Austria will not host Europe vs Facebook showdown

July 6th, 2015 by Robin Hopkins

As illustrated by Anya Proops’ recent post on a Hungarian case currently before the CJEU, the territorial jurisdiction of European data protection law can raise difficult questions.

Such questions have bitten hard in the Europe vs Facebook litigation. Max Schrems, an Austrian law graduate, is spearheading a massive class action in which some 25,000 Facebook users allege numerous data protection violations by the social media giant. Those include: unlawful obtaining of personal data (including via plug-ins and “like” buttons); invalid consent to Facebook’s processing of users’ personal data; use of personal data for impermissible purposes, including the unlawful analysing of data/profiling of users (“the Defendant analyses the data available on every user and tries to explore users’ interests, preferences and circumstances…”); unlawful sharing of personal data with third parties and third-party applications. The details of the claim are here.

Importantly, however, the claim is against Facebook Ireland Ltd, a subsidiary of the Californian-based Facebook Inc. The class action has been brought in Austria.

Facebook challenged the Austrian court’s jurisdiction. Last week, it received a judgment in its favour from the Viennese Regional Civil Court. The Court said it lacks jurisdiction in part because Mr Schrems is not deemed to be a ‘consumer’ of Facebook’s services. In part also, it lacks jurisdiction because Austria is not the right place to be bringing the claim. Facebook argued that the claim should be brought either in Ireland or in California, and the Court agreed.

Mr Schrems has announced his intention to appeal. In the meantime, the Austrian decision will continue to raise both eyebrows and questions, particularly given that a number of other judgments in recent years have seen European courts accepting jurisdiction to hear claims against social media companies (such as Google: see Vidal-Hall, for example) based elsewhere.

The Austrian decision also highlights the difficulties of the ‘one-stop shop’ principle which remains part of the draft Data Protection Regulation (albeit in more nuanced and complicated formulation than had earlier been proposed). In short, why should an Austrian user have to sue in Ireland?

Panopticon will report on any developments in this case in due course. It will also report on the other strand of Mr Schrems’ privacy campaign, namely his challenge to the lawfulness of the Safe Harbour regime for the transferring of personal data to the USA. That challenge has been heard by the CJEU, and the Advocate General’s opinion is imminent. The case will have major implications for those whose business involves transatlantic data transfers.

Robin Hopkins @hopkinsrobin

Forget me knot…BBC publishes list of ‘forgotten’ stories

June 30th, 2015 by Anya Proops

Since the CJEU’s controversial decision in Google Spain,the debates have raged about how the so-called right to be forgotten should cash out in the online world. Particular concerns have been expressed by the media that the judgment rides rough shod over Article 10 rights, including not least the Article 10 rights of the website authors whose stories are being deindexed. Now it seems the BBC is seeking to reassert its Article 10 rights by publishing a list of all the stories which have been deindexed by Google thus far – see here.

The BBC’s position is that the publication of the list does not seek to frustrate the Court’s judgment, because it will not ‘make the stories more findable for anyone looking for a name’. What it will do, according to the BBC is enable a ‘meaningful debate’ about the right to be forgotten to take place. This is a bold step coming from one of the world’s most respected media organisations. It will doubtless provoke a copycat reaction from other media organisations which regard the CJEU’s judgment in Google Spain as an affront to their Article 10 rights. What is interesting about this new approach is that it does very clearly allow the wider public to examine how the right to be forgotten is in practice being weighed against the fundamental right to free expression. No doubt the BBC’s actions will attract criticism from those individuals who had hoped that their requests to be forgotten would result in the relevant links sinking for all time into the soup of online forgetfulness. It remains to be seen how the Information Commissioner will respond to this important and provocative development.

