In July 2014, the High Court (the ‘Court’) considered for the first time the implications of the landmark decision in Google Spain, when delivering an interim judgment in the case of Hegglin v Persons Unknown  EWHC 2808 (the ‘Judgment’).
Mr Hegglin (the ‘Claimant’), a businessman who lived in London but now resides in Hong Kong, sought to have removed a number of abusive and defamatory allegations about him that had been posted on various websites by unknown persons. Google was a defendant in the case as portions of the offensive material appeared in search results, and because Mr Hegglin requested the court to order that the identities of the anonymous posters be disclosed to him.
While the substantive claims remain to be decided, the Court considered certain interim matters, including an interim injunction and permission to serve the claim on Google, Inc., incorporated and located in the United States.
The Claimant sought an interim injunction against Google based on sections 10 and/or 14 of the Data Protection Act 1998 (‘DPA’), which allow individuals the right to prevent the processing of their personal data where it is likely to cause damage or distress, or where it is otherwise inaccurate. The Court rejected Mr Hegglin’s application for an injunction on the grounds that there was insufficient notice (less than two clear working days) and it was too extensive, as it would have required Google to take “all reasonable and proportionate technical steps as might be necessary in order to ensure that [the] material does not appear as snippets in Google search results.” However, the Court did issue an order requiring Google to disclose information in its possession which could assist the Claimant in identifying the individuals who are responsible for the posts.
When considering whether the Claimant should be granted permission to serve the proceedings out of the jurisdiction, the Court considered the Google Spain case and noted that the Court of Justice of the European Union (‘CJEU’) had concluded that Google was a data controller for the purposes of Data Protection Directive 95/46/EC. As a result, there was “at least a good arguable case” that Google was required to comply with the DPA when processing the Claimant’s personal data. On this basis, permission was granted.
While this case is not concerned with the “right to be forgotten”, which has been subject to extensive press and political attention, it highlights the fact that the CJEU’s decision is in fact much broader. The full consequences remain to be seen, and the case is set to come to full trial in November 2014.