Hawktalk

Confusion over Google’s Enforcement Notice in the UK

Note added 11 December: Google have appealed the Enforcement Notice so let legal battle commence.

In the last blog, I reported that Google had been ordered to remove nine search results and that the case was important as it related to Google’s practice of notifying websites that certain personal data have been delisted when searching by name.  I wrote the blog after I was told by the Information Commission’s (ICO’s) press office that Google had not appealed the ICO’s Enforcement Notice.

However, I have heard subsequently from the beating of the tom-toms in the data protection jungle that Google did not appeal because the ICO had withdrawn its Enforcement Notice (even though at the time of posting this blog, the Google Enforcement Notice is still published on the ICO’s website; see references).

So plucking up courage, I asked the ICO whether the drum-beats were correct: “Has the enforcement notice been withdrawn because, for instance, it was defective?”, I asked.  The answer was: “We’ll shortly be publishing a blog which will give more information. We’ll let you know when it’s published” – which I have to presume is a long-winded way of saying “yes”.

So, much of the last blog could well be wrong.  Sorry about that.

However, the case is still very important as it relates to Google’s policy of informing website owners of the fact of a Google delisting.

For instance, look at the page on the BBC website (“List of BBC web pages which have been removed from Google's search results”) where several stories have been delisted by Google and re-emphasised by the BBC (including the personal data that have been delisted). As before, by delisting,  BBC articles are only delisted from results for search queries on certain names; they are not removed from the Google index entirely (i.e. other search parameters could produce the link that is delisted with a search on a name).

The BBC explains that it “has decided to make clear to licence fee payers which pages have been removed from Google's search results by publishing this list of links. Each month, we'll republish this list with new removals added at the top” (see references).

Should the BBC do this? Is it fair to data subjects? Are such stories needed to protect freedom of speech etc etc?  Important questions that need answers.

The options open to the ICO, to be explained in its forthcoming blog, are as follows: 

• ICO does nothing on the enforcement front; the new links remain and the “Right to be Forgotten” risks being diminished in the UK.
• ICO confirms that enforcement is not needed because Google has taken down the new links; the “Right to be Forgotten” is likely to be enhanced in the UK.
• ICO enforces, Google appeals and an interesting legal battle commences (the chosen option). 

References

Google’s enforcement notice: https://ico.org.uk/media/action-weve-taken/enforcement-notices/1432380/google-inc-enforcement-notice-18082015.pdf.

BBC website of delisted stories: http://www.bbc.co.uk/blogs/internet/entries/1d765aa8-600b-4f32-b110-d02fbf7fd379

We have a BCS DP Practitioner Qualification (starting in London on January 26),  BCS DP Foundation Certificate (starting in London on January 19). Also we have a DP Regulation workshop on Jan 25th,  PIA on Jan 11th and DP Audit: Jan 18th.  Details of these courses are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

Google fails to defend its policy of informing websites that personal data have been delisted by it.

Please see the blog of 25/10/2015 which updates this blog

Google was given 35 days (which elapsed around October 1^st) to respond to the Commissioner's Enforcement Notice; I have found out from a very reliable source that Google has not appealed (i.e. passed over the opportunity to defend the policy at the Tribunal).  As Google risks criminal prosecution if they have not complied with the ICO’s demand, I am assuming Google has complied.

The nine search results related to a relatively minor criminal conviction for which the data subject received a two years conditional discharge; the offence was committed nearly a decade ago.  As the offence is spent under the Rehabilitation of Offenders Act, and the data subject is not a public figure, Google took down the links to the conviction.

However, Google then followed its common practice and informed the website owner that a post concerning the data subject had been delisted. This caused the website owner to repost the story, presumably in the context of freedom of expression, which included the full criminal record details again.

This new posting was then reproduced by other websites, and it is these nine links that were subject to the Enforcement Notice.

Google refused to delist this new posting on the grounds that the story about the taking down links and freedom of speech was in the public interest even though it contained the criminal record details it did delist.

The Enforcement Notice

In our DP courses, I always stress that there is no point for a controller to get an Enforcement Notice and NOT to appeal subsequently to the Tribunal. This is because, usually, the Commissioner gives a data controller the opportunity to meet his demands without serving an Enforcement Notice.

For example, suppose the Commissioner were say to a controller: “I have done an investigation and please delete these personal data”.  The Commissioner only needs to consider enforcement if the controller then refuses to delete the personal data. Note that if the controller meets the demand and deletes the personal data, then there is nothing for the Commissioner to enforce! 

So, in these circumstances, if a controller were to refuse to delete the personal data, there is a principle where the data controller thinks the Commissioner is wrong.  So in its Enforcement Notice (in paragraph 16), Google clearly state that the retention of the links to the new posting was in the public interest. The ICO disagreed with this position, Google resisted, and hence the Commissioner had to serve an Enforcement Notice.

The scene was therefore set for an interesting Tribunal Hearing and perhaps the long march through the legal institutions to the Supreme Court.  However, this has not happened; the dog has refused to bark.

In other words, Google has not taken the opportunity to defend its procedure of informing websites that certain personal data have been delisted.  This will encourage others who oppose this policy to make similar complaints to the ICO.

Note added: a comment has been made that points out that that the delisting of links only arises when the search term includes the name of the data subject.

