Erasing the right to know: Maltese courts applying restrictive interpretation of privacy rules

The director of the Maltese law courts is facing mounting requests from people whose names appear in court judgements, to have their records removed from the public online database.

The database, created in 2000, has had 22 court decisions removed although these are not struck off the courts’ records but are only removed from the publicly accessible online system.

While director general Frank Mercieca says he is processing requests according to the EU’s General Data Protection Regulation’s ‘right to be forgotten’ clause, there is so far no clear system of making a formal request, with visible criteria that must be satisfied, and no public record of those cases being removed.

MaltaToday won partial access to the removed decisions through a Freedom of Information request, but the courts director has refused to divulge the names of the ‘right to forget’ complainants.

The decisions so far removed include errors in anonymised family court decisions, where one of the witnesses such as a domestic partner, is identifiable; cases where minors are mentioned; several conditional discharges; anonymised annulment cases where one party is mentioned; a case where a court verbale stated that the name of the minor, who was liberated of the charges, was not be to be published but was ignored; a case where the victim is named in the decision of a court of criminal appeal; and a case where the witness in a drug trafficking case is mentioned.

While the court director-general, who is also data controller, tells complainants that removal of these decisions are not policy, Mercieca is employing his discretion when interpreting the “right to forget” in the GDPR’s Article 17(1)(a).

This states that data subjects have the right to have any personal data erased when the data is “no longer necessary in relation to the purposes for which they are collected or processed”.

But it is arguable that the importance of seeing justice to be made does require the necessity that these decisions remain publicly available at all times, especially considering that the GDPR’s Article 17 (3) says that the right of erasure does not apply for exercising “the right of freedom of expression and information.”

Need for clear standards

One of the beacons for openness on digital rights and laws is the Malta IT Law Association, which shudders at the restrictive way in which certain regulations are being interpreted.

Indeed, the MITLA rightly makes a crucial difference: complainants who have a grievance might have a problem with search engines like Google but potentially also a problem with the processing that is not being carried out by a public online repository provided by the Government that should stand as a witness of our justice system.

Removal of personal data from an online service administered by Government and which contains public records, especially court judgments, cannot be simply compared to de-listing from a search engine,” MITLA member and University of Malta lecturer in data protection law Antonio Ghio said.

Additionally, the right to be forgotten is not an absolute right – data controllers such as the court’s director should take into consideration whether the public interest is served by deletion or not, and the importance of the personal data being erased.

“The application of public interest considerations restricting the right to be forgotten is stronger when the request for erasure of public data is not being made against a search engine, or a newspaper but on the keeper of the public record,” Ghio says.

The concerns raised by MITLA are problems that newspapers and journalists will share when faced by the courts’ apparent discretion at accepting the requests.

First there is the issue of transparency. It was only through PQs and freedom of information requests that the public learnt of how many requests the courts’ director has received for the deletion of the public online records. It lacks the semblance of a system where complainants must be identifiable and where the public can be informed of any such deletion.

“There is no rule, policy or procedure publicly available that outlines the workings of how exercising one’s right to be forgotten with respect to the deletion of court decisions available on the online local court database works. Irrespective of the fact that such a rule might be right or wrong, there is surely no transparency whatsoever in such ‘system’,” Ghio said.

As evidenced by the variety of requests accepted by the courts’ director, the
discretion – even when applied according to set criteria – may lack legitimacy, because deletion may take place simply “to pander to private persons’ disproportionate expectation of their rights, while creating a precedent for further unjustified requests.”

For example, somebody who wants to run for politics might want previous convictions, minor or not, removed from the public online system. It stands to reason that the interest of the public will be significantly greater when the data subject plays a role in public life.

The Article 29 Working Party, the European experts who discuss the application of the data protection rules of the EU, have said that “politicians, senior public officials, business-people and members of the (regulated) professions can usually be considered to fulfil a role in public life... A good rule of thumb is to try to decide where the public having access to the particular information – made available through a search on the data subject’s name – would protect them against improper public or professional conduct.”

Such an example could explain the legitimate interest that a court judgement is left on a public database indefinitely, but surely the answer is not so simple and there is no one-size fits all solution.

MITLA also mentions three other important elements: justifiability, in that people’s data must no longer be required for the purpose that it was collected for; necessity, which means these ‘right to be forgotten’ complaints must be weighed against the public interest and transparency, and proportionality.

Ghio says complainants cannot expect to be “absolved” from the truth of their past in all occasions, especially when such availability of information is still relevant to the present and future, whether as individuals or as society at large, especially when one considers that position that certain people, including public officers have.

“Without specific rules, the right to be forgotten cannot be used as a blank cheque to re-write our (personal) history, especially when crimes, which affect the whole of society, are involved. If we start on this dangerous route, will we continue to erase other, more heinous crimes, simply because it is not fair for one’s criminal history to follow one for the rest of one’s life? Where would the fairness and justice in that be for the victims of that crime?  Where would that leave society at large?”

Ghio says Malta needs to discuss rights relating to the rehabilitation of offenders, to balance them with privacy rights and the rights of society to be informed. “Such laws have been in existence in Germany since the early 70s and the time is ripe to start considering such rules also in Malta, not only due to the right to be forgotten but also in light of our right to personality and informational self-determination.”

Blame Google

People who complain about their cases cropping up on internet searches may have a simpler avenue to get what they are after, without upsetting the function that a public registry of court decisions provides to society and the press.

Only last week, a businessman won a legal action against Google to remove search results about a criminal conviction in a landmark “right to be forgotten” case.

The decision taken in the London High Court could have wide-ranging repercussions, because the claimants demanded that Google remove search results mentioning the cases for which they were convicted. These include links to web pages published by a national newspaper and other media. Google refused their request and the men took the company to the high court.

Explaining his decision, the judge’s key conclusion was the second complainant’s – who won the case – “crime and punishment information has become out of date, irrelevant and of no sufficient legitimate interest to users of Google search to justify its continued availability”.

This has to be contrasted with what the judge said of the first complainant, who had been convicted of conspiracy to account falsely in the late 1990s; the claimant who won had been convicted of conspiracy to intercept communications. The judge said of the first applicant that he had “not accepted his guilt, has misled the public and this court” and that also “remains in business, and the information serves the purpose of minimising the risk that he will continue to mislead, as he has in the past. Delisting would not erase the information from the record altogether, but it would make it much harder to find.”

This judgement begs the question as to how data controllers should assess requests being made for the deletion of public records of court decisions that concern them. Firstly, is the court’s data controller responsible for the grievance or is it Google and its search engine that is troubling the complainant? Secondly, is the case outdated and is the subject-matter irrelevant to the complainant’s present circumstances?

For if someone with a string of minor crimes should one day seek office in the House of Representatives, would voters’ public interest not be rightly served by knowing the full extent of a candidate’s criminal and legal history?

The barrister representing the first complainant, Hugh Tomlinson QC, is also chairman of a press regulation campaign group Hacked Off. He told the court the businessman made a living from commercial lending, and was not a public figure. An oft-mentioned concern was that “people engaged in misdeeds when they were young and if the misdeeds were constantly brought to the attention of others then they would permanently have a negative effect.”

Google’s barrister Antony White QC, however, argued that the “right to be forgotten” ruling first laid down in 2014 by the EU’s Court of Justice was “not a right to rewrite history or ... tailor your past if that’s what this claimant would like to use it for”.

White said the business malpractice that gave rise to the complainant’s conviction was “serious and sustained”.