Anya Proops

New A-G’s opinion on territorial application of Data Protection Directive

June 29th, 2015 by Anya Proops

The transnational nature of many modern commercial enterprises can create significant difficulties when it comes to the application of domestic data protection legislation within the EU. Questions can often arise as to whether the enterprise has the necessary territorial presence in order to enable the domestic legislation to apply. These questions can be particularly difficult to resolve where the enterprise in question comprises an online business which has ethereal tentacles stretching into multiple jurisdictions. Of course, we have now all just about got to grips with the interesting intellectual gymnastics embarked upon by the CJEU in Google Spain. Now the issue of the territorial application of data protection legislation has resurfaced in a case concerning a spat between a Slovakian company operating a property-dealing website (W) and various disgruntled Hungarians who sought to sell their properties through the site: Weltimmo s.r.o. v Nemzeti Adatvédelmi és Információszabadság Hatóság (Case 230/14).

You can read about the background to the Weltimmo case here. In short, the core question which arose in Weltimmo was whether the Hungarian Data Protection Authority (HDPA) had jurisdiction to fine W in circumstances where:

(a) W had its registered seat in Slovakia;

(b) one of W’s owners was a Hungarian living in Hungary who had legally represented W before the HDPA;

(c) W had received personal data from individuals in Hungary who wished to advertise their Hungarian properties on W’s website and

(d) W had apparently then gone onto misuse the personal data it had received.

The Hungarian Kúria court was unsure as to how to answer this question. This was because it was unclear as to the legal effects of two Articles of Directive 95/46/EC: Article 4 (concerning the territorial scope of domestic data protection laws) and Article 28 (concerning the role of the domestic supervisory authority). Accordingly, the court referred a number of questions to the CJEU, all of which were essentially focused on identifying the territorial reach of the domestic data protection laws and domestic supervisory authorities under the Directive (you can find the questions here). Advocate-General Cruz Villalón (yes he of Digital Ireland fame) has now given his opinion on these questions: see here. Rather frustratingly however, the opinion is not currently available in English. It is available in French and a host of other European languages (including for the multi-lingual amongst you Bulgarian and Czech). My admittedly rather untutored take on the French language version is that it contains the following key conclusions (see in particular paragraph 72):

- The effects of Articles 4 and 28 are that a supervisory authority in Member State X cannot assert jurisdiction over a data controller which is not ‘established’ in Member State X. Instead, that supervisory authority only has jurisdiction in respect of data controllers which are ‘established’ within its own territory (i.e. within Member State X).

- When considering the extent to which a data controller is ‘established’ in Member State X, the focus should be on the de facto, rather than the de jure, position. The crucial question is: from where, in a physical, logistical sense, does the data controller operate the business in question? Answering this question is likely to require a focus on where the business’ human and technical resources are located.

- The data controller may be established in a number of different Member States, provided that its operations in those Member States have the necessary quality of stability.

- Factors such as where the data has been downloaded, the nationality of the injured parties, the domicile of the owners of the company responsible for processing the data or the fact that the service provided is directed at the territory of another Member State are not directly relevant or decisive. They may however be indirectly relevant insofar as they may shed light on the question of where the data controller is established.

It remains to be seen whether the CJEU will follow the Advocate-General’s opinion. If it does, then that will reaffirm the essentially fragmented, patchwork nature of the protections afforded under the current Directive. Of course, if and when the draft General Data Protection Regulation becomes law, this patchwork of protections will give way to a more unified approach, as the era of the one-stop shop will be upon us.

Anya Proops

Comment is (not) free – E-Commerce back in the limelight

June 22nd, 2015 by Anya Proops

Last month I posted about the settlement of the Max Mosley litigation against Google (see my post here). Had that case been fought to its conclusion, we would at the very least have had the pleasure of gaining greater insight into the weird and wonderful world of the E-commerce legislation. However, sadly that was not to be. The good news is that E-Commerce cases now appear to be like buses. No sooner has one case settled, than another one comes motoring down the litigation highway. This time E-Commerce principles have surfaced, not in the context of a right to be forgotten case, but rather in the context of a Strasbourg case concerning the application of Article 10 rights.

