must identify the single meaning of a publication by reference to the response of the ordinary reader to the entire publication: Charleston v News Group Newspapers Ltd [1995] 2 AC 65. Mr Tomlinson initially submitted that the position is or should be different in the present context. Unlike the position in a libel case, he argued, the court looks not at the “natural and ordinary meaning” of the article read as a whole, but at each discrete “item of information” which it contains. Mr White contends that any factual statement contained in the Articles or the Book Extract must be read in its proper context, and that any complaint of inaccuracy must be assessed in the light of the ordinary and natural meaning of the Article or Book Extract of which the offending statement is part.[83]By the end of the trial, Mr Tomlinson had moved in this direction, accepting that words must be read and interpreted in context, but he still resisted the introduction of the defamation principles as to meaning, suggesting that they contained “artificial” restrictions. As I have indicated, I prefer Mr White’s submissions. I do not regard the principles identified in Charleston as artificial. Nor do I think them inapposite in the present context. They have been developed over centuries to meet the needs of a cause of action that addresses issues arising from the publication of words and their impact on reputation. Mr White’s submissions also have two other virtues. They find support in domestic authority. In Lord Ashcroft v Attorney-General [2002] EWHC 1122 (QB) [22] Gray J held it arguable that ostensibly innocent words might convey a secondary, inferential meaning which embodied sensitive personal data about an individual to the effect that he was involved in money laundering (see Tugendhat & Christie, op cit at 7.25). In Quinton v Peirce [2009] EWHC 912 (QB) [2009] FSR 17 [27]-[29], [92] Eady J applied the single meaning rule when assessing whether data were inaccurate within the meaning of the Fourth Principle. In addition, the defamation rules seem well-adapted to testing whether the words satisfy the Working Party criterion of giving “an inaccurate, inadequate or misleading impression of an individual”.[84]There is a further dimension to this. The law of defamation contains a rule (the “repetition rule”) which recognises that an accurate report of what a third party has said about a person may convey an inferential defamatory meaning which is false. The ordinary meaning of the statement, “The prosecutor alleged that the defendant had defrauded the Revenue” is that the claimant is guilty of fraud. That could turn out to be untrue. The same is true of the statement that “The Jury found him guilty of fraud”. The policy of defamation law is to hold the publisher responsible for the inferential meaning, whilst protecting those who report accurately on court proceedings, and on certain other kinds of proceeding or statement such as Parliamentary proceedings, even if the report conveys a false or inaccurate inferential meaning. The protection is absolute or qualified, according to the context. Some accurate reports are privileged “subject to explanation or contradiction”. The interpretative provisions of DPA Schedule 1 Part II contain some apparently relevant provisions for qualified exemption from the strict requirements of accuracy. They state:
“7. The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where (a) having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and (b) if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.” (b) if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.”
[85]It is noteworthy that the remedial provisions of the DP Directive and DPA afford the Court a discretion, and considerable latitude. DPA s 10(4) gives the Court a discretion to require a data controller to take “such steps… as the court thinks fit”. Section 14 provides that if the Court is satisfied that personal data are inaccurate it “may” order the data controller to rectify, block, erase or destroy those data. Sections 14(2) and (3) contain further provisions, some of which build on the requirements of Sch 1 Part II paragraph 7, quoted above: “(2) Subsection (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then-(a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and(b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a). (3) Where the court- (a) makes an order under subsection (1), or (b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate, it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.” (a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and (b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a).[86]It is clear from these provisions that even where data are found to be inaccurate the Court has a toolbox of discretionary remedies that can be applied according to the circumstances of the individual case. Indeed, the Court may grant a remedy even if by virtue of paragraph 7 of Sch 1 Part II the data are not found to be inaccurate. At one extreme, the Court may deem it appropriate to order a data controller both to block and erase data, and to tell third parties to whom the data have been disclosed that this has been done. At the other extreme, the Court may conclude that no order should be made. Between those two extremes lies a variety of options. The Court’s order will need to be tailored to the circumstances, having regard to the effect a particular remedy would have on the parties and on the wider public. Some options might be excessive. If a long article on a matter of public interest containing a substantial amount of information about the claimant was found to contain one inaccuracy, of a relatively minor nature, the knock-on effects of blocking access via an ISE such as Google might make it hard to justify the grant of that remedy. Rectification, or an order under s 14(2) might be a more appropriate course. Such an option might not be available on the facts of a given case. It could be, for instance, that an ISE lacked the technical ability to add to an individual search result or snippet an indication of “the data subject’s view that the data are inaccurate”, or a supplementary statement of “the true facts”. The evidence in this case does not tell me anything about that, probably because the claimants have not sought rectification or any lesser remedy than blocking and erasure.[87]It seems to me legitimate to have regard in this context also to the contours of the English law of defamation, which has always allowed a generous latitude to those reporting proceedings in Court or in Parliament, going so far as to permit reporting which conveys the “impression” of the journalist (see, eg, Cook v Alexander [1974] 2 QB 279, CA). It would be wrong to treat the two branches of the law as coterminous, as they not only have different origins but also serve different purposes. It is possible to give more weight to literal accuracy in the context of data protection law, with its broader aims and its wider and more flexible range of remedies. It is appropriate, however, to bear in mind domestic principles in order to ensure, as far as possible, that the law has the “coherence” to which Lord Sumption referred in Khuja.The evidence[88]Google’s case depends on documentary evidence, and such support as it can derive from answers given by the claimant under cross-examination. The hearsay rule has been abolished for civil proceedings so there is no difficulty, generally, about reliance on statements of fact contained in third party documents. Among the documents relied on here, however, are transcripts of the Judge’s sentencing remarks, and of the Court of Appeal’s judgment dismissing the appeal of NT1 and allowing that of Mr Fitzgerald. That prompted a discussion of whether Google’s case was in any way limited by Hollington v F Hewthorn & Co Ltd [1943] KB 587. Nobody doubts that convictions are admissible as evidence of guilt. Section 11 of the 1968 Act provides for that. Nor is there room for doubt that judgments or sentencing remarks (which are a form of judgment) are admissible as hearsay evidence of the facts of the case, subject always to the requirements of s 4 of the Civil Evidence Act 1995 regarding the evaluation of hearsay: see Hourani v Thomson [2017] EWHC (QB) [21]-[22]. Section 11(2) of the 1968 Act plainly contemplates that evidence can be adduced of the facts on which a conviction is based. But I wondered whether Hollington v Hewthorn might be an impediment to reliance on the Court’s conclusions or findings on contested issues of fact, whether made at first instance or on appeal, if those go beyond the facts leading to the conviction. In the end I do not think this is a problem.[89]As Tugendhat J pointed out in Director of Assets Recovery Agency v Virtosu [2008] EWHC149 (QB) [2009] 1 WLR 2808 [39]-[40], Hollington v Hewthorn is distinguishable where, as here, the previous judgment that is placed before the Court enables it to link up the conduct found proved by the previous court and the conduct to be proved in the instant case, and the issue for consideration is identical. As further pointed out in Virtosu at [41], it has been held by the Court of Appeal that Hollington v Hewthorn “does not purport to be an authority” on the matter of “raising in a civil action the identical question that had already been decided in a criminal court of competent jurisdiction”. It is fair to mention that Mr Tomlinson did not seek to exclude reliance on the sentencing remarks in reliance on Hollington v Hewthorn, perhaps in part because his client’s case relies in part on findings made by the Courts, which are said to exculpate NT1. Further, it is for the claimant to prove inaccuracy. I agree with Mr White that, on the face of it, an attempt to do so in reliance on a proposition contrary to the findings of a criminal court of competent jurisdiction would be an abuse of process (cf. Hunter v Chief Constable of West Midlands Police [1982] AC 529).[90]It is not an inherently easy task to determine the truth or falsity of statements published nearly 20 years ago about events that were older still, following two lengthy trials. The evidence I have to help me in that task is limited and far, far less than was before the trial Court or the Court of Appeal. NT1 has chosen, as is his right, to place relatively little evidence before the Court on the inaccuracy issues. The documents all come from Google. NT1’s witness statement is less than comprehensive in its explanation of why the offending publications are inaccurate. It deals with the First and Second Articles in two relatively short paragraphs. It does not deal with the Book Extract at all. Granted, those two paragraphs of the witness statement are preceded by an account of the factual background, but that account itself is fairly superficial and the two elements are not clearly linked to one another. Moreover, (as explained in the Private Judgment) there are aspects of the inaccuracy complaint which are not addressed at all by the statement. As a result, much of the claimant’s response to the documents relied on by Google emerged for the first time under cross-examination.[91]He did not perform well, and made a bad impression on me. He began by giving long-winded and elaborate answers to simple questions, showing a tendency to make speeches rather than give answers. He tended to evade, to exaggerate, to obfuscate, and worse. Examples of such behaviour which can be given in this public judgment include the following.(1) At an early stage in his cross-examination it was put to the claimant that his business had been “repeatedly prosecuted by trading standards authorities … and sued by victims of its deceptive and misleading sales practices …”, he flatly denied it as “absolutely untrue”. Confronted with a newspaper report from the 1990s asserting that Alpha had a specified number of criminal convictions for trading standards offences, and a larger specified number of civil claims standing against it, the claimant said it was a long time ago and he could not be expected to comment on “unparticularised allegations like that”.(2) Shown a letter from a Mr Updike, the head of a Consumer Group, which gave detailed particulars of such convictions and civil claims, which matched the content of the newspaper article, the claimant embarked on an attack on Mr Updike’s motives, and questioned the authenticity and reliability of the list. He then suggested that the cases had “been encouraged and built up by” Mr Updike. When I asked if he was therefore accepting that there were such cases he said no, he did not have enough information to accept this.(3) Google has produced contemporaneous cuttings to support the existence of several of the convictions. The list of civil claims was detailed enough to give a Court, an action number, and a specific figure for each judgment or claim. It indicated whether the judgment had or had not been satisfied. Cuttings and other evidence also support the existence of civil claims. The evidence overall makes it clear enough that a substantial number of criminal prosecutions and a substantial number of civil claims were brought with success, and I find that Mr Updike’s lists were substantially accurate. I am by no means convinced that the claimant’s memory was so bad that he could not recall such matters. Maybe his memory of the detail is poor, but I am confident that he had not forgotten these matters altogether and that his evidence was not frank. He was equivocating, dissembling, and blustering.(4) The claimant repeatedly used extravagant language to denounce suggestions, courteously put to him by Mr White, that he was involved in the management of Alpha. He rejected these as variously “bizarre”, “ridiculous” or “palpable nonsense”. Although he also gave reasons for rejecting such suggestions, such persuasive force as they had was undermined by the exaggerated language used. The impression conveyed was of an attempt to make a case by (metaphorically) shouting. After all, it does not seem inherently ridiculous to suggest that a person who returns from abroad to deal with a crisis, owns nearly all the shares in a company, and is able to move over £6m out of the company to his personal accounts in Switzerland has a good measure of knowledge of the company’s day to day business and practical control over its conduct. Nor does it seem immediately obvious that, as NT1 would have it, the business was in fact under the effective control of a man in his early 20s who held a tiny minority stake in the company.(5) Also significant, in my judgment, was the claimant’s evidence about the formal undertakings given by him and Mr Fitzgerald. In form, those undertakings embodied admissions by each man that he had previously consented to or connived at a course of conduct involving a raft of criminal offences, and a promise that he would not continue to do so. There was a formal announcement which described each man as a present or former executive of Alpha. The claimant told me that all he could now recall was that he gave the undertakings. He did not accept that he had in fact consented to or connived at any of the offences listed in the undertakings, or that the document setting them out was evidence that he had done so:
“I, as I said, was not the author of the list and do not remember the list, [but] I accept that I signed the document. I do not accept that the semantic point of referring to "continuing to consent to or connive at the course of" means that I accept that I had previously been involved in any of those practices or activities.”
The claimant agreed that there were steps he could have taken, but did not take, to head off the regulator’s demand for such undertakings. He said he had chosen not to challenge the demands because he was trying to resolve the problems not add to them. (6) I found this part of the claimant’s evidence most unconvincing. I do not accept that he could not recall the process. I do not believe that he gave what on any view were important formal undertakings without reading or understanding them. I am not persuaded by his evidence that he signed simply to make things easier for himself and the company. I regard the undertakings as reliable admissions which form an important element of the evidence in this case. I regard the claimant’s unreliable evidence about the undertakings as a factor that undermines his credibility.[92]Some of the evidence given by the claimant in relation to other parts of the case further undermined his credibility: see in particular [123] below. Overall, I find myself unable to accept much of the claimant’s evidence on the inaccuracy issue and, as a rule, where that evidence conflicts with contemporary documents, and the inferences that can fairly be drawn from those documents, I accept the latter. I should add two further comments on aspects of the claimant’s oral evidence. (1) NT1 made clear that he did not accept every finding of the sentencing Judge. He attempted twice to persuade me that the Judge’s findings about his role in Alpha were mistaken, using the same unmeritorious argument on both occasions. First, he said that the Judge had never heard from him, and so “I never had the opportunity” to present to the court “anything to contradict the judge’s impression”. It was, naturally enough, pointed out to him that he had had every opportunity to explain, but had chosen not to give evidence. He appeared to accept that. But when another of the Judge’s observations about his role was put to him a little later, he denied it was correct and said:
“… I would remind you, my Lord, of my previous comment, that neither myself nor [Fitzgerald] gave evidence during the trial and, therefore, the judge’s conclusion is somewhat subjective.”
This is a most unattractive line to take, and I disagree with the claimant’s assessment of the Judge’s findings. They were based on the evidence given at the trial over which he presided. They are consistent with evidence that has been adduced in this trial, and I consider them to be reliable. (2) NT1 also sought to persuade me that the Court of Appeal had taken a mistaken view of the settlement with the Inland Revenue, and that the sum paid had represented the full amount of the tax which the Revenue considered had been evaded. He described the calculation adopted by the Court as “subjective”. That was in my judgment an untenable position, given the conclusions of the Court and the facts recorded in the Court of Appeal judgment. The attempt to quarrel with this part of the reasoned judgment of the Court of Appeal (on other aspects of which he seeks to rely) was, in my view, another illustration of an obstinate tendency on NT1’s part to reject adverse Court findings, however well-founded. Assessment of the six complaints[93]For the following reasons, and further reasons given in detail in the Private Judgment, I reject all six complaints of inaccuracy.(1) The main complaint is that the headline of the First Article suggested that the claimant had been convicted of the second conspiracy. The Amended Defence admitted this alleged inaccuracy but asserted it was immaterial. In his written opening, Mr White argued that position on the basis that the offence of which NT1 was convicted was “very closely connected” to the other offending, and so serious that “the said inaccuracies would have no greater adverse impact on the claimant’s reputation than the true facts summarised in the” URLs. That argument is redolent of the somewhat complex statutory provisions of s 2(3) of the Defamation Act 2013, and I would have had to think hard before accepting it. In oral argument and in closing, however, Mr White put his client’s case rather differently, submitting that this article is not capable of bearing the meaning complained of, and that (having regard to the s 4(2) order postponing reporting) the First Article was “a classic contemporary court report”. I broadly agree with that. The claimant’s argument depends on taking the headline out of context in a way that is contrary to principle. Even if that was wrong, I would still not exercise my discretion to grant an order for the blocking or erasure of the URLs on this ground alone. The most that could be justified, assuming either to be practicable, would be a limited order for rectification or the addition of a notation. Neither of those remedies has been claimed. In so far as this complaint applies to the Second Article and/or the Book Extract it fails for essentially the same reasons. Both, when read as a whole, gave a clear enough account of what it was that the claimant was convicted of.(2) The second complaint is that the First Article and Book Extract gave a false impression of the claimant’s role in the management of Alpha. The claimant has not established that these publications are inaccurate in this respect. If this complaint is meant to include a claim that the publications falsely implicated him in the second conspiracy, he has not adequately pleaded that case and he has failed to persuade me that the publications were inaccurate in this respect: see (4)-(6) below.(3) The third complaint relates to an assertion about Alpha’s fate which featured in both Articles and in the Book Extract. The claimant’s case is that this is inaccurate as Alpha “was placed temporarily in administration, the only creditor was then paid in full and the company was reinstated.” I do not accept that account of events. I reject the complaint on the further grounds that the information is not personal data of the claimant; the claimant has fallen a long way short of showing that the wording used was, in context, inaccurate or misleading; and for the reasons given at (1) above I would not have ordered blocking or erasure anyway, as a matter of discretion.