References 

Google’s enforcement notice: https://ico.org.uk/media/action-weve-taken/enforcement-notices/1432380/google-inc-enforcement-notice-18082015.pdf 

The above will be discussed at our all day UPDATE session (Oct 19th; London; £225); places still available.  Next  BCS Qualification in Edinburgh (starting Nov 2nd) and London (starting Nov 16th). All details on www.amberhawk.com.

Understanding Safe Harbor, Schrems v Facebook in less than 300 words

Safe Harbor is now defunct because the European Court of Justice (ECJ) found the following:

(a)    There is no general privacy law or other measures enacted in the USA that shows the USA offers "an adequate level of protection" for personal data relating to European data subjects;

(b)    Public law enforcement authorities which obtain personal data from organisations in Safe Harbor are not obliged to follow the Safe Harbor rules after disclosure;

(c)    Some USA law enforcement agencies can gain access to personal data in Safe Harbor without having any law that legitimises their access; and

(d)   The European Commission knew all the above  and knew that personal data were being possibly used for incompatible and disproportionate purposes by law enforcement agencies.

If you think of Article 8(2) of the Human Rights Convention, you will "get" the ECJ Judgment immediately. This Article states that

“There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”

As Snowden leaks showed, there is no law legitimising the interference by the National Security Agencies, so one does not know whether any interference on their part is necessary.

Safe Harbor is unsafe because such agencies in the USA can access personal data without due process, and because the USA has no law that limits the use of personal data by them.

Perhaps the time has come is not for a revamped Safe Harbor (as is promised), but for the USA to adopt a Federal Data Protection Law.

References 

Schrems  v Facebook: Case C 362/14 http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=81678

The above will be discussed at our all day UPDATE session (Oct 19th; London; £225).  Also coming up are our Data Protection Practitioner courses leading to the BCS Qualification in Leeds (starting October 13th) and Edinburgh (starting 2nd Nov). All details on www.amberhawk.com.

ECJ bombshell! No fair processing notice? No processing.

I think the European Court of Justice (ECJ) has just issued a judgement which has the potential to be more important than Max Schrems v Facebook (due on October 6 next week).

The ECJ has just concluded that Articles 10, 11 (the fair processing requirements of Directive 95/45/EC) and Article 13 (includes the exemptions from the need to provide a fair processing notice) must be interpreted as precluding national measures which allow a public administrative body in a Member State to disclose personal data to another public administrative body for their subsequent processing, without the data subjects being informed of that disclosure and processing.

This judgment seems to imply that if a fair processing notice does not describe the purpose of the processing and there is no exemption from the fair processing obligation then a data controller should not process personal data for that purpose!  Certainly, Government should not introduce data sharing legislation and ignore the fairness obligations under the Act (unless there is no applicable exemption from the fairness obligations).  This is the position irrespective of an Article 7 criterion (i.e. a Schedule 2 ground in the UK Act) for the processing of personal data.

The Court agreed with the Advocate General that the requirement to inform the data subjects about the processing of their personal data is important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the personal data being processed (in Article 12 of Directive 95/46), and their right to object to the processing of those data (in Article 14 of the Directive).

According to the Court, it follows that the fair processing requirements of personal data as laid out  in Article 6 of Directive 95/46/EC (i.e. the First Principle of the UK DP Act) “requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data”.

The Court rejected the idea that because there was a law that allows the disclosure, then there was no need to provide a fair processing notice.  The Court stated that only reason why one cannot provide a fair processing notice is when there is an exemption from the obligation consistent with the conditions laid down in Article 13 of Directive 95/46/EC (which permits Member States to derogate from fairness obligations flowing from Article 10).

That is why “Articles 10, 11 and 13 of Directive 95/46 must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing” (my emphasis).

Note that this judgment can be overturned if the Council of Minister’s version of Article 21 of the General Data Protection Regulation prevails.  This allows Member State law to introduce an exemption from the fair processing notice with respect to “important objectives of general public interests of the Union or of a Member State”.  As any government can argue that the reason for enacting any legislation is to meet “important objectives of general public interests”, then the Article 21 exception proposed by any Member State legislation can neuter this new ECJ Judgment.

This is the Third ECJ judgement that the Council of Minister’s version of the Regulation would overturn; it is yet another indication that the Directive 95/46/EC might offer better protection to data subjects than the Regulation.

References

Case C-201/14 Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate and Others:  http://curia.europa.eu/juris/liste.jsf?num=C-201/14   (Sadly the English version of the Advocate General’s view is not available yet; I would really like to see what it says).

The above will be discussed at our all day UPDATE session (Oct 19th; London; £225).  Also coming up are our Data Protection Practitioner courses leading to the BCS Qualification in Leeds (starting October 13th) and Edinburgh (starting 2nd Nov). All details on www.amberhawk.com.

My analysis of Article 21, and the other exemptions promoted in the Council of Minister’s version of Regulation, shows that if this text prevails the Regulation will weaken protection for data subjects.  See end of http://amberhawk.typepad.com/amberhawk/2015/08/councils-exceptions-from-the-data-protection-regulation-degrade-the-privacy-protection-below-directive-9546ec.html.

The other two ECJ Judgments that are overturned by the Member State version of the Regulation: http://amberhawk.typepad.com/amberhawk/2015/07/council-of-ministers-regulation-text-negates-ecj-rulings-in-lindqvist-and-ryne%C5%A1.html.