The case in question, Delfi AS v Estonia (Case no. 64569/09), concerned an Estonian internet news portal called Delfi. In common with many internet news organisations, Delfi permits readers to write comments about the online stories which they publish. In 2006, Delfi published a story concerning the alleged destruction of certain Estonian ice roads by a particular company (S). The story, which was itself legally unobjectionable, attracted lots of reader comments, including comments which were very attacking of S’s majority shareholder (L). The comments in question were not only defamatory but also amounted to hate speech and an incitement to violence against L, all of which is unlawful under Estonian law. Upon complaint by L, Delfi immediately removed the comments (this was some six weeks after they had first been posted). However, L was not happy with this retrospective deletion of the comments. He brought a claim for damages against Delfi on the basis that Delfi had acted unlawfully by publishing the comments on the site. L eventually won his case in the domestic court and was awarded 320 Euros in compensation.

Delfi then took the case to the Strasbourg court. It alleged that the domestic court’s findings breached its Article 10 right to freedom of expression. A core plank of Delfi’s case was that it had to be treated as a mere intermediary under EU E-Commerce legislation, with the result that it was not liable in respect of the comments. Delfi contended that any other approach to the application of the E-Commerce principles would result in an undue interference with its Article 10 rights. The Strasbourg court rejected Delfi’s case. It held that Delfi was not acting merely as an intermediary in connection with the comments. This was particularly given that:

  • Delfi had comprehensive powers of editorial control over the comments once they had been posted;
  • moreover, Delfi positively encouraged the posting of comments on the basis that this would increase its potential to accrue advertising revenue.

In this respect, the comments on the Delfi site were, in the court’s view, to be contrasted with: ‘other fora on the Internet where third-party comments can be disseminated, for example an Internet discussion forum or a bulletin board where users can freely set out their ideas on any topics without the discussion being channelled by any input from the forum’s manager; or a social media platform where the platform provider does not offer any content and where the content provider may be a private person running the website or a blog as a hobby’ (§116).

The court went on to hold that whilst Delfi could not be expected to pre-vet comments prior to their publication, its obligations as online publisher of the comments were such that it should immediately and of its own motion detect and remove unlawful content (i.e. without waiting for a complaint brought). The court held that such an approach to the management of the comments constituted a justified interference with Delfi’s Article 10 rights.

This is an important judgment for a number of reasons.

  • First, it suggests that the defences available to online intermediaries under the E-Commerce are to be narrowly construed. In short, the greater the degree of editorial control over and entrepreneurial interest in the data in question, the more likely it is that the court will find that the defences are not available.
  • Second, it suggests that, when it comes to the publication of data online, Article 10 cannot be treated as an all-purpose get out of jail free card. Instead, as with speech expressed through traditional media, Article 10 rights must be balanced against other affected rights (although note paragraph 113 where the court alluded to the need to adopt a ‘differentiated’ and ‘graduated’ approach to the enforcement of rights as against internet service providers, as opposed to traditional publishers).
  •  Third, it suggests that, in this post Google-Spain world, the CJEU is not alone in its desire to create strong controls around the ways in which data is managed online, particularly where there is a profit-making element to the data processing scheme.

So put simply, online comment is not free, at least not for those media organisations which seek to profit from facilitating free expression within the online environment.

Anya Proops

Freedom of Information in Scotland

June 15th, 2015 by jamesgoudie

The Scottish Government has initiated a Consultation on further extension of coverage of the Freedom of Information (Scotland) Act 2002 (“FoIS”) to more organisations, specifically contractors who run privately managed prisons, providers of secure accommodation for children, grant-aided schools and independent special schools.

FoIS provides a statutory right of access to information held by Scottish public authorities. These range from the Scottish Parliament and Government, to local authorities, NHS boards, higher and further education bodies, doctors and dental practitioners.  However, the provisions of FoIS can be extended to bodies that carry out functions of a public nature or which provide, under a contract with a Scottish public authority, a service which is a function of that authority. This can be done by making an Order under s5 of FoIS, which designates those bodies as a Scottish public authority for the purposes of FoIS. They are then subject to the full requirements of FoIS. They would also automatically become subject to the requirements of the Environmental Information (Scotland) Regulations 2004. In accordance with s7(3) of FoIS, bodies proposed for coverage would be covered only in respect of the information they hold about specified public functions or services. Their duties under FoIS would therefore be limited to those functions or services as set out in the Order.

