Judge Sheehan of the Circuit Court recently delivered judgment in Mark Savage v the Data Protection Commissioner and Google Ireland Inc,
holding that the Appellant (Mark Savage, a former election candidate) had an entitlement to have information posted about him on Reddit (a social news aggregation, web content rating, and discussion website, where registered community members of Reddit can submit content, such as text posts or direct links.) removed by Google.
The Appellant handed out leaflets as part of his campaign during the 2014 local elections. These leaflets referred to "gay perverts cavorting in flagrante on the beach in broad daylight
", that subsequently formed the subject of a Reddit thread which described the Appellant as "North County Dublin's homophobic candidate
". When conducting a search of the Appellant’s name on Google, the list of the results provided a link to the thread on Reddit. The Appellant made a request to Google to remove/de-index the thread so it would no longer be in the list of results from a search of his name, arguing that it branded him as a homophobic.
Google declined his request to remove/de-index the content. The Appellant took the matter before the Data Protection Commissioner (the "DPC") who found that there had been no violation by Google of the Data Protection Acts 1988 and 2003 (the "Acts"). The DPC’s decision was based on the fact that an internet user searching for information on the local elections was unlikely to consult an online discussion forum as a source of verified facts.
Circuit Court decision
The DPC’s decision was appealed and overturned by the Circuit Court which found that the fundamental rights and legitimate interests of the Appellant had been prejudiced. The view of Judge Sheehan was that individual users of the internet could in fact consult online discussion forums such as Reddit as a source of verified facts given the way search engines such as Goggle operates.
The DPC and Google have lodged an appeal to the High Court which is listed for hearing in May 2017.
We will provide a further update following the High Court hearing.
General Data Protection Regulation (“GDPR”)
The GDPR which comes into effect in May 2018 puts the ‘right to be forgotten’ on a statutory footing (which is currently not the position), subject to a number of limited exemptions for example for the establishment, exercise or defence of legal claims. We anticipate that data controllers will see an increase in data access requests followed by erasure ‘right to be forgotten’ requests.