united-kingdom gdpr european-union court-records
Does the GDPR cover reference to court proceedings?
<p>On this site many good answers are referenced by real court cases, usually in the form Surname vs. Surname [date] &lt;link to further details&gt;.  There also <a href="https://www.prearesourcecenter.org/sites/default/files/library/crossgendersearchescaselawsurvey.pdf" rel="nofollow noreferrer">exist documents</a> (example is US so as not to breach GDPR) that collect multiple court cases that share features, and publish them together.</p>
<p>The UK Data Protection Act 2018 specifies additional rules about <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/criminal-offence-data/" rel="nofollow noreferrer">processing criminal offence data</a> that are quite strict, and would seem to include posting court proceedings on stackexchange:</p>
<blockquote>
<p>What is criminal offence data?</p>
<p>This covers a wide range of information about offenders or suspected offenders in the context of:</p>
<ul>
<li>criminal activity;</li>
<li>allegations;</li>
<li>investigations; and</li>
<li>proceedings.</li>
</ul>
<p>you can only process criminal offence data if the processing is either:</p>
<ul>
<li>under the control of official authority; or</li>
<li>authorised by domestic law. This means you need to meet one of the conditions in Schedule 1 of the DPA 2018.</li>
</ul>
</blockquote>
<p>What is the law here?  Is posting references to court cases in the UK/EU processing data?  Is there an exception that allows this?  Are we all breaking the law?  What about stackexchange, who collects many of these references and makes them available to the public in a searchable form?</p>

<p>Privacy against publication of criminal convictions has been considered in the High Court in <a href="https://www.bailii.org/ew/cases/EWHC/QB/2018/799.html" rel="noreferrer"><em>NT1 &amp; NT2 v Google LLC</em> [2018] EWHC 799 (QB)</a>, if I may run the risk of posting a legal citation myself. But note that the claimaints there are anonymized, as often happens in criminal trials as well. In some cases, the court may give an injunction against disclosing names or details, and can hand down both a public and a private judgement, with the latter being a restricted document that does have the identifying details. So this question could only apply to mentions of criminal process where the accused is actually identified. (And I think just saying &quot;R v Smith&quot; is not enough - the posted or linked text would have to give some identifying detail about which Smith it is, the nature of the crime, etc.) I have no qualms at all about talking about NT1 and NT2.</p>
<p>The claimants brought a case against Google for making available information about their long-spent convictions, including on GDPR grounds although it took place just before the implementation of GDPR in UK law. Dealing with that argument under the prior legislation, the judge found that of the various exemptions claimed by Google, the condition</p>
<blockquote>
<p>The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.</p>
</blockquote>
<p>(found in the <a href="https://www.legislation.gov.uk/ukpga/1998/29/schedule/3/2017-04-27" rel="noreferrer">Data Protection Act 1998, Schedule 3, paragraph 5</a>, implementing the Data Protection Directive that preceded GDPR) applied, because of a longstanding principle for criminal conduct. The idea is that (paragraph 111):</p>
<blockquote>
<p>A person who deliberately conducts himself in a criminal fashion runs the risk of apprehension, prosecution, trial, conviction, and sentence. Publicity for what happens at a trial is the ordinary consequence of the open justice principle [...] The same must be true of the details of the offending, and other information disclosed in open court, including information about himself which a criminal reveals at a trial or in the course of an application.</p>
</blockquote>
<p>The core principles are the same as the carve-out from defamation law for the fair and accurate reporting of criminal proceedings (paras 44-49).</p>
<p>That &quot;made public&quot; condition can now be found in a slightly different context in the <a href="https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/part/3" rel="noreferrer">Data Protection Act 2018, Schedule 1, Part 3, paragraph 32</a>, which mirrors <a href="https://gdpr-info.eu/art-9-gdpr/" rel="noreferrer">Article 9(2)(e) of the GDPR</a> for the purpose of <a href="https://gdpr-info.eu/art-10-gdpr/" rel="noreferrer">Article 10</a>:</p>
<blockquote>
<p>This condition is met if the processing relates to personal data which is manifestly made public by the data subject.</p>
</blockquote>
<p>Since this is virtually the same condition of European provenance, in  the same context of surrounding rules, I think the precedent is a good guide.</p>
<p>For courts themselves, law reports, and journalism or scholarship, there are other specific grounds to rely on. Individual Stack Exchange posters are surely covered under the general exemption for posting on social media in a private capacity, <a href="https://gdpr-info.eu/art-2-gdpr/" rel="noreferrer">GDPR 2(2)(c)</a> as interpreted through its <a href="https://gdpr-info.eu/recitals/no-18/" rel="noreferrer">Recital 18</a>.</p>
<p>For the site itself, as in the case of NT1 and NT2, there could well be a legal claim made about the inclusion of criminal conviction information in a posted answer. (In general, such a post, being free text, could contain all sorts of defamatory statements or other objectionable content.) The court would have to look at the competing interests and the level of harm. NT1 was not successful but NT2 was. The example scenario, where we are talking about a very brief mention of a criminal case, cited because it illustrates a legal point rather than because there's anything relevant about the person mentioned, is quite far from the grounds complained of by NT2. For NT2, there was a newspaper article in which he was &quot;quite inappropriately, portrayed as one of a rogues' gallery of serious criminals&quot; (para 188), eight years after the end of his sentence, and it was this that he wanted removed from search results.</p>
<p>In particular, the <a href="https://www.legislation.gov.uk/ukpga/2018/12/schedule/1" rel="noreferrer">academic exemption (para 13)</a> seems strong, in the same way that it would be for a publisher of legal academic content. The test of &quot;substantial public interest&quot; does not apply, because this exemption comes through paragraph 36 in the case of criminal convictions; it's enough to show a reasonable belief that publication would be in the public interest. Google was not able to rely on the &quot;journalism&quot; version of this exemption (again, under the prior law) because they are a totally generic search engine for all kinds of data and purposes (para 100 of the 2018 judgement). The public interest test, and the accompanying &quot;legitimate interest&quot; for the data controller, do not seem too difficult in this example.</p>