The Scottish Government brought forward Scotland’s first Order under s5(1) of FoIS in September 2013. Following consideration by the Parliament the Order came into effect on 1 April 2014. The Order extended coverage of FoIS to certain trusts which have been created by local authorities to deliver sporting, cultural and leisure facilities and/or activities on behalf of the local authority(ies).

The Scottish Government are now consulting on options for further extension of coverage. They are proposing to lay an Order in the Scottish Parliament in Autumn 2015. Subject to the Scottish Parliament supporting the Order, they would expect the bodies covered to become subject to FoIS and the EIR from Spring 2016. In addition to the organisations discussed in the Consultation Paper, suggestions are sought as to what other bodies – whether individually or collectively – should be considered in any future consultation.

In the previous consultation in 2010 the Scottish Government adopted a factor-based approach in determining the extent to which a function of an organisation could be described as being ‘of a public nature’.  They continue to believe that a factor-based approach is appropriate, and that a range of factors should be considered in assessing the ‘public nature’ of particular functions undertaken by certain organisations.

The Consultation Paper notes that the Scottish Information Commissioner has called for the extension of FoIS coverage to social housing owned by RSLs.  For a number of reasons, the Scottish Government are not currently persuaded of the merits of extending coverage to housing associations.

The Scottish Government do, however,  consider that a number of factors apply in relation to the functions undertaken, or services provided, by those various organisations highlighted in the Consultation Paper. In particular, there is a focus on organisations who, for the purposes of s5 of FoIS, undertake functions of a public nature or provide a service that is a function of a public authority(ies) relating to security, care and education.

The organisations considered for inclusion at this stage are:

  • contractors who run privately-managed prisons
  • providers of secure accommodation for children
  • grant-aided schools
  • independent special schools

With all these groups it is envisaged that any Order would provide a ‘class description’ in respect of the particular function undertaken or service provided. Given the potential for contractors or service providers to change over a period of time, a ‘class description’ gives more flexibility than listing specific bodies or contractors in the Order.

James Goudie QC

Data Protection Regulation Update

June 15th, 2015 by Christopher Knight

You know how it took you years to get your head around what the Data Protection Act 1998 meant? Well, the new general Data Protection Regulation took one step closer towards ripping up Directive 95/46/EC (and therefore the DPA) today. The Commission’s proposals for the new Regulation have now been signed off by the Justice Ministers (see press release here). The Commission informs us that the first meeting in the trilogue between the Commission, the European Parliament and the Council of the EU will take place on 24 June, and the aim is to have a text agreed before 2015 is out. The trilogue is where all the nitty gritty stuff has still to be hammered out, and plenty of changes are likely through that process, but at least we have a little more of an idea now of the timescale.

Christopher Knight

Le Right to be Forgotten

June 15th, 2015 by Christopher Knight

Bonjour, et maintenant pour un post de Panopticon dans le style de Miles Kington et ‘Franglais’.

Recallez-vous le judgment de la Cour de justice de l’Union européenne dans Google Spain (ici)? Tres bien. Maintenant, il y a une announcement from CNIL (le ICO de France), informing Google that le ‘right to be forgotten’ applies aux search results decouvert en et, pas seulement (voila, ici). Ce n’est pas une announcemente populaire avec Google, mais ce n’est pas une surprise. Dans November 2014 le Article 29 Working Party adopted ‘Guidelines on the Implementation’ of Google Spain, which said the same thing, as an aspect of the principle of effective protection of data subjects’ rights. C’est believed que la France est le premier data protection authority to expressly and publicly take this line with Google. Les developments dans le future sont tres interessant.

(That’s enough of that. Another issue which has caused some interest is the approach Google are taking whereby any search result on for an individual name comes back with the rider at the foot that some search results may have been omitted as a result of Google Spain, regardless of whether they have been or not. This raises some interesting possible questions in defamation (could it be defamatory to imply that an individual has exercised their Google Spain rights?), privacy (does the implication itself invade private life and reputation?) and DPA compliance (is the approach justified because only having the notice where the right has been exercised is tantamount to undermining the exercise of the right, and would no notice at all be too secretive?). That will also be interesting to see if anyone follows it up with Google, the ICO and then the courts. For those of you want to see a bit more analysis, and an example of a complaint, listen carefully, I shall say zis only once: Jon Baines’ blog discusses it ici. Eh bien.)