(4) (5) &(6) These three complaints can conveniently be taken together. They all relate to the Second Article, and only that article. Each complaint asserts that specific wording contained in that article was inaccurate. The complaints have a common underlying theme, namely that the Second Article meant that the claimant was guilty of the second conspiracy. I agree that it did. The article made it clear to any reasonable reader that the claimant was convicted of the false accounting conspiracy, and not convicted or even tried for the second conspiracy. But it implied that he was guilty of that crime, and that he had got away with the proceeds of that crime. That was certainly not accurate court reporting within paragraph 7 of DPA Sch 1 Part II. The question is one of substance. The claimant has not persuaded me that the Second Article was inaccurate in any of these respects. He was not convicted of participation in the second conspiracy. But nor was he acquitted. He was charged. The CPS considered it had a realistic prospect of securing a conviction. He was not tried, but for reasons that have no bearing on his guilt or innocence. The absence of a conviction does not tilt the balance in his favour. I find that he had sufficient control of Alpha’s affairs to cause millions to be transferred to his offshore companies commencing shortly after his return from abroad. The second conspiracy was already under way at that time, which makes it more likely than not that the funds that went to the offshore companies included the proceeds of fraud. The second conspiracy continued for a long while thereafter. The claimant’s increased shareholding after the buy-out of Mr Steinbeck gave him legal and, in my judgment, practical control of Alpha. That view is supported by the conclusions reached by the sentencing Judge and the Court of Appeal, which I consider to be both admissible and reliable for present purposes. The business carried on a good deal more than a year after NT1 took control of it. I do not accept the claimant’s case that in this period others were doing the dirty work, without his knowledge or involvement, whilst he tried to clean up behind the scenes. An important element here is of course the undertakings he gave, and my assessment of their significance and the claimant’s evidence about them. I also see force in Mr White’s point, that I should draw an adverse inference against the claimant from his repeated failures over the years to take the opportunity to challenge allegations made against him. He made no representations to the regulator, despite the gravity of the steps being taken or threatened, he put in no evidence in response to the serious allegations made in the winding-up proceedings, he elected to remain silent at his criminal trial, and in response to the Revenue.[94]In the words of the Working Party’s commentary, NT1 has failed to “provide … all the information needed to establish the data are evidently inaccurate.” The Privacy Issues (1) The Exemption Issue[95]The domestic provision relied on by Google is the so-called “Journalism exemption” contained in DPA s 32. The exemption in fact applies to processing for what are called the “special purposes”, which is a rather broader notion encompassing “journalism, literature and art”. An exemption in respect of data processed for these purposes is authorised by Article 9 of the DP Directive, which is headed “Processing of personal data and freedom of expression”, and provides as follows:
“Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.”
[96]Section 32(1) of the DPA provides that:- “Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if -(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.”[97]The provisions to which s 32(1) relates – that is, the requirements from which exemption may be claimed – include all the data protection principles with which this action is concerned, as well as s 10 (the right to prevent processing) and s 14 (the right to blocking, erasure, etc.).[98]The first issue is whether s 32 is engaged at all; put another way, have the personal data at issue been processed or will they be processed “only for the special purposes”? Closely associated with that question is the issue of whether processing by Google is undertaken “with a view to” publication for journalistic purposes. In my judgment, Google’s case on the Exemption Issue fails at this threshold stage. I can accept the starting point of Google’s argument, that the concept of journalism in EU law is a broad one. The concept extends beyond the activities of media undertakings and encompasses other activities, the object of which is the disclosure to the public of information, opinions and ideas: see, eg Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy Case C-73/07 [2010] All ER (EC) 213 [61]. But the concept is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions. To label all such activity as “journalism” would be to elide the concept of journalism with that of communication. The two are plainly not the same, and I do not consider that Google’s own activity can be equated with journalism.[99]Nor can I agree with the narrower version of Mr White’s submission, which asserts that the concept of journalism is apt to cover, at least in the present cases, the purpose of the service provided to internet users by Google’s search engine. It is submitted that the process of making search results available is “for the purpose of” enabling users to access third party publishers’ content which discloses information, opinions and ideas. Mr White is quick to emphasise that Google is not a publisher of the material at the URLs; it is only a facilitator: see Metropolitan International Schools Ltd v Designtechnica Corpn [2009] EWHC 1765 (QB) [2011] 1 WLR 1743. But he points out, fairly, that this is not in itself an obstacle to its reliance on s 32. The scope of the exemption is not confined to processing which consists of journalistic publication by the person relying on the exemption; it extends to processing “undertaken with a view to the publication by any person” of any journalistic material (emphasis added). The argument is that the information available at the URLs complained of in this case consist of journalistic material published by third parties, and Google’s role is undertaken “with a view to” such publication, facilitating publication by the third parties. This narrower argument can be characterised, without meaning to disparage it, as parasitic. It depends upon the character of the underlying publication, and can only be relied on where that publication is for purposes properly characterised as journalism, or for one of the other special purposes. Much material that people want to have delisted will not be within those confines.[100]There may be a range of support or ancillary activities that are undertaken by those who are not themselves publishers, but which involve processing the sole and exclusive purpose of which is to enable third parties to publish journalistic material. Processing by a printer to which a newspaper has outsourced its production might qualify. But I do not consider that this can fairly be said of an ISE such as Google. Its activities are not exclusively subsidiary, subservient, or ancillary to those of any publisher. The reality, as is clear from the evidence of Ms Caro and common knowledge, is that the processes of obtaining, indexing, storing, and making available information that are engaged in by an ISE are automated, and governed by computerbased algorithms. The “All” search function is carried out indiscriminately, in the sense that the search criteria have no regard to the nature of the source publications. Searches for “news” may target a narrow range of sources. But whatever the nature of the search in question, when Google responds to a search on an individual’s name by facilitating access to journalistic content about that individual, this is purely accidental, and incidental to its larger purpose of providing automated access to third party content of whatever nature it may be, that it has identified and indexed and meets the search criteria specified by the user. That is a commercial purpose which, however valuable it may be, is not undertaken for any of the special purposes, or “with a view to” the publication by others of journalistic material within s 32(1)(a). Such processing is undertaken for Google’s own purposes which are of a separate and distinct nature.[101]In my judgment, both versions of the argument would fail on the alternative ground that the processing involved when Google Search makes available third party content that happens to be of a journalistic nature is not properly regarded as processing undertaken “solely” or “only” for journalistic purposes, as required by Article 9 and s 32. In Google Spain, the Grand Chamber indicated at [85] that it did not consider an ISE would process solely for journalistic purposes, and although that was not an integral part of the Court’s reasoning I consider it is true. I also accept the argument of Ms Proops, for the ICO that Google’s approach to the journalism exemption is to be resisted because it would have consequences that cannot have been intended by the legislators. The argument, shortly stated, is that the effect of ss 3, 45 and 46 of the DPA is to impose severe constraints on the ICO’s powers of enforcement where data are processed for the special purposes. If Google’s activities fall within that description, it would be able to operate the “right to be forgotten regime” without regulatory oversight and control. I consider my conclusions to be consistent with the stricture contained in Article 9 of the DP Directive, that Member States may provide for journalistic exemptions “only if they are necessary to reconcile … privacy with … freedom of expression” (emphasis added).[102]I would in any event have rejected Google’s case on the Exemption Issue, for these reasons. Each of s 32(1) (b) and (c) has a subjective and an objective element: the data controller must establish that it held a belief that publication would be in the public interest, and that this belief was objectively reasonable; it must establish a subjective belief that compliance with the provision from which it seeks exemption would be incompatible with the special purpose in question, and that this was an objectively reasonable belief. That is the ordinary and natural meaning of the words used (and of the somewhat similar provisions of s 4 of the Defamation Act 2013, discussed in Economou v de Freitas [2016] EWHC 1853 [2017] EMLR 4 [136], [139(2), (3)]). There is no evidence that anyone at Google ever gave consideration to the public interest in continued publication of the URLs complained of, at any time before NT1 complained. I accept that consideration was given to that issue after complaint was made. It was part of the process of assessment that Google undertook, as described by Ms Caro. Thus far, there might be something in Google’s argument, that it should be exempt if the view it took on the public interest was a reasonable one. But it would still have to go on to show that it held a belief, that was reasonable, that it would be incompatible with the special purposes for its continued processing of the data to be carried out in compliance with the DPA. There is no evidence of that at all. Google’s “right to be forgotten” assessment process is not designed or adapted for that purpose. That may be because it has not considered until recently that the journalism exemption might be available to it. It certainly did not suggest this in the Google Spain case. Google’s reliance on s 32 would therefore have failed at the s 32(1)(b) stage in any event. (2)The Structure Issue[103]There are three competing arguments on this question. Mr Tomlinson submits that the Google Spain balance falls to be struck at the remedial stage, after a conclusion has been reached on liability. Mr White argues that I should adopt a staged approach, deciding first whether there is a prima facie obligation to the erasure of personal data and then, if so, considering whether the obligation is avoided because the processing is necessary for the exercise of the right of freedom of expression. He submits that “the lack of a lawful basis for the processing of sensitive personal data merely gives rise to the qualified right to be forgotten”. Mr White relies on the structure of Article 17 of the GDPR, which he submits is in this respect a “setting out” of the law as declared by the CJEU in Google Spain, and should be applied by this Court. The ICO rejects both these approaches as both wrong and unprincipled. She contends that the issue is a straightforward question of liability, which calls for a decision on whether Google has complied with its duties under the DPA, as interpreted in the light of the DP Directive and the Charter. She argues, however, that for this purpose the requirement of the First Principle, that the processing comply with at least one condition in Schedule 3, should be disapplied, if the circumstances are such that, on an application of the Google Spain criteria, the balance tips against delisting. The basis for disapplication would be the same as that adopted by the Court of Appeal in Vidal-Hall ([32] above).[104]The existence of this last-mentioned argument betrays the fact that the various approaches adopted by the parties are all at least partly driven by a view (on the part of the ICO and the claimants) and/or a concern (on the part of Google) that on a straightforward application of the DPA and/or the DP Directive Google is, or may be, unable to demonstrate that any Schedule 3 condition is met. On the face of it, that would lead inevitably to a conclusion that it is in breach of statutory duty. All agree that this is not a tenable approach; the reasoning process involved would be too mechanistic to be compatible with the requirements of the Charter and the Convention. It would afford no recognition to the fact, acknowledged by the CJEU in Google Spain, that there may be free speech justifications for disclosing sensitive personal information, even if the data subject does not consent.[105]These are not easy questions. Now that I have resolved the Exemption Issue against Google, I am not sure that the answers matter, either for this case or more generally. Everyone agrees that I must address the Google Spain balancing exercise at some point, with due regard to the Working Party criteria. And this case is being determined in the twilight of the DP Directive regime, with the first light of the GDPR already visible on the horizon. It seems unlikely that my decision will have an impact on other cases. In deference to the arguments, and recognising that this case may be considered by another court, I will nonetheless state my conclusions, with brief reasons.(1) I reject Mr White’s submission. I am unable to identify any principled basis on which I can use the GDPR as an aid to the interpretation of Google Spain or to the identification of the legal principles that apply to events, some of which occurred before the enactment of the GDPR, and all of which (so far) have taken place before it has effect. I do not myself detect such an approach as explicit or implicit in Google Spain.(2) I also reject Mr Tomlinson’s approach. As indicated when dealing with the Inaccuracy Issue, I do consider the flexibility of the remedies provided for by the DPA and DP Directive to be an important feature of the law in this area. But it would be unsatisfactory, and I think Ms Proops is right to say unprincipled, to leave so much to the discretion of the Court.(3) The solution that fits best with the structure of the law and the decision of the CJEU is, in my judgment, the one advocated by the ICO. But I am reluctant to take the radical step of disapplying any part of the DPA. There is a powerful argument that the scheme of the DPA is incompatible with fundamental rights, as it fails to recognise any possibility of a free speech justification for the processing of sensitive personal data without consent. But the same would seem to be true of the DP Directive which, in this respect, the DPA merely mirrors. The CJEU did not need to confront this issue in Google Spain, as the data in that case, though “sensitive” in the colloquial sense as they concerned personal financial matters, were not “special category data” within Article 8 of the DP Directive. In my judgment, it is not necessary to go as far as the ICO contends. On the facts of this case, at least, I need not confront the question of disapplication. I consider that a Schedule 3 condition is met. (3) The DPA Compliance Issue[106]The First Principle. On the facts of this case, the general requirements of this Principle, that processing be “fair and lawful” add nothing to the particular requirements, that processing comply with at least one Schedule 2 condition and, if the data are sensitive personal data, at least one condition in Schedule 3. Most of the personal data with which I am concerned are sensitive personal data and it is convenient to start with Schedule 3.[107]Schedule 3. I reject most of Google’s arguments that its processing was compliant with Schedule 3. The processing of NT1’s data by making them available to those who search on his name was not, nor is it, “necessary for the purposes of exercising legal rights” within Condition 6(c) of Schedule 3. The rights relied on those of internet users under Article 10 of the Convention and Articles 8 and 11 of the Charter, as well as the Article 16 freedom of Google to conduct a business. I do not consider that broad interpretation can stand. As Ms Proops and Mr Tomlinson submit, this condition must be applied in conformity with Article 8.2(e) of the DP Directive, which uses the terms “legal claims”; its “focus is on the protection of underlying rights”: R (British Telecommunications plc) v Secretary of State for Culture, Olympics, Media and Sport [2012] EWCA Civ 232 [2012] Bus L R 1766 [74].[108]Google’s reliance on paragraph 7A of Schedule 3 is close to unarguable. That condition applies to processing of information “disclosed by an anti-fraud organisation”. It is said that this paragraph should be given a wide interpretation, encompassing both public and private sector organisations concerned with exposing and preventing wrongdoing. I have seen nothing to warrant such a broad interpretation of wording which, on its face, appears to be specific and relatively narrow in ambit.[109]Nor can Google rely on Condition 10 of Schedule 3 and paragraph 3 of the Schedule to the Data Protection (Processing of Sensitive Personal Data) Order 2000 (SI 2000/417), made by the Secretary of State pursuant to Condition 10. That condition is, in substance, a narrower version of DPA s 32. It lays down a set of requirements which are cumulative (see Campbell v MGN Ltd [2002] EWHC 499 (QB) [121] (Morland J)). Among the requirements are that the processing in question is “for the special purposes”, and “with a view to the publication of … data by any person”. Whatever else might be said about the application of this Condition to the facts of this case, the existence of those two requirements means that Google’s argument is unsound, for the reasons I have given in deciding the Exemption Issue.[110]The Schedule 3 condition that I do find satisfied is Condition 5: that “the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject”. In reaching that conclusion I am following a path already trodden by Stephens J in Townsend v Google Inc [2017] NIQB 81, and a principle that seems to be logical, and well-established in domestic and European law. In Townsend, Stephens J refused an application for leave to serve proceedings on Google in California, claiming remedies under the DPA in respect of the processing of information about the convictions of a prolific offender. (By the age of 24 the plaintiff had accumulated 74 convictions, of which only 2 were spent). One of Stephens J’s conclusions was that Sch 3 Condition 5 was so clearly satisfied that the contrary was not arguable, so there was no triable issue. He reasoned, at [62], that “legally as a consequence of the open justice principle by committing an offence [the offender] is deliberately taking steps to make the information public”. Mr Tomlinson quarrels with this analysis. He argues that the Claimant took no steps, deliberate or otherwise, to “make the information contained in the data” public. Condition 5, he says “requires some act of dealing with information”. An offender such as NT1, who commits an offence in private, is by no means deliberately making his conduct public. I do not believe this reasoning is sound.[111]First of all, the wording of condition 5 is important. It does not require a deliberate decision or “step” by the data subject “to make” the information public, but rather(a) the taking by him of a deliberate step or steps, as a result of which(b) the information is “made public”. A person who deliberately conducts himself in a criminal fashion runs the risk of apprehension, prosecution, trial, conviction, and sentence. Publicity for what happens at a trial is the ordinary consequence of the open

