05/09/2014
The European Court of Justice's recent decision in the so-called "right to be forgotten" case (Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, Case C-131/12) has been widely reported. What is more interesting is how, in the wake of that decision, some individuals are successfully persuading non-EU based website operators to swiftly remove potentially defamatory material on the grounds of unlawful processing of personal data rather than on the more traditional grounds that the website operator is liable under defamation laws.
Although existing EU and English law fixes the operator of a website with liability for any defamatory material hosted on the website as soon as the operator is notified of the defamatory material or becomes aware of the unlawful nature of the material, operators based outside the EU (including Twitter, Facebook and Google) will very rarely take action to remove the material complained of unless a court order is obtained against them. Whilst the Defamation Act 2013 is of some assistance to claimants who want to ensure that defamatory material is removed from a website (particularly where the author is anonymous), where the website operator does not edit or moderate user-generated-content and where it is "reasonably practicable" for the claimant to pursue the author direct (for example, because the author is identifiable) the claimant must pursue the author. Either way, it may become necessary to issue court proceedings which are often costly and time consuming for claimants. There is often no quick fix.
In Hegglin -v- Persons Unknown and Google [2014] EWHC 2808 (QB) a number of anonymous individuals had posted comments on various websites (including websites hosted by Google) that were highly defamatory of the claimant. The claimant applied for an injunction against Google under the Data Protection Act 1998 (DPA) on the grounds that Google had processed data relating to the claimant which was inaccurate or which was likely to cause him substantial damage or distress (the claimant complained that Google was hosting the material on its own websites and was displaying search results in response to user-input search terms containing links to other websites that hosted defamatory material). Although this was an interim hearing (an application for permission to serve Google out of the jurisdiction), the court made it clear that there was a "good arguable case" for extending Google's obligation (enforceable in the courts of England and Wales) as data controller to comply with the DPA not only in relation to its search engine facility but also in relation to the websites that it hosts on which such data appears. It will be very interesting to see the court's final decision on this issue (the trial has been fixed for November 2014). If the court makes that finding at trial, the scope of the decision in Google Spain will clearly widen.
The problem now for Google, and potentially other non-EU based website operators, is that whilst they were previously inclined to ignore (in the absence of a court order) requests from UK individuals to remove defamatory material from websites hosted by them on the grounds that they were based outside the EU, the decision in Google Spain, and the court's finding in Hegglin, may now cast the net wide enough to catch their web hosting operation for DPA purposes. Indeed, in Hegglin, Google confirmed to the court that it had already taken steps not only to block links to the offending material that appeared in its search results but also to remove the offending material from Google-hosted websites.
Whether claimants find success in similar situations involving non-EU based web hosts remains to be seen, as does the question of how far the UK courts are willing to apply Google Spain beyond search engine facilities. Those individuals interested in proactively self-managing their reputations online will make no doubt make hay while the sun shines whilst Google (and others) continue to grapple with the scope of their obligations under the DPA not only as search engine provider but now as web host too. It is worth noting that organisations with concerns about potentially defamatory material posted online (about the organisation itself) do not benefit from the decisions in Google Spain or Hegglin as the DPA only applies to data relating to individuals.
For further information please contact Wesley O'Brien or Emma Godding.