Ce n’est pas ‘goodbye’, mais seulement ‘au revoir’.

Christophe Chevalier

Ittihadieh Judgment Now Available

June 3rd, 2015 by Christopher Knight

Almost a month ago, I blogged about a decision of the High Court in Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd & 6 others [2015] EWHC 1491 (QB), noting that the judgment was not yet available. Since then my postbag has been inundated with letters (sample from a Mrs Trellis of North Wales, “Dear Robin Hopkins, If data protection is so important, why does the postman keep delivering my letters next door?”) haranguing me for further information. Following a suitable period to allow excitement to build, I am happy to oblige. It may now be seen here: Ittihadieh v Cheyne Gdns APPROVED judgment 05 05 15.

It is not necessary to repeat the commentary already provided in the previous post. HHJ Seymour QC did indeed construe the SAR as being directed only to the company – based on the wording of it and the payment of only one £10 fee – but he also held that directors would not have been data controllers themselves, applying Southern Pacific Personal Loans [2013] EWHC 2485 (Admin). The relevance of the domestic purposes exemption in section 36 came about because it was suggested some of the company directors may have expressed views about the Claimant amongst themselves in a personal capacity. This, thought the judge, would fall within section 36. In any event, he would have exercised his general and untrammelled discretion (applying Durant) under section 7(9) not to make any order requiring them to search personal email accounts.

Finally, at [50], comes a happy reminder that even post Vidal-Hall not every potential breach will sound in damages, as the court noted the claim for distress and expressed severe doubts about it in the following terms:

“It is not necessary or appropriate for me to give lengthy consideration to the prospect that Mr. Ittihadieh has suffered distress, but the material before me does indicate that Mr. Ittihadieh is a person who is accustomed to defending his corner, to put it colloquially, if necessary, or perhaps even if not necessary, by resort to legal proceedings, or threat of legal proceedings, and he certainly seems to engage in the expression of colourful phrases in the English language which are not used in polite society. That use of language suggests that he, himself, may not be a particularly sensitive flower.”

That is not to say that the “sensitive flower” test is one which should be applied generally (one struggles to see Max Mosley, to pick a sadomasochistic example at random, meeting the test), but it is a welcome expression of judicial realism.

Christopher Knight

Disclosing child protection information: make sure you ask the right questions first

June 1st, 2015 by Robin Hopkins

High-profile revelations in recent years illustrate the importance of public authorities sharing information on individuals who are of concern in relation to child protection matters. When inaccurate information is shared, however, the consequences for the individual can be calamitous.

AB v Chief Constable of Hampshire Constabulary [2015] EWHC 1238 (Admin) is a recent High Court judgment (Jeremy Baker J) which explores the implications of such inaccurate disclosures. The case is not only about inaccuracies per se, but about why those inaccuracies were not picked up before the disclosure was made.

Perhaps the most notable point from the judgment is this: if such a disclosure is to be necessary, then the data controller must take care to ask themselves reasonable questions about that information, check it against other obvious sources, and make necessary enquiries before disclosure takes place.

In other words, failure to ask the right questions can lead to the wrong course of action in privacy terms. Here is how that principle played out in the AB case.


In 2010, AB was summarily dismissed from his job as a science teacher for inappropriate comments and conduct with potential sexual undertones, as well as a failure to maintain an appropriately professional boundary with students. His appeal against dismissal failed. The Independent Safeguarding Authority, however, decided not to include AB on its barred lists. The General Teaching Council also investigated AB, but it did not find that the allegations of improper conduct were made out.

AB’s dismissal, however, came to the attention of a member of the child abuse investigation public protection unit of the Hampshire Constabulary. Enquiries were made of the college, and certain email correspondence and records were generated and retained on police systems.