justice principle:

“An important aspect of the public interest in the administration of criminal justice is that the identity of those convicted and sentenced for criminal offices should not be concealed. Uncomfortable though it may frequently be for the defendant that is a normal consequence of his crime”: Re Trinity Mirror plc [2008] EWCA Crim 50 [2008] QB 770 [32] (Sir Igor Judge P). The same must be true of the details of the offending, and other information disclosed in open court, including information about himself which a criminal reveals at a trial or in the course of an application. The European Court of Human Rights was making a related point, I think, in Axel Springer AG v Germany (2012) 32 BHRC [83]. The applicant complained of sanctions imposed for reporting information about a celebrity’s arrest, conviction, and sentence for possession of cocaine. Finding a violation of Article 10, the Court observed that, whilst reputation is protected by Article 8 of the Convention, it “cannot be relied on in order to complain of a loss of reputation which is the foreseeable consequence of one’s own actions such as, for example, the commission of a criminal offence…”
(emphasis added).[112]The argument in favour of the application of Condition 5 would be stronger, if one was dealing with a person who committed a crime in public; someone who does that has “placed himself in public view”: see In re JR38[2015] UKSC 42 [2016] AC 1131 [32], citing Higgins LJ (sitting in the Divisional Court of the Queen’s Bench Division in Northern Ireland). But it would be wrong, as well as impracticable, to draw a distinction of principle for these purposes between information about crimes committed in public and those committed in private. The place for drawing that distinction is in weighing up the competing considerations of privacy and publicity.[113]Mr Tomlinson is entitled to point to the wording of Article 8.2(e) of the DP Directive, from which Sch 3 Condition 5 derives. Article 8.2(e) exempts the processing of “special category data” from the general prohibition in Article 8.1 where it “relates to data which are manifestly made public by the data subject” (my emphasis). This however is rather obscure language. I do not think it provides a sufficient reason to depart from the ordinary meaning of Condition 5 itself. I attach weight to the fact that a narrow interpretation would tend towards the unacceptable conclusion discussed above. I see a good deal of force in the point made by Mr White, that if this condition were not available in respect of processing of this nature it is hard to see how ordinary members of the public could lawfully discuss online the convictions (whether recent or historic) of those appearing before the courts.[114]Schedule 2. The fact that a Schedule 3 Condition is satisfied means that it is not necessary to consider the disapplication of that part of s 4(4) that requires this to be so. It is by no means the end of the matter, of course. A Schedule 2 Condition must also be met. This can be dealt with shortly. It is agreed on all sides that in principle Sch 2 Condition 6(1) is capable of application to this case. It reads as follows:
“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
[115]In general terms, Google plainly has a legitimate interest in the processing of third party data in pursuit of its business as an ISE, and third parties have a legitimate interest in receiving information via Google or other ISEs. These obvious propositions are bolstered by the authority of the CJEU which, in paragraphs [73-74] of Google Spain, agreed with the Advocate-General’s submissions on the point. The A-G had said that internet intermediaries “act as bridge builders between content providers and internet users …” playing a role that “… has been considered as crucial for the information society”: see [36]. The vital questions are whether, on the facts of this case, the particular processing at issue is “necessary” for the purposes of such interests, or is “unwarranted” for any of the reasons specified in Condition 6(1). This condition clearly calls for the conduct of a balancing exercise. Authority to date is that the exercise the Court must undertake in this context is an assessment of proportionality (see Morland J in Campbell v MGN Ltd (above), [116-117]) involving essentially the same Article 8/Article 10 “ultimate balancing test” as prescribed by In re S (Murray v Express Newspapers [2007] EWHC 1908 (Ch) [2008] 1 FLR 704 [76] (Patten J)). It must form part of the balancing process mandated by Google Spain. Indeed, as Ms Proops points out, the CJEU’s analysis was heavily reliant on Article 7(f) of the DP Directive, which is the analogue of Condition 6(1).[116]The Second to Sixth Principles. I have already dealt with NT1’s case under the Fourth Principle. Otherwise, in my judgment, the question of whether Google’s processing of the claimant’s personal data was in breach of or in compliance with these Principles is subsumed by or, in Mr White’s phrase, “collapses into” the Google Spain balancing exercise. It does not require separate consideration. (4) The Google Spain IssueFacts[117]The facts I need to consider for this purpose are not only those of and surrounding NT1’s conviction, but also the other matters that have already been examined when dealing with the Inaccuracy Issue. Google contends that NT1’s business career since his imprisonment and his social media profile both support its case that the processing complained of was and is compliant with Google’s statutory duty under the DPA, and its obligations under Google Spain. I must therefore summarise this part of the case and my findings. NT1’s subsequent business career[118]Google relies on publicly available documents relating to business activities of NT1, which it describes as “indicative of the nature of his ongoing business activities”. The documentation evidences a variety of business ventures stretching over some 15 years, as well as a demand made by the Inland Revenue for information about NT1’s affairs, a High Court ruling on the validity of that demand, and a decision by the OFT refusing an application by NT1 for a consumer credit licence. NT1 was crossexamined at some length about these documents, and what they did or did not show about his behaviour. As before, the details appear in the Private Judgment, and this judgment can only summarise; parts of what follows are undisputed, but there are disputes. To the extent there is dispute these are my findings.[119]Around the turn of this century, for a period of some years, NT1 obstructed an Inland Revenue investigation into his tax affairs by steadfastly failing and refusing to provide any of the information which had been requested. When the Revenue made a statutory demand for that information, under s 20 of the Taxes Management Act 1970, NT1 mounted a flimsy and deservedly unsuccessful legal challenge. A High Court Judge dismissed six grounds of challenge advanced on a renewed judicial review application. The Judge held that NT1 and his solicitors had put forward any possible pretext to avoid giving the information, which was at all times within his reach. In his evidence to me, NT1 sought to distance himself from the conduct of the legal proceedings. I was not persuaded that he had left this to his lawyers. He put forward additional reasons to justify his failure to provide the information. I do not accept those reasons, which I regard as unconvincing and unmeritorious. I accept the Judge’s assessment.[120]After his release from prison, NT1 made an application to the OFT for a Consumer Credit Licence, without disclosing his previous association with a credit licensee whose licence was revoked. His application was refused on the grounds that he was not fit to hold such a licence, because of his conviction (which was not “spent” at that time), and because of his failure to declare the previous association. In his evidence to me, NT1 described the reasons for refusal as “somewhat disingenuous”. He claimed that it was the fact of his association with a business that had a consumer credit licence revoked that had led him to make the application in the first place and that, if he had not made reference to the prior association in the written application, he had done so orally. I do not accept any of NT1’s evidence on this aspect of the case. I accept and adopt the findings of the OFT.[121]NT1’s post-prison business career has included lending money to business and individuals over the last 15 years or so. The money lent came from the profits of Alpha, of which NT1 had “siphoned off” several million pounds in the false accounting conspiracy, and taken a further £3m by way of the funds frozen in Switzerland. This much NT1 accepted in cross-examination. He did not accept that any of the money he lent represented the proceeds of frauds on consumers. I do, however, conclude that this was the case. I accept NT1’s case, that Alpha’s business was not fraudulent from the outset. I also accept that the scale of the fraud was modest in comparison to the number of transactions undertaken by companies in the Alpha group. The Court of Appeal made that observation. But the scale of the fraud was not negligible, and it was profitable, and on the balance of probabilities the profits contributed to the sums that NT1 took out of the business.[122]Google relies on lending activities involving three companies (Oscar Ltd, Charlie Ltd, and Victor plc), and a group of companies owned or controlled by a Mr Twain, his family or associates (“the Twain Companies”). Google also relies on a number of other, smaller loan transactions. This activity started in the early years of the present century, shortly after the expiry of NT1’s prison sentence but at a time when he was disqualified from acting as a company director. My findings as to the lending activity undertaken during this period are set out and explained in detail in the Private Judgment. The main findings are these.(1) Between his release from prison and about 2015 the claimant used the monies to which I have referred above to engage in substantial commercial lending activities. Some of this was done via a Bahamian company, Charlie Ltd. I reject Google’s case that there was a related Swiss company called Charlie AG or similar, and that NT1 engaged in consumer lending. His lending was to businesses. I do not accept Google’s case that Charlie AG or Charlie Ltd lent at “extremely high rates of interest”. The scant evidence on the point is insufficient to support that case.(2) In the early 21st century, Charlie took a stake in an English private company called Bravo, to which it lent about £300,000. At the same time, NT1 entered into a 15-year consultancy agreement with Bravo, by which he was to provide up to 3 days a month of consultancy services for a fee. That fee was to increase by 10% each year. Within 2 years it had reached £66,000 per annum, which greatly exceeded the remuneration due to any director of the company. By that time, Charlie’s stake in Bravo had increased to about a quarter of the issued share capital. I do not accept NT1’s evidence that the consultancy fee was not paid. Having considered other possibilities, I accept Google’s case that NT1 was acting as a shadow director of Bravo during this period.(3) However, I do not accept Google’s case that there were serious failures of disclosure about NT1, when Oscar Ltd issued a prospectus for the takeover of Bravo and the listing of the business on the London Stock Exchange. The plan was for Oscar Ltd to acquire the entire issued share capital in Bravo, then change its name to Bravo plc, which would be the listed entity. Google’s case is that the representations in paragraph 7.6 of the Prospectus were false because they said that none of the “Directors expected nor any of the Proposed Directors” had any unspent convictions in relation to indictable offences, or had been a director of a company that had been placed in compulsory liquidation, or been criticised by any regulator, or disqualified from acting in the management or conduct of the affairs of a company. NT1 had acted as a shadow director of Bravo. If he thereby counted, or should have been counted, as one of the “Directors” or “Proposed Directors” those representations would have been false or misleading. Google’s case is that he did. It says the quoted terms referred to “the directors of [Bravo] or proposed directors of [Bravo plc].” I do not agree.(4) The term “Directors” was defined on p4 of the Prospectus to mean the directors of “the Company”, which was in turn defined to mean Oscar Ltd (Bravo plc, as it was to become). The Prospectus went further, and identified the Directors as those named on p3 of the Prospectus. The names that appeared there were those of directors of Oscar Ltd. The term “Proposed Directors” was also defined in the Prospectus, to mean six named individuals. These were men whom, it was proposed, would become directors of the listed company. It arguably might have been better, perhaps, if disclosure had been made about NT1, because he was a significant figure in the business of Bravo. But he was not a director or shadow director of Oscar Ltd. His role as an active “consultant” to, and shadow director of Bravo did not make him so. I am not persuaded by his evidence that he had nothing to do with the Prospectus; I rather doubt that is true. But given my conclusions on the allegations of misrepresentation it does not matter.(5) Over about 8 years after its flotation, Bravo plc raised some £16m in various tranches. It eventually went into insolvent administration with a deficiency estimated at over £14m.(6) Charlie lent a six figure sum to Victor plc, under a short-term loan agreement which provided for interest and a substantial “repayment premium”. Less than a year later, the parties agreed to convert this premium into equity, as a result of which Charlie owned over a quarter of the issued share capital of Victor plc, as well as being owed the amount of the original loan and interest. The evidence about this transaction is fairly scant, and rather unclear. The transaction documents themselves are not available, only descriptions of them. It is hard to know what to make of Google’s contention that the loan involved a “repayment premium” that was equal to the amount of the loan. My conclusion is that this was the case. The probable explanation is that the loan was a very high risk transaction, undertaken without any or any valuable security, to fund a speculative property development opportunity. I am not persuaded by Google’s case that this was an investment transaction on the part of Charlie. It took an equity stake because the property transaction did not come to fruition, Victor plc had no funds available, and to swap debt for equity was to make the best of a bad job.(7) NT1, via corporate vehicles, lent seven figure sums to Mr Twain, a former bankrupt, via the Twain Companies, which were property development businesses selling to consumers and investors. The main purpose of the loans was to fund the buy-out of someone who had been a partner of Mr Twain in the businesses. I am not persuaded by Google that this activity was investment, as opposed to lending. NT1 took a stake in the main corporate vehicle of the Twain Companies’ business, but that was by way of security for a relatively short period. Nor do I accept Google’s case that these business activities involved NT1 in some way in the conduct of a business similar to that of Alpha, which engaged in comparable sales practices towards consumers and investors. His role was as a lender not a participant in the business. A sales brochure for one of the Twain Companies that was put to NT1 in an attempt to support that case post-dated his involvement with the businesses, and did not support the comparison other than in a very broad fashion.(8) Other loans. Google has not established out its case that NT1 made other loans to consumers. Google referred to the activities of three companies, Zebra Ltd, Tango Ltd, and Uniform Ltd, in or between June 2011 and May 2015. Google had little information about these companies, relying on what NT1 fairly described as “generic descriptions that are so often provided in ... accounts ... when filed.” In this regard, I accept NT1’s evidence about the activities of the three companies, and that they were not dealing or proposing to deal with consumers.[123]I should set out here one finding on a point of detail, as it does not tend to identify the claimant and goes to credibility. The claimant initially said that Charlie Ltd was owned by a family trust of which he was a beneficiary, which may be correct. He was asked, “It is a company controlled by you as well as owned by your family trust?” His prompt answer was “No. The arrangements with the family trust do not allow me control.” Shortly afterwards, he admitted that he was able to use the company as his lending vehicle, and accepted that his earlier point had been “in that context … an artificial point.” This is an illustration of two more general features of the claimant’s evidence: its unreliability on quite important points of detail, despite the emphatic way was is given; and his reluctance to make an unequivocal concession. His patent unreliability in this regard is obviously relevant when assessing his evidence about the control of Alpha, and about his role in respect of Bravo. NT1’s online profile[124]For a period, over recent years, NT1 caused online postings to be made which spoke positively about his business experience, standing and integrity. Google describes these online postings – now removed – as “boasts”. It says they included claims that are “thoroughly misleading [and] dishonest”, and which need to be corrected by the true information which is, and for this reason should remain, available at the URLs complained of. The principal vehicle for these postings was a WordPress blog, though a variety of social media were also used. On the blog and at least one of the social media sites, claims were made that NT1 had gained recognition for his flawless professional integrity, few being better known for this characteristic. The social media sites also stated that NT1 had earned recognition for his business expertise gained over 25 years in consulting businesses. The actual wording used is set out in the Private Judgment. It clearly promotes the idea that NT1 is a man of unblemished integrity, with a longstanding reputation as such.[125]All this material came to be published as a result of instructions given by NT1 to a reputation management business, Cleanup. NT1’s evidence was that the only reason he consulted Cleanup was the continual availability of the URLs complained of. He had heard of adverse Google Search results being successfully removed by organisations such as Cleanup, whom he retained “in order to create material online that would detract from the negative postings”. The aim was to “demote” the negative material.[126]NT1 equivocated about his personal responsibility for the published content. In his witness statement he said that the postings were “material I have authorised to be published about me”, but went on to say that the sites were “designed and written by [Cleanup] with no input from me save that I approved the content and supplied the background information that they had requested from me.” He was, naturally, questioned about this account. At first, he claimed never to have seen a blog. Later, he conceded that he had been sent the wording to be posted online, but he never unequivocally admitted that he had read and approved any such wording.[127]The true position emerges with tolerable clarity from the documents. By email of 22 May 2014, Ms AF of Cleanup sent NT1 a questionnaire, in order to obtain information about him, on which to base the content which Cleanup was to prepare. He was urged to provide as much information as possible, included “achievements, accolades, …” The plan that AF set out in this email was for “our journalists” to use the questionnaire to create content which would then be sent back to NT1 “for approval”. The email made clear that “I will always make sure to send you all and any content before we put it live on the internet”. When this email was put to him NT1 started by answering evasively:
“She doesn't actually say it is for me to approve.”
