The General Data Protection Regulation (GDPR) (EU) is a regulation in EU law on data protection and privacy for all individuals within the European Union. When the GDPR enters into force on 25 May 2018, all companies that collect data on citizens in EU countries will need to comply with strict new rules around protecting customer data.
A recent Irish High Court decision may well set the standard, or at least provide a persuasive guideline, as to how rights of individuals protected by the GDPR should be balanced with potentially competing rights, such as public interest and freedom of expression.
The case in question involved a claim brought by a Plaintiff against a decision taken by the Office of the Data Protection Commissioner (ODPC). In 2014 the Plaintiff requested that the ODPC require the removal of certain information posted about him on an online discussion forum, Reddit. The post in question referred to the Plaintiff as “North County Dublin’s Homophobic Candidate” which appeared in Google search results when the Plaintiff’s name was searched for. He argued that the post contained inaccurate information and that it was not clear that it was an expresssion of opinion, thereby leading people to believe that there was some credence to the statements. The ODPC concluded that the Reddit user was expressing a personal opinion based on election material published and that as a result there was no contravention of the Data Protection Acts. They refused to re-index the postings.
The Plaintiff appealed this decision to the Circuit Court who ruled in favour of the Plaintiff, stating that it was likely that people would consult an online forum and might consider the unverified statement to be true. The Court ordered that the information contained in the link be edited and the results presented in a Google search made it clear that the comments were opinion only.
The High Court overturned this decision on appeal by the ODPC and ruled that the appropriate legal test had not been applied in coming to the Circuit Court decision. The Reddit post must be taken in its entirety and indeed that in order for Google to comply with the Circuit Court decision, they would have to engage in editing functions beyond those previously contemplated and set down in the 2014 Google Spain case, which established the “right to be forgotten”. The High Court agreed with the initial ODPC decision that the refusal to remove the link did not contravene Data Protection Acts.
This decision brings to light the “right to be forgotten” (to be referred to as the “right to erasure” under the GDPR) and demonstrates that placing it on a statutory footing may well be justified. There must however be a balance between this and the rights to information and freedom of expression. The right to be forgotten is not absolute under the GDPR and is subject to certain exemptions and derogations. Whether this decision will create reluctance among Irish Google users to seek to vindicate their perhaps diminishing right to be forgotten is yet to be seen.
Meaby&Co is authorised and regulated by the Solicitor’s Regulation Authority (SRA Number 447880) and registered in England and Wales with registered number OC322672 at 2 Camberwell Church St, London, SE5 8QY.