Later the following year, AB was offered a teaching job elsewhere. This came to the police’s attention in 2013. There was internal discussion within the police about this. One officer said in an email that, among other things (i) AB had also been dismissed from another school, and (ii) AB’s 2010 dismissal had involved inappropriate touching between himself and pupils. There was no evidence that either of those points was true. That email concluded “From What I’ve been told he should be nowhere near female students. I will put an intel report in on [AB]”.

The above information was passed to the Local Authority Designated Officer (‘LADO’) and in turn to the school, who terminated AB’s employment. He then made a subject access request under the DPA, by which he learnt of the above communication, and also the source of that information, which was said to be a notebook containing a police officer’s notes from 2010 (which did not in fact record either (i) or (ii) above). AB complained of the disclosure and also of the relevant officer’s failures to follow the requisite safeguarding procedures. The police dismissed his complaint.

The Court’s judgment

AB sought judicial review of both the disclosure of the inaccurate email in the email, and of the dismissal of his complaint about the police officer’s conduct in his reporting of the matter.

The Court (Jeremy Baker J) granted the application on both issues. I focus here on the first, namely the lawfulness of the disclosure in terms of Article 8 ECHR.

Was the disclosure “in accordance with the law” for Article 8 purposes?

The Court considered the key authorities in this – by now quite well-developed – area of law (Article 8 in the context of disclosures by the police), notably:

MM v United Kingdom [2010] ECHR 1588 (the retention and disclosure of information relating to an individual by a public authority engages Article 8, and must therefore be justified under Article 8(2));

Tysiac v Poland (2007) 45 EHRR 42, where the ECtHR stressed the importance of procedural safeguards to protecting individuals’ Article 8 rights from unlawful interference by public bodies;

R v Chief Constable of North Wales Ex. Parte Thorpe [1999] QB 396: a decision about whether or not to disclose the identity of paedophiles to members of the public, is a highly sensitive one. “Disclosure should only be made when there is a pressing need for that disclosure”);

R (L) v Commissioner of Police for the Metropolis [2010] 1 AC 410: such cases are essentially about proportionality;

R (A) v Chief Constable of Kent [2013] EWCA Civ 1706: such a disclosure is often “in practice the end of any opportunity for the individual to be employed in an area for which an [Enhanced Criminal Record Certificate] is required. Balancing the risks of non-disclosure to the interests of the members of the vulnerable group against the right of the individual concerned to respect for his or her private life is a particularly sensitive and difficult exercise where the allegations have not been substantiated and are strongly denied”;

R (T) v Chief Constable of Greater Manchester Police & others [2015] AC 49 and R (Catt) v ACPO [2015] 2 WLR 664 on whether disclosures by police were in accordance with the law and proportionate.

The Court concluded that, in light of the above authorities, the disclosure made in AB’s case was “in accordance with the law”. It was made under the disclosure regime made up of: Part V of the Police Act 1997, the Home Office’s Statutory Disclosure Guidance on enhanced criminal records certificates, section 10 of the Children Act 2004 and the Data Protection Act 1998.

See Jeremy Baker J’s conclusion – and notes of caution – at [73]-[75]:

“73. In these circumstances it seems to me that not only does the common law empower the police to disclose relevant information to relevant parties, where it is necessary for one of these police purposes, but that the DPA 1998, together with the relevant statutory and administrative codes, provide a sufficiently clear, accessible and consistent set of rules, so as to prevent arbitrary or abusive interference with an individual’s Article 8 rights; such that the disclosure will be in accordance with law.

74. However, it will clearly be necessary in any case, and in particular in relation to a decision to disclose information to a third party, for the decision-maker to examine with care the context in which his/her decision is being made.

75. In the present case, although the disclosure of the information by the police was to a LADO in circumstances involving the safeguarding of children, it also took place in the context of the claimant’s employment. The relevance of this being, as DC Pain was clearly aware from the contents of his e-mail to PS Bennett dated 10th June 2013, that the disclosure of the information had the potential to adversely affect the continuation of the claimant’s employment at the school….”