When shown the full wording of the email again, he eventually agreed that it did say the wording was to be sent to him for approval, but qualified his admission by saying that it was a URL that was sent. That may be true. The papers include an undated Progress Report with URLs linking to the blog, and to postings at Smore and Livejournal. But I have no doubt the links were sent to NT1 before the posts went live, as well as afterwards. It is not credible that NT1 failed to follow those links on either occasion. He must have read what was to be posted, and approved it in both the formal and the substantive sense. The evidence suggests to me that the wording is in part standard-form, “boilerplate”, rather than tailored to the specific facts and circumstances of NT1’s career. But I have no doubt that it was put together in reliance on information provided by NT1 in response to Cleanup’s questionnaire, and that he knew of and approved the wording before it was posted.[128]NT1 did ultimately accept that he had omitted from these blogs, or allowed to be omitted from them, any reference to a criminal conviction. Leaving aside for the present any question of rehabilitation, it seems to me indisputable that the quoted statements about NT1’s integrity and reputation are false or at best highly misleading. The fact of his conviction for criminal dishonesty involving a £3.3m fraud is enough to falsify the assertions of integrity. There is however a good deal more that casts a long and dark shadow over his integrity, as set out in this judgment above. Moreover, it is his own case that his reputation has been injured by reporting of his conviction, and by reporting connecting him with the business of Alpha. The claims on the blog and social media are inconsistent with his own evidence in this case which, in this respect, I believe to be true. I also find that the blogs and social media presented a misleading picture of his business career, taken as a whole.[129]NT1’s case is not that these representations about him, his character, conduct and reputation were true. He denies, however, that the public was misled. He was not seeking to attract business or work, or otherwise addressing the public. He denounced as “disingenuous and dishonest” any suggestion that he was marketing himself. His evidence is that he was just seeking to demote the harmful information in the URLs complained of, by putting other positive information “out there”. His case is that he was justified in the attempt. Mr Tomlinson describes this as “an attempt at self-help”, which did not work in this case.[130]I have no evidence as to the extent of publication of the blog or the social media posts, but the more important question is whether they were aimed at the public. It is obvious that they were. It may well not have mattered to NT1 whether he gained business, but that is not really the issue; it was not put to him that he was marketing himself. His objectives could only be achieved by putting out messages about himself on public platforms which were then picked by by Google’s web crawlers. He was content to do this using messages that he knew to be false and misleading. That is, however, subject to this point: I recognise a risk that Google’s criticisms are circular. If harmful information about a person is being made available to the public in a way that is unlawful, it might be unjust - without more - to criticise that person for using self-help methods of removing that information from the public domain by demoting it in ISE search results. The claimant’s dealings with Cleanup began two months after his conviction became retroactively spent. Whether, paying due regard to the principle of rehabilitation, the claimant is still to be criticised for making these representations is a matter I will have to address in my overall assessment of where the balance lies. Law[131]Two further points of dispute about the nature of the balancing exercise need to be addressed before I carry out that exercise. The first concerns the state of the scales, at the outset: are they tilted in favour of the data subject, as a matter of principle, as Mr Tomlinson submits? The second point concerns the boundaries to be observed in making my assessment. Google relies on a number of factors that are not, or not in terms to be found in the Working Party criteria: the nature of the third party publishers; the public availability of the information; the nature of the information and the alleged inaccuracies; the claimant’s business activities and their relationship with the information published at the URLs complained of; and the claimant’s own online descriptions of himself. Mr Tomlinson derides this as a process of Google “inventing its own criteria”. He argues that those factors partly overlap with the Working Party criteria, but also go beyond them; that some are irrelevant, or of little weight; and that the exercise is “unhelpful”.[132]In my judgment, the balancing process in any individual delisting case is ordinarily, as a matter of principle, to be entered into with the scales in equal balance as between delisting on the one hand and continued processing on the other. I say that on the basis that such cases will ordinarily engage the rights protected by Articles 8 and 10 of the Convention and, for so long as European law is part of our domestic law, their counterparts under the Charter, as well as the right to freedom of information contained in Article 11 of the Charter. Accordingly, with appropriate adaptation, the In re S approach must be followed: neither privacy nor freedom of expression “has as such precedence over the other”; the conflict is to be resolved by an “intense focus on the comparative importance of the specific rights being claimed in the individual case”.[133]I do not read Google Spain as inconsistent with this. What the CJEU was saying, in the passages at [81] and [97] on which Mr Tomlinson relies, is that in the majority of cases of this kind the facts will be such that the factors in favour of delisting will outweigh those in favour of the continued availability of the data, via an ISE. The “general rule” to which the court was referring was a descriptive, not a prescriptive one. One factor in that conclusion was that the economic interests of an ISE are not of equal inherent weight or value to the privacy or data privacy rights of an individual. But the Court was not saying the same thing about the rights of the public to receive information and opinions. That would seem to be at odds with principle and authority.[134]Mr Tomlinson has not cited any authority to support the two propositions of law which he offers by way of explanation: that the right to receive information is inherently less weighty than the right to impart it; and that Google’s activities do not even involve the exercise of the right to freedom of expression. The second of these propositions would appear to be at odds with Google Spain in which, at [73-74], the CJEU agreed with the suggestion made by the Advocate-General (at [95]), that the legitimate interests pursued by ISEs include two, “namely(i) making information more easily accessible for Internet users;(ii) rendering dissemination of the information uploaded on the Internet more effective”, which “relate respectively to … fundamental rights protected by the Charter, namely freedom of information and freedom of expression (both in article 11)”. I would regard the CJEU’s references to a “general rule”, and its observation that a claim to delist sensitive or other private information may be defeated by a “preponderant” interest of the general public in having access to that information, as descriptions of how cases of this kind are most likely to work out in practice; but not as tantamount to a declaration that the public’s interest in access to information is inherently of lesser value than the individual’s privacy rights. I note that the Working Party commentary seems consistent with my assessment. It suggests that “In determining the balance ... the jurisprudence of the [ECtHR] is especially relevant”.[135]As for the criteria relied on by Google, some may go a little outside the Working Party criteria, but there is nothing wrong in principle there. The criteria were created over three years ago, within seven months of the Google Spain decision, on the basis of the early experience of the new regime. They are expressed to be flexible, nonexhaustive, and liable to “evolve” over time on the basis of experience. The factors relied on by Google in this case all seem to me to have some bearing on the issue for decision, and in particular on the question of whether the data remain “relevant”, or are “excessive”, or have been “kept for longer than is necessary” within the Third and Fifth Principles. I shall aim so far as possible to weave my consideration of Google’s points into my review of the 13 Working Party criteria. For consistency with the DPA, I shall refer to data in the plural. Application of law to facts (1) Does the search result relate to a natural person – i.e. an individual? And does the search result come up against a search on the data subject’s name?[136]Yes. This is the starting point, without which no delisting claim would be viable. (2) Does the data subject play a role in public life? Is the data subject a public figure?[137]NT1 has never been in politics, or held any public office, or played a role in public affairs. Nor has he been a sportsman, entertainer, or engaged in other highly public areas of life. He is and has always been in business. But the Working Party commentary on this criterion suggests a broader meaning for the term “public figures”:
“individuals who, due to their functions/commitments, have a degree of media exposure.”
The criterion of “playing a role in public life” is broader still. The Working Party offers illustrations which include “business-people and members of the (regulated) professions”, explaining that the key factor is the potential relevance of information about the individual:
“A good rule of thumb is to try to decide where the public having access to the particular information – made available through a search on the data subject’s name – would protect them against improper public or professional conduct.”
[138]By these standards, NT1 was a public figure, with a role in public life, in the closing years of the last century, and the early years of this one. He was reasonably wellknown to the public at large as a person who played a leading role in a controversial property business, who was tried, convicted, and sentenced for criminal conspiracy in connection with that business and charged but never tried for another conspiracy. His name appeared in public statements, such as from the regulator, and in reports of the criminal proceedings. The “rule of thumb” would have favoured the continued availability of accurate information about his conduct and in particular his misdeeds. Since he left prison over a decade ago, he has played a role in business, but he has not been a public figure. Mr Tomlinson accepts that he has “played a role in public life” for present purposes but describes this as “extremely limited”. That is a fair point. NT1’s business role has not been a leading or prominent one. His social media postings are misleading in that respect. Plainly, therefore, the argument that the public needs to know about his past to guard against impropriety has gradually weakened over time.[139]But as the Working Party commentary on this criterion makes clear, the degree of privacy that attaches to the information is also a relevant factor. Another Working Party “rule of thumb” is that “if applicants are public figures, and the information in question does not constitute genuinely private information, there will be a stronger argument against de-listing”. Mr Tomlinson has reminded me in this context of the well-known passage in von Hannover v Germany (No 1) (2005) 40 EHRR 1 [63] which identifies a “fundamental distinction ... between reporting facts capable of contributing to a debate in a democratic society and reporting details of the private life of an individual who does not exercise such functions.” The passage is cited by the Working Party. Mr Tomlinson argues that there is no current debate to which NT1’s past behaviour has any relevance. That may be true. But the criterion does not require an extant debate; the test is whether the information is “capable of contributing” to a debate of the kind referred to. More importantly, the principle is concerned with “details of the private life of an individual”. Mr White submits that the information in this case is not of that kind, or that most of it is not. It relates wholly or mainly to the claimant’s criminal conduct in a public role in the management of a company selling services to the public, not to his private or personal life. He invites comparison with Yeo v Times Newspapers Ltd [2015] EWHC 3375 (QB) [2017] EMLR 1, and Axon v Ministry of Defence [2016] EWHC 787 (QB);[2016] EMLR 20. In the former case, I held at [147] that information about a politician’s offer to help a company by using his public office was of such a nature that it fell outside the ambit of his private or personal life. In the latter case, at [41]-[49], Nicol J reached a similar conclusion about information relating to the events leading to the removal of a Royal Navy warship commander from that role.[140]I agree with Mr White. The information here includes some about NT1’s health (“the health information”). This is intrinsically private in nature but it is vague, and historic, and it was made public in the course of the proceedings. For those reasons, and others I shall explain, it could not justify a stand-alone delisting claim and adds little if any weight. The rest of the information (“the crime and punishment information”) is “sensitive”, but it is not intrinsically private in nature. The criminal behaviour has a private aspect in that it was undertaken in secret, and not intended for public view. But it was not intimate or even personal. It was business conduct, and it was criminal. Having been identified and then made the subject of a public prosecution, trial and sentence, it all became essentially public. The authorities do show that information that begins as public may become private, and that Article 8 may be engaged by dealings with information, of whatever kind, that have a grave impact on the conduct of a person’s private life - for instance by undermining their “personal integrity” - or by interfering with their family life: see the discussion in Yeo at [141]-[146]. But the essential nature of the crime and punishment information in this case was public, not private. The claimant did not enjoy any reasonable expectation of privacy in respect of it during the process of trial, conviction, and sentencing. If the right to respect for private or family life interest had been engaged at that time there is no room for doubt that the open justice principle would have roundly trumped it, for the reasons given in CG v Facebook, Khuja, and Re Trinity Mirror ([49(4), [61] and [111] above). One key question in this case is how that position is affected by the passage of time. (3) Is the data subject a minor?[141]No. He was and has remained at all material times a mature adult. He has full capacity. (4) Are the data accurate?[142]For the reasons I have given, I do not consider that the information has been shown to be inaccurate in any material way. (5) Are the data relevant and not excessive?(a) Do the data relate to the working life of the data subject?(b) Does the search result link to information which is allegedly constitutes hate speech/slander/libel or similar offences in the area of expression against the complainant?(c) Is it clear that the data reflect an individual’s personal opinion or do they appear to be verified fact?[143]The crime and punishment information is not hate speech, or libel. It does relate to the claimant’s working life, and appears to be (and is) factual. The sub-questions do not, however, exhaust the factors that bear on whether data are relevant or excessive. On the facts of this case, I do not believe that anything turns on the requirement that data be not “excessive”. No fine distinctions are to be drawn. When it comes to relevance, the question begged is of course “relevant to what?” The Working Party commentary identifies the “overall purpose of these criteria”. It is “to assess whether the information contained in a search result is relevant or not according to the interest of the general public in having access to the information” (emphasis added). Relevance is “closely related” to the age of the data, so that “Depending on the facts of the case, information that was published a long time ago, e.g. 15 years ago, might be less relevant that information that was published 1 year ago.” The commentary goes on to observe that:
“Data protection - and privacy law more widely - are primarily concerned with ensuring respect for the individual’s fundamental right to privacy (and to data protection). Although all data relating to a person is personal data, not all data about a person is private. There is a basic distinction between a person’s private life and their public or professional persona. The availability of information in a search result becomes more acceptable the less it reveals about a person’s private life.”
Both the example and the statement of principle are pertinent in this case. The information was in the main not private, and it was relevant; its relevance has faded, but the essentially public character of most of the information has not altered. One factor, naturally, is whether (as the Working Party put it) the data subject is “still engaged in the same professional activity”. NT1 is not, but he is still in business. Customers and others are affected by his activities, but not consumers. His impact on the world of business and that of consumers is much reduced from what it was. Again, attention is directed to what has changed with the passage of time.[144]Google advances two further factors in support of its case on relevance:(i) it is said that those who deal or might deal with companies associated with NT1 need to know about his business background, including his conviction and sentence;(ii) NT1’s social media profile shows that there is a need to correct the record. I shall return to these points when I consider criterion 13. (6) Is the information sensitive in the meaning of Article 8 of the Directive?[145]The reference is to data in “special categories”, for which “sensitive” is the English term. For practical purposes, all the information qualifies as sensitive. The significance of this is explained in the Working Party commentary:
“As a general rule, sensitive data ... has a greater impact on the data subject’s private life than ‘ordinary’ personal data. A good example would be information about a person’s health, sexuality or religious beliefs.”
The health information in this case is not of any great weight, however. It is old. It is “out of date”. But that does not of itself demand de-listing. Not all disclosures of health data call for the same treatment. AsLady Hale said in Campbell v MGN Ltd [2004] UKHL 22 [2004] 2 AC 457 [157], “The privacy interest in the fact that a public figure has a cold or a broken leg is unlikely to be strong enough to justify restricting the press’s freedom to report it. What harm could it possibly do?” The health information in this case is different, but the same can be said. NT1’s evidence contains no complaint of any separate or distinct harm that is said to result from the disclosure of that information, which would surely not have been complained of in isolation. It is an incidental but integral part of the overall story. It is the crime and punishment information about which there is a real issue. If the balance is struck in favour of delisting that information, it will disappear from search results, and the health information will disappear with it. But the reverse would plainly be unjustifiable. sexuality or religious beliefs.” (7) Are the data up to date? Are the data being made available for longer than is necessary for the purpose of the processing?[146]The Working Party identifies the objective of this criterion as ensuring that “information that is not reasonably current and that has become inaccurate because it is out-of-date is de-listed”. The health information is not current. It is out of date and in that sense inaccurate; but it is an accurate picture of the historic position and does not purport to be anything more. Its disclosure is trivial. All the crime and punishment information is historic, but it is not for that reason inaccurate. Whether that information is being made available for longer than necessary is the main issue in the case. This criterion offers no separate guidance. (8) Is the data processing causing prejudice to the data subject? Do the data have a disproportionately negative privacy impact on the data subject?[147]The CJEU made clear in Google Spain that the claimant in a delisting case does not need to prove prejudice (or harm, as I shall call it). But it is not controversial that, as the Working Party commentary puts it, “where there is evidence that the availability of a search result is causing prejudice to the data subject, this would be a strong factor in favour of de-listing”.

