Mosley v Google Inc & Anor

A search-engine operator may be a data controller for processing personal data displayed through its search results. A claimant who gives a valid notice under section 10 of the Data Protection Act 1998 may seek an order requiring the operator to cease processing where substantial, unwarranted damage or distress is reasonably arguable. The E-Commerce Directive does not at this stage establish that such relief is unavailable. Its prohibition on general monitoring does not necessarily prevent measures directed to identified images or a specific dispute. Whether the proposed measures would involve impermissible monitoring, and whether compensation and erasure remedies are available, required further determination.

The claimant had obtained damages and an injunction against the publisher of images depicting private sexual activity. The images nevertheless remained accessible through internet searches. He brought claims against Google Inc and Google UK for misuse of private information and under sections 10, 13 and 14 of the Data Protection Act 1998. The claim against Google UK was discontinued or shortly to be discontinued.

Google applied to strike out the claim or obtain judgment on the basis that it had no real prospect of success. The common-law claim was stayed. The court considered whether the data-protection claim was viable, whether Google was a data controller, and whether the E-Commerce Directive prevented the proposed relief.

1. The claim against Google UK was discontinued or was shortly to be discontinued. The common-law claim against Google Inc was stayed. The claims for compensation and relief under sections 13 and 14 of the Data Protection Act 1998 were also stayed pending an appeal concerning proof of damage.

2. Following Google Spain SL v Agencia Espanola de Proteccion de Datos, [2014] QB 1022 ("Costeja"), Google accepted that a search-engine operator is a data controller in respect of processing carried out by finding, indexing, temporarily storing and making available personal data in search results.

3. On the assumed facts, the claimant’s section 10 claim was reasonably arguable. He had given written notices, and his assertion that the processing caused substantial and unwarranted distress was capable of belief. The court could order steps to comply with a justified notice.

4. Reducing an image to a thumbnail did not modify it for the purposes of Article 13(1)(a) of the E-Commerce Directive. Modification required an alteration to the information or impression conveyed by the image, such as changing the image or adding material to it.

5. The relationship between the Data Protection Directive and the E-Commerce Directive could be approached either as a comprehensive data-protection code or by reading both instruments in harmony. The provisional preference was for the latter. In either event, the relevant provisions permitted a judicial remedy capable of requiring steps to cease processing.

6. Article 15 of the E-Commerce Directive prohibited a general obligation to monitor, but the evidence did not permit determination at the strike-out stage whether the claimant’s proposed measures would amount to prohibited monitoring. The prohibition did not necessarily bar measures concerning identified images. Effective and proportionate relief remained potentially available without impermissible monitoring.

7. The claim against Google Inc was viable, raised issues of general public interest, and should proceed to trial.