Was the disclosure proportionate?

While the disclosure decision was in accordance with the law, this did not remove the need for the police carefully to consider whether disclosure was necessary and proportionate, particularly in light of the serious consequences of disclosure for AB’s employment.

The Court held that the disclosure failed these tests. The crucial factor was that if such information about AB was well founded, then it would have been contained in his Enhanced Criminal Record Certificate – and if it was not, this would have prompted enquiries about the cogency of the information (why, if it was correct, was such serious information omitted from the ECRC?) which would reasonably have been pursued to bottom the matter out before the disclosure was made. These questions had not been asked in this case. See [80]-[81]:

“… In these circumstances, it was in my judgment, a necessary procedural step for DC Pain to ascertain from the DBS unit as to, whether, and if so, what information it had already disclosed on any enhanced criminal record certificate, as clearly if the unit had already disclosed the information which DC Pain believed had been provided to him by the college, then it would not have been necessary for him to have made any further disclosure of that information.

81. If either DC Pain or PS Bennett had taken this basic procedural step, then not only would it have been immediately obvious that this information had not been provided to the school, but more importantly, in the context of this case, it would also have been obvious that further enquiries were required to be made: firstly as to why no such disclosure had been made by the DBS unit; and secondly, once it had been ascertained that the only information which was in the possession of the DBS unit was the exchange of e-mails on the defendant’s management system, as to the accuracy of the information with which DC Pain believed he had been provided by the college.”

Judicial reviews of disclosure decisions concerning personal data: the DPA as an alternative remedy?

Finally, the Court dealt with a submission that judicial review should not be granted as this case focused on what was essentially a data protection complaint, which could have been taken up with the ICO under the DPA (as was suggested in Lord Sumption’s comments in Catt). That submission was dismissed: AB had not simply ignored or overlooked that prospect, but had rather opted to pursue an alternative course of complaint; the DPA did not really help with the police conduct complaint, and the case raised important issues.

Robin Hopkins @hopkinsrobin

Mosley v Google: RIP

May 18th, 2015 by Anya Proops

So Max Mosley has done a deal with Google in respect of his claim that Google had breached his rights under the DPA 1998 by refusing to block certain images and videos accessible via the Google search engine (see this FT article which suggests that the settlement also applies to claims brought by Mr Mosley in Germany and France). The settlement of the claim, which follows on from Google’s failed strike out application (discussed further below), leaves unanswered a number of really important questions concerning the application of data protection rights in the online world. Not least, the settlement leaves open the question of the extent to which the so-called ‘right to be forgotten’ can operate so as to force internet search engines, not only to de-index individual URLs on request, but also to block access to the offending data globally (i.e. as ISEs already do, for example, where images of child pornography are identified).

This is an important issue for those data subjects who garner significant public attention within the online environment, as was the case with Mr Mosley. The difficulty for such individuals is that online stories or comments about them can proliferate on the internet at such a rate that they cannot practicably achieve the online amnesia they crave. No sooner have they requested that the relevant internet search engine remove a number of privacy-invasive links, than the story has sprung up in a raft of other different locations on the net, with the result that the individual is effectively left trying to capture lightening in a bottle. This raises the question as to whether a right to be forgotten mechanism which is limited to de-indexing only specific those URL’s identified by the data subject is fit for purpose in terms of achieving the outcomes envisaged by the CJEU in Google Spain. Put shortly, if the ISE is the lightening conductor for privacy intrusive data, can it properly be required to stop the lightening at its source and block all access to the data in question? Is this the way in which the right to be forgotten ultimately cashes out in the online world?

Which takes us on to the defences which Google sought to run in the Mosley case because, certainly in the context of the strike out application, Google was not seeking to argue that data in issue (images and video of Mr Mosley engaging in private sexual activity) was not private or that its online dissemination did not cause substantial damage or substantial distress to Mr Mosley for the purposes of s. 10. Nor did Google seek to dispute that the damage or distress suffered by Mr Mosley was ‘unwarranted’ for the purposes of s. 10(1). Instead, its entire case in the context of the strike out was mounted on the basis that it was shielded from all liability under the DPA by virtue of the protections afforded to intermediary ‘internet society services’ (ISSs) under Part IV of the E-Commerce Directive (Directive 2000/31/EC).