(a) of the DP Directive (the origin of DPA s 10):

“compelling legitimate grounds relating to his particular situation”
. An illustration is given, which does not fit the present case, but has some relevance:
“The [processing of the] data might have a disproportionately negative impact on the data subject where a search result relates to a trivial or foolish misdemeanour which is no longer – or may never have been – the subject of public debate and where there is no wider public interest in the availability of the information.”
I have added the words in brackets, as they must be implied. Information does not harm a person, only what is done with it.[148]The claimant’s case on harm is pleaded in paragraph 12 of his Particulars of Claim, and the evidence of harm is to be found in his witness statement. There are no other statements, nor is there any other evidence of harm. The evidence does not reveal how many searches have been or are being made using the claimant’s name. No allegation as to the extent of disclosure was made in the Particulars of Claim, and nobody seems to have thought of investigating the issue.[149]Paragraph 12 of the Particulars of Claim alleges that the processing has caused the claimant “substantial damage and distress” under three main headings.(1) Treatment as a pariah in his personal, business, and social life with a consequent significant effect on his previously outgoing personality. He is said to live “in fear that anyone he does meet will inevitably look him up using the Defendant’s search engine and subsequently and as a result shun him.”(2) Threats made in public places by “people referring to the content still linked by the Defendant’s search engine and seeking to extract money from him in consequence.”(3) Disruption of his family life by the effect of the Defendant’s search engine results. NT1 says that his wife has become withdrawn and insecure and faced questions from her friends about the search results. “This in turn has affected adversely the quality of the Claimant’s personal, private and family relationships with each of his children and his wife.”[150]Some further information is provided in the Confidential Schedule to the Particulars of Claim, and ten paragraphs of the claimant’s witness statement are devoted to the topic of the impact of the continued availability of the information. These reiterate the above and provide some elaboration. As Mr Tomlinson points out, none of this was challenged in cross-examination. But that does not prevent me from making my own assessment of the evidence. Adopting the criterion specified in Article 14(a) of the DP Directive. I find that the claimant’s case on harm is for the most part a legitimate one, though not entirely so; and it is not, overall, a particularly compelling one.[151]There are causation issues here, of course. The relevant harm is that which is being or will be caused by the processing which the claimant seeks to prevent. He cannot place any great weight on harm which would result in any event. So this, it seems to me, is one context in which I need to consider Google’s “public domain” argument: the issue of harm needs to be considered in the light of the fact that the information in question will continue to be available on the source websites, and in a number of other locations on the internet. I am not greatly impressed by this argument. Accessibility is not the same thing as actual access. The CJEU was surely right to point out in Google Spain that information distribution via ISEs is inherently different from and more harmful than publication via source websites. The reality is that few are likely to locate the crime and punishment information otherwise than through a search engine. That raises the question of what a Google search on the claimant’s name would look like if the three URLs complained of were removed. Nobody has led evidence on that issue. But I can infer, from the two pages of snippets from a search in mid-February 2018 that are in evidence, that the other third party websites would not feature on the first two pages of a search. That said, it is also true that NT1 cannot rely on any harm that results from legitimate processing in the past. As his witness statement concedes, “up to a point the fact of my conviction is to blame” for the harm to personal and professional relationships of which he complains. It is not just that his own conduct is one cause of that harm. Many will have got to know the crime and punishment information as a result of earlier, legitimate, communication via Google or otherwise, at a time when the conviction was not spent. This is particularly true of pre-existing contacts, both business and personal.[152]This is pertinent when I consider the evidence in support of the pleaded complaint of “threats”. The only such evidence relates to incidents when NT1 was in prison, serving his sentence, and some incidents shortly after he was released. This is all significantly more than 15 years ago, well over a decade before NT1’s first complaint, and over 7 years before his conviction became spent. This is significant harm, but it cannot count as harm that resulted from any illegitimate processing by Google.[153]Nor can the only specific incident recounted by NT1 in which a business deal was expressly hindered by the counterparty’s knowledge of his conviction. This was some 9 years ago and, as NT1 acknowledges, this too was before the conviction became spent. There is evidence that two bank accounts were closed in 2013. NT1, in a single sentence, attributes this to the availability of information about the conviction. That may be so, but the bank did not say so, there has been no disclosure nor any other evidence about the matter, and I am unable to draw that inference. The other evidence of business harm is vague in the extreme, with no names, dates, or details. NT1’s evidence is that he has never been offered employment since he left prison. But he does not say that he has applied for employment, and I do not consider I would be justified in drawing the inference that his lack of an employed job, as opposed to selfemployment, is due to processing by Google since the conviction became spent. I would accept that knowledge of the claimant’s conviction has affected his business life to some degree, and the continued availability of the crime and punishment information since the conviction may have had some impact; but in the end, it is really impossible to reach a conclusion on the evidence before me that this aspect of his life has been significantly prejudiced by the continued availability of the crime and punishment information via Google search in recent years.[154]Turning to the claimant’s private and family life, the evidence that he has been “treated as a pariah” in his social life is entirely general in nature. It amounts to little more than a reiteration of the pleaded case. No specific incidents of any kind are recounted, despite the lengthy period with which we are concerned. The position is similar so far as the claimant’s evidence about the impact on his family life is concerned. Indeed, it is less satisfactory. No specific mention is made of the claimant’s wife, so the evidence falls short of the pleading. The evidence consists largely of generalities about the impact on the claimant’s adult children, and the effect on him of their distress. Details of specific incidents, or even of the nature of the impact, are lacking. As Mr Tomlinson acknowledges, impacts on relationships with adult children who are not part of the claimant’s household do not engage “family life” within Article 8; in this context, “… neither blood ties nor the concern and affection that ordinarily go with them are, by themselves or together, in my judgment enough to constitute family life”: Kugathas v Secretary of State for the Home Department [2003] EWCA Civ 31 [19] (Sedley LJ), [30]-[31] (Simon Brown LJ). The impact on the rights of persons other than the claimant is a legitimate consideration, when assessing the legitimacy of a communication. The claimant’s distress at the impact on others, or “reflexive” distress, is also a legitimate head of harm, properly to be considered under the heading of interference with his private life. But the absence of statements from any of the family members themselves is surprising. It is wellestablished that where a party seeking to restrain freedom of expression wishes the Court to give weight to the impact on others, he will generally be expected to adduce evidence from those others, or explain why such evidence is not before the Court: YXB v TNO [2015] EWHC 826 (QB) [18].[155]Standing back from the detail, a substantial part of the claimant’s evidence and, in my judgment, a major part of his concern, about the continued availability of this information is business-related. But much of this is of some age; the evidence is for the most part general; and there are real causation issues. I accept that the continued availability of the information via Google Search in recent years has had some impact on the claimant’s private life, of the kinds that he identifies. But much of that impact will inevitably have been felt as a result of earlier, legitimate communications. As for the present and future, the impact appears to me to be mainly consequential on the impact on the feelings of the claimant and his family of the fact that the crime and punishment information is “out there”, available to anybody who searches on the claimant’s name. There is clearly a real concern that the claimant and his family will be shunned and avoided by those who, now and in the future, come to learn via Google of the crime and punishment information. That is a natural and reasonable concern, given the nature of the information. It can easily be inferred that some adverse impact of that kind will result. But it remains the fact that there is nothing concrete to which the claimant can point; there is no corroborative evidence from the family members whom the claimant prays in aid; and there are again causation issues. In short, this case is not closely comparable to the illustration given by the Working Party, and the evidence of harm or “prejudice” does not add great weight to the case in favour of delisting. (9) Does the search result link to information that puts the data subject at risk?[156]No. (10) In what context was the information published?(a) Was the content voluntarily made public by the data subject?(b) Was the content intended to be made public? Could the data subject have reasonably known that the content would be made public?[157]The Working Party commentary on this criterion focuses on consent, suggesting that if this was the only justification for the original processing, revocation of consent may make delisting appropriate. Those considerations are not directly relevant here. The claimant did not consent, and the initial publication had a different justification. But it is relevant that the information was published in the national media, in substantially fair and accurate reporting of legal proceedings held in public, and related reporting which has not been shown to be inaccurate. The legal proceedings, and the media coverage of them, were both natural and probable and foreseeable results of the dishonest criminal conduct in which the claimant deliberately engaged. Again, one is brought back to the question of what has changed with the passage of time.[158]One factor that I do not consider this claimant can legitimately pray in aid is any legitimate expectation of rehabilitation, enjoyed when he left prison. His witness statement asserts that “When I left prison, I looked towards completing my rehabilitation and being able to start over. I understood that the law recognises this, in that my conviction would eventually become “spent” (which it did on …) …”. He was not challenged about this, but it cannot be true - unless he misunderstood the law or had a crystal ball. As explained above (at [16(1)]), if the law had remained as it stood when NT1 left prison, his conviction would never have become spent. He cannot have had any legitimate expectation that this would occur until the changes wrought by LASPO came into effect, which was well over a decade after he left prison. (11) Was the original content published in the context of journalistic purposes?[159]Yes, though Mr Tomlinson submits that the Book Extract is for advertising purposes. This issue has received little attention, and I treat the information as journalistic in its origin and at least predominantly journalistic in its overall character. “The fact that information is published by a journalist whose job is to inform the public is a factor to weigh in the balance”, says the Working Party commentary. It is a factor of some weight, in particular because of the subject-matter: crime, and related legal proceedings. But the fact that the information is a media report of that kind is not of itself enough, because the Google Spain ruling “clearly distinguishes between the legal basis for publication by the media, and the legal basis for search engines to organise search results based on a person's name”. (12) Does the publisher of the data have a legal power – or a legal obligation – to make the personal data publicly available?[160]There is no obligation, of course. The question of whether the publishers have a legal power to continue publishing has not been debated. It is no part of Mr Tomlinson’s case that it does not. A delisting claim does not require a claimant to advance or establish such a contention. That is clear from Google Spain. It is common ground that the newspaper publisher has received and rejected a complaint, and that no proceedings have been brought against it. I proceed on the basis that the publisher will continue to make the information publicly available on its website, and that it would be entitled to do so. I also take into account, to the limited extent I have already identified, that access to the information is and will continue to be available via a number of other websites. (13) Do the data relate to a criminal offence?[161]This, in my view, is the single most important criterion in the present case. The Working Party commentary says this about it:
“EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. DPAs will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the de-listing of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis.”
