Skip to main content

Internet service providers: duty to monitor

On 15 January 2015, Google’s application to strike out a data protection claim brought by Max Mosley was dismissed, (Mosley v Google Inc. [2015] EWHC…

On 15 January 2015, Google’s application to strike out a data protection claim brought by Max Mosley was dismissed, (Mosley v Google Inc. [2015] EWHC 59 QB).

In 2008, while Max Mosley was participating in private sexual activity in a London flat, he was secretly filmed by the News of the World, which subsequently published pictures and displayed edited footage on its website. Following trial, it was found that Mr Mosley’s reasonable expectation of privacy had been infringed. He was awarded compensatory damages and a permanent injunction restraining NGN Limited from republishing the images and footage. Notwithstanding this, the images are still maintained on websites by persons other than NGN and can be accessed by search engines, such as Google.

Although Google blocks access to individual offending website addresses and pages when Mr Mosley brings them to its attention, many such sites remain and new ones appear. In 2014, Mr Mosley issued proceedings against Google claiming damages and injunctive relief.

The 2014 judgment of the Grand Chamber of the Court of Justice in Google Spain SL v Agencia Espanola de Proteccion de Datos, [2014] QB 1022 confirmed that an internet service provider may act as a data controller which processes personal data, for the purposes of the Data Protection Directive (95/46/EC), (the “Data Protection Directive”).

Mr Mosley asserted rights under the Data Protection Act 1998, (which implements the Data Protection Directive in England and Wales) claiming that Google should stop processing personal data relating to his previous activities, as the continued publication of such data was causing him substantial and unwarranted damage or distress.

The defendants applied, but failed, to have the claim struck out. Google’s legal arguments centred on the E-Commerce Directive (2000/31/EC), (the “E-Commerce Directive”). Google argued that Articles 12-15 of the E-Commerce Directive conditionally excluded legal liability on an internet service provider for information and images retrieved by a user via a search engine. In particular, it argued that, pursuant to Article 15, when providing the Services covered by Articles 12-14 inclusive, (i.e. acting as a “mere conduit”, “caching” and “hosting” in respect of data in the context of the provision of an information society service), it has no duty to monitor generally the information which it transmits or stores, or to actively seek facts or circumstances indicating illegal activity, subject to certain provisos.

Among other things, the court observed that the prohibition in the E-Commerce Directive on the requirement to monitor generally did not apply to monitoring in specific cases. It held that Mr Mosley had a viable case which might succeed and which raised public interest issues. It was not possible to say, on the limited evidence before it, that the steps that Mr Mosley required Google to take involved a general obligation to monitor, contrary to Article 15 of the E-Commerce Directive. It was appropriate for this matter to be aired fully at trial, rather than struck out without trial.

In conclusion, the Google Spain case has raised the possibility of an increased number of claims being brought under data protection legislation in the future. It will be interesting to see what conclusions are reached by the court if this claim proceeds to a full trial; it may have implications for those wishing to bring similar claims against search engine operators in future.