For the uninitiated, Part IV of the E-Commerce Directive is designed to afford protections to intermediary ISSs which are genuine data intermediaries in the sense that they merely transmit, cache (i.e. store) or host data generated by others. The idea which lies behind Part IV is that the development of electronic commerce within the information society, one of the key objectives of the E-Commerce Directive (see recital [2]), would be frustrated if entities acting essentially as online data messengers could too readily get shot by third party claimants. Thus, we see:

  • in Article 12 a limitation on liability where the ISS is acting as a mere conduit;
  • in Article 13 a limitation on liability where the ISS is merely caching the data;
  • in Article 14 a limitation on liability where the ISS is merely hosting the data (this was the provision invoked by Facebook in CG v Facebook, as to which see my post here) and, finally,
  • in Article 15 a specific exclusion of any general obligation on the part of the ISS to monitor content falling within the scope of Articles 12, 13 or 14.

Google’s case on the strike out was that it was not liable in respect of Mr Mosley’s claim under s. 10 DPA on the basis that: (a) it was merely caching the data in issue (thus Article 13 of the E-Commerce Directive was engaged) and, in any event (b) the order being sought by Mr Mosley would conflict with the requirement of Article 15 of the E-Commerce Directive, as it would result in Google having to engage in general monitoring of cached content.

Mitting J considered both of these arguments in the context of Google’s strike out application (see his judgment here). So far as Google’s case on Article 13 was concerned, Mitting J clearly took the view that, where an individual’s data protection rights are being infringed by virtue of an ISS’s continued processing of privacy-invasive data, there is nothing in Article 13 of the E-Commerce Directive which purports to limit the ISS’s liability to cease processing that data; quite the contrary Article 13(2) specifically leaves the door open to a cease processing order being made in these circumstances (see in particular [47]). This conclusion dovetailed with Mitting J’s more general (albeit provisional) conclusion that the Data Protection Directive and the E-Commerce Directive were intended to work ‘in harmony’ with one another (see [45]-46]). On the Article 15 defence, Mitting J was clearly sceptical about Google’s argument that the order being sought by Mr Mosley would result in the kind of general monitoring which was ostensibly prohibited by Article 15 [54]. However, he accepted that this was an issue which would have to be decided by the trial judge.

Of course, in light of the recent settlement, it is clear that that issues concerning Google’s Article 15 defence are now unfortunately not going to be decided by the trial judge. Which leaves us all pondering in particular the following important questions:

  • First, where right to be forgotten claims are formulated as claims to have data blocked by the relevant ISE, will such claims in practice effectively require a form of general monitoring by the ISE?
  • Second, if they do require a form of general monitoring, does that mean that the claims must fail by reference to Article 15 of the E-Commerce Directive or does Article 15 itself have to fall silent in the face of the imperatives of the data protection legislation? (Mitting J made clear in his judgment he was not expressing a view on this issue)
  • Third, what about claims for compensation brought against an ISE which refuses to block data? Do E-Commerce principles afforded ISEs a refuge against such claims? (Notably, Mitting J had stayed Mr Mosley’s compensation claim pending the outcome in Vidal-Hall so he did not address this issue).

It is perhaps worth pointing out here that no reference was made in Mitting J’s judgment to the EU Charter of Fundamental Rights (presumably because Charter rights were not specifically relied on in argument). Obviously in the post-Vidal-Hall world, Charter rights - including not least Article 8 (concerning the protection of personal data) – are bound to play a dominating role in discussions concerning the relationship between the E-Commerce Directive and data protection rights. Which all tends to suggest that this is an area which remains rich in litigation potential.

Finally, it should be pointed out that as at today’s date the various images which Mr Mosley was seeking suppress all appear still to be available online via Google. It remains to be seen whether in time these images will in fact quietly sink into the soup of online forgetfulness.

Anya Proops