[162]A review of the rehabilitation laws of Member States conducted by Google’s solicitors, Pinsent Masons, has been put before me. It suggests that there is indeed a diversity of approach across the EU. The existence of a rehabilitation law of some kind would appear to be universal, but there seem to be a variety of methods and criteria for establishing when a given conviction should become spent, and some differences in the consequences when it does. The methods include rehabilitation based on sentence, the passage of time, and individual judicial assessment. The review is at a high level of generality, and has been subject to some mild criticism by Mr Tomlinson. It is certainly not admissible evidence of foreign law. What is clear, however, is that the Working Party considered it to be consistent with Google Spain for individual jurisdictions to apply their own domestic rehabilitation laws, even if these diverge from those of other Member States. That is consistent with the margin of appreciation afforded to states when implementing the DP Directive, the Convention, and Charter.National laws must be interpreted and applied consistently with those instruments. But nobody in this case suggests that there is any single, transnational, rule or set of rules to which resort can be had to provide an answer in this context. With that in mind, I shall aim to follow the guidance of the Working Party by identifying the relevant domestic principles, and applying them to the particular facts of this case.[163]The starting point has to be the 1974 Act. The high point of the claimant’s case, as presented by Mr Tomlinson, is couched in the language of s 4 of the 1974 Act: in opening it was submitted that the claimant “is entitled to be treated for all purposes as a person who has not committed or been charged with or prosecuted for or convicted of or sentenced for the offence or offences which were the subject of” the conviction. Mr Tomlinson must be right when he relies on s 4 to show that there is a strong public policy in favour of the rehabilitation of criminal offenders. For the ICO, Ms Proops has offered some support for that approach, submitting that the public policy principle underpinning the Act is that, “once a criminal has served his or her time, it is important that the ability of that individual to rehabilitate themselves is not unduly prejudiced”. But Ms Proops does not go all the way with Mr Tomlinson’s opening submission. In her submission, in a delisting case involving a spent conviction, it would be wrong automatically to assume that the balance tips in favour of continued indexation or alternatively in favour of de-indexation. Rather each case must turn on its own individual facts, albeit that “the fact that the conviction is spent ought generally to weigh heavily in the balance in favour of de-indexing the relevant website.” By the end of the trial, Mr Tomlinson had adopted that line of argument. His case is that “the fact that a conviction is spent is not determinative” but it is weighty.[164]For Google, Mr White acknowledges that the fact that the claimant’s conviction is spent is a relevant factor, but he argues that for a variety of reasons it carries relatively little weight on the particular facts of the case. As a fall-back from his “abuse of process” argument ([58-60] above), Mr White relies on s 8 of the 1974 Act as an important statement of Parliamentary policy which points in the opposite direction from s 4 and, he argues, is weighty in this case. That submission is resisted by Mr Tomlinson and Ms Proops, on the basis that s 8 is irrelevant given that this is not a claim for libel or slander.[165]Behind these competing submissions lie some obvious difficulties. It is not a simple matter of applying s 4 of the 1974 Act, without regard to other factor or considerations. Such a hard-edged approach would be incompatible with human rights jurisprudence, and the fact-sensitive approach that is required. The argument for the ICO, and the argument with which Mr Tomlinson ended up, acknowledge as much. The Court’s task is to interpret and apply the will of Parliament as expressed in a statute passed some 25 years before the advent of the internet, to a set of facts of a kind that Parliament cannot then have foreseen; to do so consistently with the will of Parliament as expressed via the HRA in 1998; and to do so in the light of the fact that it was not until 2004 that the Courts identified the existence of the common law tort of misuse of private information. The conclusions arrived at then have to be fitted into the scheme of the “right to be forgotten”, first authoritatively recognised in a CJEU judgment of 2014 by which this Court is bound, by reason of the 1972 Act.[166]Without attempting to be exhaustive I have arrived, for the purposes of these cases, at the following reconciliation:(1) The right to rehabilitation is an aspect of the law of personal privacy. The rights and interests protected include the right to reputation, and the right to respect for family life and private life, including unhindered social interaction with others. Upholding the right also tends to support a public or societal interest in the rehabilitation of offenders. But the right is not unqualified. It will inevitably come into conflict with other rights, most notably the rights of others to freedom of information and freedom of expression. It is not just legitimate but clearly helpful for Parliament to lay down rules which clearly prescribe the point at which a given conviction is to be treated as spent. But such rules, depending simply on the offender’s age and the nature and length of the sentence, can only afford a blunt instrument. Parliament has legislated for exceptions, but these cannot be treated as necessarily exhaustive of the circumstances in which information about a spent conviction may be disclosed. More subtle tools are needed, if the court is to comply with its duty under the HRA to interpret and apply the law compatibly with the Convention. Section 4 of the 1974 Act must be read down accordingly as expressing a legal policy or principle.(2) The starting point, in respect of information disclosed in legal proceedings held in public, is that a person will not enjoy a reasonable expectation of privacy (Khuja, [61] above). But there may come a time when they do. As a general rule (or “rule of thumb”, to adopt the language of the Working Party), the point in time at which Parliament has determined that a conviction should become spent may be regarded as the point when the convict’s Article 8 rights are engaged by any use or disclosure of information about the crime, conviction, or sentence (see T, [49(2)] above). But this does not mean that in 1974 Parliament enacted a right to confidentiality or privacy from that point on (Pearson, L v The Law Society, [47-48] above). Still less does it follow that the convict’s Article 8 rights are of preponderant weight, when placed in the balance. As a matter of principle, the fact that the conviction is spent will normally be a weighty factor against the further use or disclosure of information about those matters, in ways other than those specifically envisaged by Parliament. The starting point, after all, is the general policy or principle in favour of that information being “forgotten”, as expressed in s 4 of the 1974 Act. That policy has if anything become weightier over time. It is likely that in many cases the particular circumstances of the individual offender will support the application of that general principle to his or her case. But the specific rights asserted by the individual concerned will still need to be evaluated, and weighed against any competing free speech or freedom of information considerations, or other relevant factors, that may arise in the particular case.(3) Part of this balancing exercise will involve an assessment of the nature and extent of any actual or prospective harm. If the use or disclosure causes, or is likely to cause, serious or substantial interference with private or family life that will tend to add weight to the case for applying the general rule. But where the claim relies or depends to a significant extent upon harm to reputation, the Court is in my judgment bound to have regard to s 8 of the 1974 Act. It is possible to identify a public policy that underlies that section, and which qualifies the public policy that underpins s 4. It is that offenders whose convictions are spent should not be able to obtain remedies for injury to their reputation (or consequent injury to feelings) resulting from the publication in good faith of accurate information about the spent conviction, or the related offending, prosecution or sentence. It is not a satisfactory answer to this point to say that the causes of action relied on are not libel or slander, but data protection and/or misuse of private information. That is too narrow and technical an approach, which ignores the fact that neither cause of action was known to Parliament when it legislated. The fact that, as I accept, reputational harm can support a claim under those causes of action tends, in fact, to undermine the force of that argument. I therefore do not accept that the policy that underlies s 8 falls to be disregarded merely because the claim is not framed in defamation. Again, there can be no bright line, because Convention jurisprudence shows that reputational harm can be of such a kind or severity as to engage Article 8 (Yeo, [140], above); but subject to considerations of that kind I would consider that this statutory policy or principle falls to be applied by the Court.(4) Another aspect of the proportionality assessment will be the nature and quality of the societal benefits to be gained in the individual case by the use or disclosure in question. Freedom of expression has an inherent value, but it also has instrumental benefits which may be weak or strong according to the facts of the case. The fact that the information is, by its very nature, old will play a part at this stage also.(5) Most, if not all, of these points about spent convictions are likely to be relevant in more than one context. Where a spent conviction is the subject of a delisting claim, the Court will need to weave its evaluation according to domestic principles into the overall Google Spain balancing exercise. The Working Party criteria are a key tool for this purpose. One matter that Ms Proops rightly identifies as needing due weight at this stage is fact that de-indexation does not per se remove the source websites containing the relevant data from the online environment. It merely makes that data harder for the public to find.[167]In this case, the following factors from the domestic legal context would appear to be of some importance. First, NT1’s case lies at the very outer limit of the statutory scheme. His sentence was such that, under the law as it stood from 1974 to 2014, it would never have become spent. Thanks to the LASPO amendments, since March 2014 his case has been positioned on the very cusp of the scheme. If his sentence had been one day longer, it would still be disqualified from ever becoming spent. Moreover, the fact that the sentence qualifies for rehabilitation is adventitious. The sentencing remarks make clear that the sentence would have been longer but for a matter of personal mitigation, which had no bearing on culpability, and no longer applies. Secondly, NT1’s case on harm is not especially compelling. It is largely to do with harm to reputation. The policy of the 1974 Act militates against granting a remedy to prevent harm of that kind. There is of course no question of Google acting maliciously. Factors that might prevail over the statutory policy are absent. Much of the evidence of harm is to do with harm to business reputation, and business activity. This does not engage Article 8. The claimant’s case on interference with family life is very weak, and his case on interference with private life is not strong.[168]On the other side of the equation, I would accept Google’s case on relevance, to this extent. For a period of time after the date on which NT1’s conviction is to be treated as spent, it has been of some relevance to a relatively limited number of people with whom this claimant had business dealings to know about his dishonest criminal past; there were people who had a legitimate interest in having that knowledge, in order to make informed decisions about dealing with him. His criminal past was also relevant, during that period, to anybody who read or might read the blog and social media postings which the claimant, via Cleanup, put out about himself. Those postings were false or misleading, and in my judgment unjustifiably so. It was quite unnecessary, in order to achieve the claimant’s stated objective of demoting the offending URLs, to put forward such clear and gross misrepresentations of his business history and his actual or reputed integrity. The fact that the claimant took down the posts after Google served a Defence relying on the misrepresentations they contained, is telling. The inference I draw is that he was reacting to what, having taken legal advice, he saw as a criticism of some merit. His attempts to offer other explanations were unconvincing. The continued accessibility of substantially fair and accurate information to the contrary served the legitimate purpose of correcting the record. These purposes might perhaps have been served by means other than making the information available via Google or another ISE, but it is not easy to see how.[169]That said, Mr Tomlinson has a point when he argues that, if there was ever any need for anyone to know these matters for these reasons, it has been met, because HMRC know about it all, and the information has been available to others via Google. The issue that is relevant to the delisting claim is whether, even if the information ever was relevant in these ways, its relevance has now been exhausted. Mr Tomlinson argues that it has. I am not so sure. A number of factors seem to me in combination to make the crime and punishment information of some continuing relevance to the public’s assessment of the claimant. His conviction was for serious dishonesty, on a substantial scale. He has very obvious difficulties in acknowledging his guilt, as opposed to the fact of his conviction. My assessment is that he does not consider himself to have been guilty, and that the conviction and the sentence both still rankle with him. He has not persuaded me that it was inaccurate to implicate him in the further fraud of which others were convicted. In recent years, he has engaged in crude attempts to re-write history, via his blog and social media postings. The content was clearly misleading, and he approved it. He was initially evasive and at all times quite unapologetic about this. I found him to be an unreliable witness, whose evidence was not always honest. He remains in business, dealing with large sums. He is not, in that respect, by any means a recluse. It may be that delisting would not present a risk to the public revenues but the dangers do not in my judgment end there. I accept Mr White’s submission that the claimant’s conduct, including his evasive and dishonest conduct in the witness box, demonstrates that he cannot be trusted to provide an accurate account of his business background or credentials to those with whom he comes into contact in the course of business now and in the future.

