Carruthers Law

ICO orders Google to remove links.

September 23, 2015

An enforcement notice was issued by the Information Commissioner’s Office (ICO) under s.40 of the Data Protection Act 1998 (DPA), on the 18th August 2015, against Google Inc.The notice required Google to take off links to a web page which had included a report concerning a minor criminal conviction relating to the Complainant, who remained anonymous during the enforcement notice hearing, committed by him approximately 10 years earlier.

The Complainant asked Google to delete the links which they agreed to do, also letting the website owner know. The story of Google removing the link was then published in a newspaper where reference was made to the original story with more stories following online from other media outlets. The Complainant then asked Google to delete the links to those sites, which they refused to do, contending that they were of public interest and of relevance.

The ICO found that the links should be removed but Google refused arguing that the story was a matter of public importance due to its subject matter. They considered that the details relating to the Complainant were a main part of the story and had determined whether they were of relevance and in the public interest by looking at the judgment shown by the news media in reporting the story.

The ICO considered Google’s compliance with the first and third data protection principles and looked at what was pertinent. It noted that the story did not concern a person in public life and therefore was not protecting the general public from inappropriate conduct. The data was of a sensitive nature appertaining to the Complainant’s conviction from 10 years ago where he received a two year conditional discharge

The Complainant’s privacy had been affected. This had been a minor offence which he had committed a long time ago and did not have a wide public interest. With regard to the journalistic aspect, the Commissioner recognised that decisions made to remove search results may well be of interest to the public and sustained without the need for the Complainant’s name and conviction being revealed in the search links. Further, the offence was now spent under the Rehabilitation of Offenders Act 1974.

The Commissioner on looking at all the aspects considered Google Inc had breached the third data protection principle as the links to the website revealed personal data which was no longer of any relevance. Further, the Commissioner considered the processing to be unfair, the effect on the Complainant’s privacy was out of proportion and, therefore, in breach of the first data protection principle.

The Commissioner, with reference to s 40(2) DPA, had to decide whether it was appropriate to serve an Enforcement Notice and was any breach likely to cause, damage and distress to any person. He considered that the links to the websites with the results shown, after searching the Complainant’s name, would be likely to cause him distress.

Under s.40 of the DPA, Google must, within 35 days of the date of the notice, the 18th August, take steps to remove the links to the websites listed in the Annex to the Notice.

Google is appealing the decision.