MR JUSTICE WARBY
Approved Judgment
NT1 & NT2 v Google LLC
exemption might be available to it. It certainly did not suggest this in the Google
Spain case. Google’s reliance on s 32 would therefore have failed at the s 32(1)(b)
stage in any event.
(2) The Structure Issue
103.
There are three competing arguments on this question. Mr Tomlinson submits that
the Google Spain balance falls to be struck at the remedial stage, after a conclusion
has been reached on liability. Mr White argues that I should adopt a staged approach,
deciding first whether there is a prima facie obligation to the erasure of personal data
and then, if so, considering whether the obligation is avoided because the processing
is necessary for the exercise of the right of freedom of expression. He submits that
“the lack of a lawful basis for the processing of sensitive personal data merely gives
rise to the qualified right to be forgotten”. Mr White relies on the structure of Article
17 of the GDPR, which he submits is in this respect a “setting out” of the law as
declared by the CJEU in Google Spain, and should be applied by this Court. The ICO
rejects both these approaches as both wrong and unprincipled. She contends that the
issue is a straightforward question of liability, which calls for a decision on whether
Google has complied with its duties under the DPA, as interpreted in the light of the
DP Directive and the Charter. She argues, however, that for this purpose the
requirement of the First Principle, that the processing comply with at least one
condition in Schedule 3, should be disapplied, if the circumstances are such that, on
an application of the Google Spain criteria, the balance tips against delisting. The
basis for disapplication would be the same as that adopted by the Court of Appeal in
Vidal-Hall ([32] above).
104.
The existence of this last-mentioned argument betrays the fact that the various
approaches adopted by the parties are all at least partly driven by a view (on the part
of the ICO and the claimants) and/or a concern (on the part of Google) that on a
straightforward application of the DPA and/or the DP Directive Google is, or may be,
unable to demonstrate that any Schedule 3 condition is met. On the face of it, that
would lead inevitably to a conclusion that it is in breach of statutory duty. All agree
that this is not a tenable approach; the reasoning process involved would be too
mechanistic to be compatible with the requirements of the Charter and the
Convention. It would afford no recognition to the fact, acknowledged by the CJEU in
Google Spain, that there may be free speech justifications for disclosing sensitive
personal information, even if the data subject does not consent.
105.
These are not easy questions. Now that I have resolved the Exemption Issue against
Google, I am not sure that the answers matter, either for this case or more generally.
Everyone agrees that I must address the Google Spain balancing exercise at some
point, with due regard to the Working Party criteria. And this case is being determined
in the twilight of the DP Directive regime, with the first light of the GDPR already
visible on the horizon. It seems unlikely that my decision will have an impact on other
cases. In deference to the arguments, and recognising that this case may be considered
by another court, I will nonetheless state my conclusions, with brief reasons.
(1)
I reject Mr White’s submission. I am unable to identify any principled basis on
which I can use the GDPR as an aid to the interpretation of Google Spain or to
the identification of the legal principles that apply to events, some of which
occurred before the enactment of the GDPR, and all of which (so far) have