Overall assessment

[170]The key conclusions I have drawn are these. Around the turn of the century, NT1 was a public figure with a limited role in public life. His role has changed such that he now plays only a limited role in public life, as a businessman not dealing with consumers. That said, he still plays such a role. The crime and punishment information is not information of a private nature. It was information about business crime, its prosecution, and its punishment. It was and is essentially public in its character. NT1 did not enjoy any reasonable expectation of privacy in respect of the information at the time of his prosecution, conviction and sentence. My conclusion is that he is not entitled to have it delisted now. It has not been shown to be inaccurate in any material way. It relates to his business life, not his personal life. It is sensitive information, and he has identified some legitimate grounds for delisting it. But he has failed to produce any compelling evidence in support of those grounds. Much of the harm complained of is business-related, and some of it pre-dates the time when he can legitimately complain of Google’s processing of the information. His Article 8 private life rights are now engaged, but do not attract any great weight. The information originally appeared in the context of crime and court reporting in the national media, which was a natural and foreseeable result of the claimant’s own criminal behaviour. The information is historic, and the domestic law of rehabilitation is engaged. But that is only so at the margins. The sentence on this claimant was of such a length that at the time he had no reasonable expectation that his conviction would ever be spent. The law has changed, but if the sentence had been any longer, the conviction would still not be spent. It would have been longer but for personal mitigation that has no bearing on culpability. His business career since leaving prison made the information relevant in the past to the assessment of his honesty by members of the public. The information retains sufficient relevance today. He has not accepted his guilt, has misled the public and this Court, and shows no remorse over any of these matters. He remains in business, and the information serves the purpose of minimising the risk that he will continue to mislead, as he has in the past. Delisting would not erase the information from the record altogether, but it would make it much harder to find. The case for delisting is not made out. The Misuse Issues (1). A reasonable expectation of privacy?[171]My conclusions on this and the next issue have already been substantially identified. The information at issue is public not private in nature. At the time of his prosecution, conviction and sentence Article 8 was not engaged and the claimant had no reasonable expectation of privacy. That has changed with the passage of time, the fact that recent amendment of the 1974 Act has made his conviction spent, and the impact on his private life of the continued accessibility of the crime and punishment information. Although the claimant’s main concern is reputation, and primarily business reputation, there is enough to engage Article 8. Whether the claimant enjoys a reasonable expectation of privacy in respect of the information is I believe a separate question, which I would answer in the negative. It is probably unhelpful to enumerate the reasons here, as they also come into play at the next stage. (2) Striking the balance[172]Assuming that I am wrong in the conclusion just stated, I find that the result of the In re S balancing process is the same as that of the Google Spain process. The impact on the claimant’s business reputation of the continued accessibility of the crime and punishment information is not such as to engage Article 8. The evidence fails to establish any material interference with his right to respect for family life. I am not persuaded that there is anything more than a modest interference with his private life. The information has been legitimately available for many years. It continued to be relevant to the assessment of the claimant by members of the public, after the conviction became spent, by reason of his business activities. The information has continued relevance in view of the claimant’s continued role in business, in conjunction with his past dishonesty, failure to acknowledge guilt, and his misstatements to the public and this Court. Delisting would very significantly impede, even if it would not altogether block, public access to that information in respect of an untrustworthy businessman who poses some risk to the public. The Article 8 factors do not have sufficient weight to make that interference a proportionate response. Looked at from the opposite perspective, the interference with Article 8 that continued processing by Google represents is justified by, and proportionate to, the factors that favour the Article 10 right to receive information in this case. Having reached these conclusions it is not necessary to address, in this context, Mr White’s submission that the processing complained of does not qualify as a “misuse” of private information.

The Damages Issue

[173]Since I have found Google’s continued processing to have been and to be justified according to the Google Spain test, there is no basis for any award of compensation under DPA s 13. No damage has been suffered “by reason of any contravention … of this Act.” It is not necessary to evaluate Google’s defence under s 13(3). It is I think in that connection that I might have found Ms Caro’s evidence helpful. Nor can any question arise of damages for misuse of private information.

THE NT2 CASE

[174]The issues in this case are, with minor modifications, the same as those in the NT1 claim ([54-57] above). This claimant complains of links to eleven source publications, though it seems that two of the source publications have been taken down since the claims were made. There is one inaccuracy complaint, which relates to an item in a national newspaper of relatively recent date. That item, and the URLs that link to the other remaining sources, are relied on in support of this claimant’s Google Spain delisting claim. That claim concerns information about the claimant’s crimes, his conviction and his sentence for them (again, “the crime and punishment information”).[175]I heard oral evidence from NT2 himself, who was cross-examined. Witness statements from two other witnesses were filed on behalf of NT2, and taken as read because their contents were undisputed: a Mr Heller, a director of a number of the claimant’s companies, and Mr Wolfe. Ms Caro’s two witness statements did not call for cross-examination, her answers in the NT1 case being taken as her evidence in this action. I had four lever arch files of documentary material.[176]I found the claimant to be an honest and generally reliable witness who listened carefully to the questions put to him, and gave clear and relevant answers. He was on occasion somewhat guarded, but I did not interpret his occasional hesitation in giving an answer as an indication that he was bluffing or playing for time. Nor did his reluctance to engage (for instance) in analysis of what may have lain behind the wording of the sentencing remarks in his case, undermine his credibility in my view. Some witnesses are unnecessarily wary of Counsel’s questioning, and may appear unduly careful as a result. My assessment is that NT2 was such a witness. As will appear, I accept his evidence on most of the points of dispute.

Abuse of process

[177]I have explained above Google’s argument that the NT1 case is an abuse of process, and my reasons for rejecting it: see [58-65]. The same submissions were advanced by Google in respect of NT2’s claim. They fail for the same reasons. Data protectionThe facts 182. Delta and the conspiracies[178]NT2 started his career in the property business. By the the early years of this century he had become a senior executive and a shareholder in Delta, a company engaged in a controversial business that was the subject of public opposition over its environmental practices. There were protests by individuals, local authorities became involved, and so did a national regulator. Delta’s business was the subject of some nuisancemaking interventions, together with some criminal conduct. NT2 received death threats.[179]He formed the view that this was all associated with the campaigns against the company. With the support of Delta’s board, he engaged an investigations firm to find out who was engaged in hostile activity. He did not initially expect the firm to engage in unlawful activity for that purpose, but when it identified unlawful methods that it planned to use, NT2 agreed and authorised it to do so. The firm used phone tapping and computer hacking.[180]At some stage thereafter, the claimant moved abroad. Some months later, the business of Delta was sold to XRay, for a very large sum. The claimant received some tens of millions of pounds for his share in the business. I reject Google’s case that NT2’s authorisation of the investigations firm was motivated by concern that the protests might scupper or hinder the sale of the business to XRay.[181]The hacking and phone tapping was later discovered by the authorities, and prosecutions followed. NT2 pleaded guilty at a relatively early stage. Some three years after he instructed the investigations firm, he was sentenced with a number of others, including a Mr Roth, another Delta executive. The sentence on the claimant was one of 6 months’ imprisonment.

Data protectionThe facts

[182]The Judge’s sentencing remarks, and my analysis of their significance, are set out in the Private Judgment. Key points are that the Judge’s starting point, for a sentence after a trial, was 12 months. He identified that as a deterrent sentence. He reduced it, to account for the plea of guilty, and some personal mitigation. The sentence was imposed, I find, on the factual basis put forward by NT2 and agreed by the prosecution. This did not involve any allegations of financial gain. I find that this was not industrial espionage of the cliched kind, directed at competitors or customers. NT2 had a commercial motivation, to protect the business of which he owned a share. But he made no direct personal gain from his crime. I also reject Google’s case that NT2 was motivated by a desire to prevent legitimate protest. I accept his evidence that he wished to identify and take action against the perpetrators of the activities outlined above.[183]The claimant did not seek to appeal against sentence. He spent some weeks in custody, most of it in an open prison, after which he was released. His evidence is that “Prison was not pleasant. I did naively think that maybe when I came out I could make a fresh start”. That was a legitimate viewpoint, given the state of the law on the rehabilitation of offenders as it then stood, so far as it affected this claimant: see [16(2)] above. Zodiac[184]After he moved abroad, NT2 took financial advice from Zodiac, a financial firm based in that country.

The URLs complained of

[185]Details of the eleven URLs complained of are set out in the Private Judgment at [35]. Their nature can be fairly summarised by reference to three categories. Five are contemporary reports in the national and local news media of the claimant’s conviction and sentencing, and the underlying offending. There are two interviews given by the claimant, over 7 years ago now, about his conviction and his business plans. Then there are various other articles, spanning a decade, which include reference to his offending, conviction, and sentence. The inaccuracy issue 191. The national newspaper article[186]The one article, or item, which the claimant complains was inaccurate was not a contemporary report of the conviction or sentencing. It first appeared in a national newspaper a few years ago, over eight years after the claimant was sentenced. The item was a small component of one part of a more substantial article or feature, with a financial theme, which referred to other individuals and companies, including Zodiac, and ran to several pages. It is difficult to deal with this part of the case in anything other than these broad terms, in this public judgment. Full details of the item complained of and the feature of which it formed part are to be found in the Private Judgment. The complaint[187]The gist of the complaint is that the item is misleading as to the nature and extent of the claimant’s criminality, and that it suggests that he made criminal proceeds from it with which, with the aid of Zodiac, he dealt dishonestly and sought to shield from creditors. Evidence and submissions[188]NT2’s evidence is that he made no profits or proceeds from his crime, and engaged in no such dishonest dealings as the item suggested. Mr Tomlinson suggests that the claimant has found himself, quite inappropriately, portrayed as one of a rogues’ gallery of serious criminals. Google accepts that the item did convey serious imputations against “suspected criminals” but that these parts of the item would not have been taken to refer to NT2. Google has not sought to accuse the claimant of dishonest dealings with any proceeds of any crime, or attempts to shield assets from creditors. Assessment[189]I apply the principles identified at [80-87] above. In this case there is a further issue, namely whether the words complained of in the newspaper article refer or would be understood to refer to the claimant. That is the language of defamation law. But data protection law only applies to data that relate to an identifiable individual. In this case, the claimant’s case on reference or identifiability is built simply on the content of the offending item. There seems to me to be no material difference, at least for the purpose of this case, between defamation and data protection. Nobody has suggested any such difference. A person is referred to, or identifiable, if the words complained of would be taken by the reasonable reader of the article or item as a whole to refer to the claimant.[190]For reasons set out in detail in the Private Judgment at [49-53], I find that the article complained of is inaccurate, in that it gives a misleading portrayal of the claimant’s criminality and conveys imputations to the effect of which he complains. Remedies

The inaccuracy issue

[191]In the light of these conclusions I shall make an appropriate delisting order, in respect of the URL for the national newspaper article, in its current form, on the grounds that the article is inaccurate in the respects I have identified, contrary to the Fourth Data Protection Principle, so that continued processing by Google would represent a breach of duty under DPA s 4(4). I will hear argument on the form of order. Of course, if the underlying article were at any stage amended so as to remove the sub-section which leads to the complaint, the need for any relief might disappear.[192]I shall deal separately with the question of compensation or damages.

The Privacy Issues

[193]The arguments in NT2’s case also give rise to the Exemption Issue and the Structure Issue. I have already set out my conclusions on those matters, all of which apply equally to the present case: see [95-102], [103-105]. On the DPA Compliance Issue in this case, the reasoning in NT1 applies ([106-116] above), though there is one difference, in that two of the articles complained of were published with the claimant’s consent; it is that which satisfies a DPA Schedule 3 requirement. That leaves the Google Spain issue. Google Spain: legal principles[194]Everything that I have said already about the applicable legal principles, when dealing with the case of NT1, applies to the present case. That includes the legal discussion between [136] and [164] above, in relation to the Article 29 Working Party criteria. What remains is to summarise the relevant facts and to apply the principles to those facts. Further facts[195]Google relies on some further facts, in support of its case that the personal data contained in the third party publications accessible via the URLs complained of remain adequate and relevant, and their continuing availability serves a legitimate purpose and is in the public interest. The facts relied on fall into two main categories:(1) facts about additional business activities in which he has engaged since his conviction and sentence;(2) public statements made by the claimant. Additional business activities[196]The claimant’s uncontradicted evidence is that, since selling his stake in Delta, he has not been involved in the same controversial industry. He has been involved in other business activities, to which Google maintains the crime and punishment information in his case is relevant. Those activities have been undertaken through a corporate vehicle, Echo, and companies in the Echo group. Google’s case concerns the Echo group’s role in turning around struggling businesses; in the letting and sale of property; and in a sports marketing company, which is involved in sponsorship and large-scale property development.[197]It is Google’s case, put broadly, that those who were or might become involved or concerned in or affected by such business activities “should readily be able to find out the truth about the Claimant’s previous business activities including [the crime and punishment information], including by carrying out searches on search engines such as” Google’s Search service. The emphasis in this quotation is mine. Public statements[198]Google relies on two press interviews given by the claimant some 7 or more years ago, in which he discussed the crime and punishment information. Google says that the claimant has thereby “since the conviction became spent”, discussed it and the criminal proceedings leading to it in interviews with national media. Google’s case is that these “were clearly intended to be used to exculpate any damage caused to the claimant’s reputation by his conviction and guilty plea” and to create favourable publicity for himself and his business interests.[199]Google also relies on the fact that the claimant has in other ways sought, and continues to seek to promote himself as a successful businessman with (says Google) “a particular emphasis on his alleged experience in financial investment and corporate environmental policies”. Reliance is placed on the claimant’s personal website, a blog he ran some 7 or 8 years ago, and four instances of online news reports of similar vintage.[200]Google’s case is that it is “plainly in the public interest” that current clients of the claimant’s businesses or potential clients, and various other categories of person “should readily be able to find out [the crime and punishment information], including being able to find it by carrying out a search on search engines” such as Google Search. Assessment[201]There is one general point to make about these aspects of Google’s case: that their formulation in the Defence is in part over-broad, and rather woolly. I am not concerned with the merits of people being able to find out “the truth about the claimant’s business activities including …” his role in the conspiracies of 2004, or his sentence, or other aspects of the crime and punishment information. It is the crime and punishment information that is at issue.[202]As indicated above (at [86]), the fact that a delisting order would or might make other, relevant information about the claimant unavailable to those searching on the claimant’s name would be a material consideration when exercising a discretion. But the fact that a publication at a given URL might contain some relevant information about the claimant cannot confer relevance on the crime and punishment information, that it would not otherwise possess. Much of the cross-examination was tied to this unduly vague and blurred version of the case. That is understandable, given that this is the way the case was pleaded. However,(a) as Mr White acknowledged, I am not bound by admissions extracted in cross-examination, on issues which are for me to determine;(b) as it is, some apparent concessions extracted as a result of this broadbrush approach seem to me to be near valueless.[203]The nature of the conviction seems to me to be a significant factor in my evaluation. It is a conviction for invasion of privacy, not for any form of dishonesty. The claimant did not contest the charges, but pleaded guilty. My conclusions as to the claimant’s state of mind are also relevant. If he acted in good faith, believing the company’s business to have been targeted by malign actors, that reduces his culpability and the impact on his integrity. If his principal motivation was, as I find, to identify those responsible for trespass, criminal damage, and death threats and to take action against them, then the case for suggesting that his past crimes undermine his present environmental credentials, or his more recent claims about his commitment to environmental principles, is threadbare. The claimant’s current attitude to his criminality is also material. In oral evidence he said “It was a cataclysmic mistake, for which I pleaded guilty and took full responsibility for. I do not know what else I can say about it.” He does not cavil; his attitude is one of remorse, which I assess as genuine.[204]In the Private Judgment, the matters I have outlined above are further detailed, considered, and evaluated. For the reasons just given, and the other reasons given in the Private Judgment, I have concluded that the relevance of the crime and punishment information to any decisions that might need to be made by investors in, staff of, or customers of the businesses referred to by Google is slender to nonexistent.[205]As for the claimant’s public statements, the changes wrought by LASPO have – perhaps understandably - caused some difficulty. Retrospective changes in the law are unusual, and can be confusing. The interviews were given as a result of advice, at a time when the Claimant’s convictions were not spent. It was only later that they became spent, with effect from an earlier date. NT2’s interviews were given in that context, in order to give his own account of events. That is understandable, and not a matter for condemnation. It seems to me that Mr Tomlinson is right to submit that, having mentioned the conviction, NT2 cannot be accused of seeking to conceal it from the public. The position has now changed as the conviction is spent – and would have become spent even if LASPO had not changed the law. The claimant’s consent has been withdrawn. In his interviews, he did not seek to evade or escape from the factual basis of his conviction. He sought to put that in context.[206]As for the website and blog, the content relied on was also published before the claimant’s conviction became spent. The claimant’s evidence is that the purpose was not to promote new business, but rather, on advice, to counter the numerous references to his conviction that appeared in prominent webpages in Google’s Search results against his name. I accept his evidence on this point. To that extent, his case resembles that of NT1. Unlike NT1, however, this claimant made no claims that were inconsistent with the evidence or findings against him, or extravagantly beyond what might have been justified by reference to the principle of rehabilitation. NT2 had not contested, but had admitted, the prosecution allegations. Neither his postings nor his interviews made false claims to have or to deserve a long-standing reputation for integrity.[207]I accept Mr Tomlinson’s submission that the evidence in this case does not support Google’s case that the claimant’s business activities or his public statements mean that any of the categories of people identified should (as Google maintains) “readily have been able to find out the truth” about the crime and punishment information, or that this ought to be the case in the future. The case on relevance is a weak one at best. Application of law to facts[208]Having already set out the full wording of each of the Working Party criteria, I shall use shorthand on this occasion.[209](1) Does the information come up on a search on the claimant’s name? Yes.[210](2) Public life, public figure? NT2’s position is akin to that of NT1 in this respect. He was a public figure, with a role in public life, as a result of his crimes. That public role is now much reduced, but not wholly eliminated. The fact that he referred to his conviction and sentence in his interviews is neutral, because it was motivated by a desire to minimise the impact of the crime and punishment information.[211](3) Maturity/capacity. The claimant was not a minor, nor did he lack capacity at any relevant time. He was a mature adult at all material times, in full possession of his faculties.[212](4) Accuracy. The national newspaper article was inaccurate in the respects specified above, and in the Private Judgment. Otherwise, it is not alleged by the claimant that any of the data were inaccurate. I proceed on the footing that the publications at the other URLs were, as Google asserts, substantially accurate accounts of events so far as the claimant is concerned. The key issue is whether it remains legitimate for Google to return links to the source publications, given the passage of time, the impact on the claimant, and other material considerations.[213](5) Relevance. The data do not amount to hate speech, nor – with the possible exception of the newspaper article – do they represent “offences” against the claimant “in the area of expression”. To a limited extent, the data reflect opinions, but the gist of the complaint concerns those parts that appear to be verified fact. With the exception, again, of the newspaper article, they are verified fact. I have dealt with relevance above and in the Private Judgment. It may not be necessary to reach any further conclusions about the relevance of the newspaper article, given my finding of inaccuracy and the relief that will follow. If necessary, however, I would find that the article in its current form – that is, including the sub-section at which the complaint is directed - lacks any or any sufficient relevance to justify its continued accessibility in response to a search on the claimant’s name. By that token, and to that extent, the continued availability of the data via Google is excessive so far as the claimant is concerned.[214](6) Sensitivity The data are sensitive. The points made in this regard when dealing with the claim of NT1 hold good in the present context.[215](7) Made available for longer than necessary? This is the main issue on this part of the case, and this criterion does not add anything of value in the present context.[216](8) Prejudicial/harmful? And/or (9) dangerous? Clearly, the continued accessibility of the data is not dangerous; it does not expose the claimant to a risk of personal injury. As to other prejudice or harm, NT2’s case is that the availability of the data has had “a profound adverse impact on the Claimant and his business and personal life, including on members of his close family and school-age children.” His evidence is that he has frequently been called on to give explanations about his conviction and has had difficulty with finding banking facilities. This is corroborated by the unchallenged evidence of his witnesses. It has not been challenged but I still need to evaluate it.[217]For reasons given above, the claimant’s relationship with his grown-up children is not relevant, save marginally; and he gives no detailed evidence about it. He has not established any impact on a family life enjoyed with his adult children. He has a second family, with school-age children. The impact on that family is material, but I have hardly any evidence about it. As with NT1, a lot of the evidence is about the impact of the information on the claimant’s business. He says, “I feel that I am put at a disadvantage in securing banking facilities or business opportunities as a consequence of the information about me that is accessible through Google Search, and I believe this will simply continue unless Google “delists” the links about which I have complained.” His supporting witnesses corroborate that.[218]But his evidence does go beyond this, to an extent. He says, “Members of my close family have told me that they have been questioned about their association with me, which I have found very distressing. Some people just ask me straight out what it was like in prison.”. This is vague, lacking in detail.There are no statements from the family members, nor any explanation of why not. Nonetheless, it does go rather beyond the evidence in the case of NT1.[219](10) Context/consent and (11) journalistic purposes? The position differs somewhat, in relation to the three categories of publication. Like NT1, this claimant did not consent to the contemporaneous reporting of the criminal proceedings against him, but such reporting was a natural, probable, and foreseeable consequence of his offending and those elements of the information in question have been placed in the public domain as a result of steps deliberately taken by the claimant. So was subsequent fair and accurate reporting of the same information, in the context of the remaining publications.[220]The two interviews which NT2 now seeks to delist were given and published with his actual consent. That consent has now been withdrawn. It is not suggested that there is any legal obstacle to the claimant validly revoking his consent, for the future – such as a contractual obligation, or an estoppel, or the like. The claimant’s evidence is that he gave the interviews on advice in order to limit the impact of other reports of the conviction. No other particular circumstances have been identified, which would make it legitimate to continue processing personal data which the claimant once put into the public domain, but now wishes to withdraw from that context, to the extent of having it delisted by Google.[221](12) Legal power or obligation to make the data publicly available? None of the publishers has any obligation. Whether any of them has the power has not been debated. I proceed on the basis that, with the exception of the sub-section of the national newspaper article that refers to this claimant, the source publishers have the legal right to make the data available.[222](13) Do the data relate to a criminal offence? The answer of course is yes. As in the case of NT1, I regard this as the most important criterion. A number of obvious distinctions are apparent.(1) NT2’s conviction was always going to become spent. It was firmly within the scheme of the 1974 Act, as originally enacted. Although the sentence would have been longer but for personal mitigation, it would still have been a sentence capable of becoming spent. The LASPO changes came in a matter of months before it would have been spent anyway.(2) Much of NT2’s case is about business reputation, as opposed to private or family life. However, unlike NT1, he has given credible detail in support of the case on damage to business.(3) Moreover, unlike NT1, this claimant has a young family, and the impact of disclosure of his old conviction is capable of having an adverse impact. His case on interference with family life is stronger.(4) As to relevance, the conviction in this case was not one involving dishonesty, and it was based on a plea of guilty. This claimant acknowledges his guilt and expresses genuine remorse. I also see considerable force in Mr Tomlinson’s submission, that NT2’s conviction did not concern actions taken by the claimant in relation to “consumers, customers or investors” but rather in relation to the invasion of the privacy of third parties. There is no plausible suggestion, nor is there any sold basis for an inference, that there is a risk that this wrongdoing will be repeated by the claimant. The information is of scant if any apparent relevance to any business activities that he seems likely to engage in. Overall assessment[223]My key conclusions in respect of NT2’s delisting claim are that the crime and punishment information has become out of date, irrelevant and of no sufficient legitimate interest to users of Google Search to justify its continued availability, so that an appropriate delisting order should be made. The conviction was always going to become spent, and it did so in March 2014, though it would have done so in July of that year anyway. NT2 has frankly acknowledged his guilt, and expressed genuine remorse. There is no evidence of any risk of repetition. His current business activities are in a field quite different from that in which he was operating at the time. His past offending is of little if any relevance to anybody’s assessment of his suitability to engage in relevant business activity now, or in the future. There is no real need for anybody to be warned about that activity. Misuse of private information (1). A reasonable expectation of privacy?[224]As in NT1’s case, the information is essentially public, not private. But the position has changed. With the passage of time and in all the circumstances, Article 8 is now engaged, and the presence of a young family in this claimant’s life is a distinguishing factor. I would accept that the claimant enjoys a reasonable expectation of privacy in respect of the information, for the reasons given below. (2) A “misuse” of the information?[225]Mr White submits that proof of misuse is a separate and independent requirement of this tort. The argument did not go far on this issue, but I am not persuaded. I am content to deal with the case on the conventional two-stage test. (2) Striking the balance[226]The impact on the claimant is such as to engage Article 8. The business prejudice does not suffice for that purpose, but there is just enough in the realm of private and family life to cross the threshold. The existence of a young, second family is a matter of some weight. Even so, the evidence does not, in the end, demonstrate a grave interference. But it is enough to require a justification. Google’s case on relevance is very weak. The claimant’s evidence suggests that he has acknowledged his past error. The claimant’s current and anticipated future business conduct does not make his past conduct relevant to anybody’s assessment of him, or not significantly so. Continued accessibility of the information complained of is hard to justify. The factors that go to support that view are weak, by comparison with those that weigh in favour of delisting.

Remedies

[227]A delisting order is appropriate. As to compensation or damages, the main issue would seem to be the conduct of Google. Was it reasonable and, if so, does that excuse the company from liability for damages? These are difficult issues, on which I have reached firm conclusions only after a trial lasting several days. It would be hard to say, by reference to the terms of DPA s 13(3), that Google failed to take “such care as in all the circumstances was reasonably required” to comply with the relevant requirements.[228]True it is, that the burden of proof lies on Google. Mr Tomlinson makes the point that Ms Caro’s evidence is hearsay. She was not directly involved in the relevant decisionmaking. He invites me to treat her evidence as worthless. But Ms Caro has credibly explained Google’s processes, and I accept her evidence on this issue, so far as it goes. This is an enterprise that I accept is committed to compliance with the relevant requirements. In the current legal environment, it would be harsh to say that it had failed to take reasonable care to do so. For similar reasons I conclude that no damages are payable for misuse of private information. OVERALL CONCLUSIONS 236. NT1[229]My conclusions are:-(1) The delisting claim is not an abuse of the court’s process, as alleged by Google.(2) The inaccuracy complaint is dismissed. The First Article was a substantially fair and accurate report of legal proceedings held in public. The Second Article was not, but the claimant has failed to prove that the information in the Second Article was inaccurate in any material respect. Similar conclusions apply to the similar information in the Book Extract.(3) The remainder of the delisting claim is also dismissed.(4) The claim for misuse of private information fails.(5) The claims for compensation or damages do not arise. NT2[230]My conclusions are:-(1) The delisting claim is not an abuse of the court’s process, as alleged by Google.(2) The inaccuracy complaint is upheld, and an appropriate delisting order will be made, its terms to be the subject of argument.(3) The remainder of the delisting claim also succeeds. An appropriate order will be made, in terms to be the subject of argument.(4) The claim for misuse of private information succeeds.(5) But Google took reasonable care, and the claimant is not entitled to compensation or damages.

order

a) Is Google entitled to rely on the Journalism Exemption? (“the Exemption Issue”) b) At what point in the legal analysis should the Court assess the compatibility of Google’s processing of the offending links with the principles in Google Spain (“the Structure Issue”)? There are three competing arguments on this question. c) Does Google’s processing comply with its obligations under DPA s 4(4) (“the DPA Compliance Issue”)? d) Does Google’s processing comply with the requirements of Google Spain (“The Google Spain Issue”)? Misuse of private information

Cited in 30 later judgments

and 21 more of the most senior