by Lyn McCarthy , Ruth Prendeville June-07-2019 in Healthcare Law, Data Protection
Since the decision of the European Court of Justice (as it then was) in Google Spain v Agencia Espanola de Proteccion de Datos (2014), often referred to as a ‘David and Goliath’ victory in terms of the ‘right to be forgotten’, there has been a proliferation of similar applications to search engines and related platforms from private individuals.
At its most basic, the ‘right to be forgotten’ entitles individuals to require search engines to remove links about them where the information is inaccurate, inadequate, irrelevant or excessive. The right is not absolute and must be balanced against other considerations, to include the right to freedom of expression and public health interests.
In recent months, there has been significant activity throughout Europe in relation to healthcare professionals and their ‘right to be forgotten’ in a professional context.
Whilst a recent Dutch decision on this point has attracted particular attention, it would seem that interpretation of the pertinent issues differs across the EU.
1. Dutch developments
In the recent much-publicised decision, a Dutch surgeon who had been formally reprimanded by a disciplinary panel was successful in a legal action requiring Google to remove certain search engine results about her. Although the District Court of Amsterdam ruled on the case in July 2018, it was only made public in January 2019 following a dispute over publication of the judgment.
i. Disciplinary Action
In this particular case, the surgeon had been suspended from practice due to allegedly unsatisfactory post-operative care of a patient. On appeal, her suspension was reduced to a conditional suspension where she was permitted to continue to practise, subject to certain restrictions.
Pursuant to its governing legislation, the Dutch Medical Board maintains an online register of all medical professionals who have had disciplinary measures imposed on them. Accordingly, the disciplinary measures in relation to the surgeon were recorded on the website. The first results returned upon entering the surgeon’s name into a Google search, however, were links to a website containing an unofficial ‘blacklist’ of healthcare professionals which allowed users to post messages on a public forum.
The Dutch data protection authority refused the surgeon’s request to direct Google to remove the search results, agreeing with Google that the information remained relevant because the surgeon remained subject to a conditional suspension.
ii. Judgment
The District Court of Amsterdam subsequently ruled that the surgeon’s interest in having the search results removed outweighed the public’s interest in finding the information on the website and ordered Google to remove the results. In so finding, the Court took into account that the website gave the impression that the surgeon was unfit to treat patients (which the medical disciplinary panel had not found) and also that information regarding the disciplinary action taken against the surgeon was publicly available on the Medical Board’s online register.
iii. Territorial Scope
The practical implications for cases such as this one must be viewed in light of the territorial scope of European data protection law. Currently, Google only delists the information of those who have successfully invoked the so-called “right to be forgotten” across its European domains (such as Google.fr and Google.de) and not its non-European domains (such as Google.com) on the basis that the right does not have worldwide application. This practice has been heavily criticised by France’s data protection regulator (the “CNIL”) as inadequate to safeguard data protection rights, having regard to the global reach of the internet.
The dispute between Google and the CNIL is the subject of a case that is pending before the Court of Justice of the European Union, the outcome of which is eagerly awaited.
2. Recent Austrian decision
In contrast to the developments in the Netherlands in late 2018, the Austrian Data Protection Authority (the “Authority”) on 26 February 2019 published a decision, dated 15 January 2019, relating to the processing of a general practitioner's personal data.
i. Online information
The decision concerned data relating to the GP which had been taken by a medical search company from a publicly available web page of the Medical Association for Vienna. The medical search company had displayed the information together with patient evaluations on its physician search platform.
A formal complaint was made by the GP, who alleged that the medical search company had infringed his right to be forgotten under Article 17 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') by refusing to delete the GP's data.
ii. Decision of the Austrian Data Protection Authority
The Authority found that it was necessary to balance the legitimate interests of the medical search company and patients against the possible consequences for the GP, including the fact that negative reviews and testimonials may influence potential patients' choice of GP. In this regard the Authority referred to Germany's Federal Court of Justice's decision GZ VI ZR 358/13 of 23 September 2014, where it was held that a GP did not have a claim to the right to be forgotten, as the interests of patients outweighed that of the GP.
Ultimately, the Authority held that the processing of the GP's data was lawful and there was no breach of the GP's right to be forgotten. It held that the medical search company was correct in rejecting the GP's request, as the processing of data was necessary in exercising the right to freedom of expression and information in accordance with Article 17(3)(a) of the GDPR
Although this determination is one of a regulator as opposed to a court, it shows a markedly different approach to the balancing of rights exercise involved to that adopted in the decision in the Netherlands, cited above.
3. Comment
Although applications of this nature are in their infancy, it is interesting to note the divergence of opinions between the various jurisdictions in terms of the respective doctors’ claims of a right to be forgotten. Indeed, given that the Dutch decision related to disciplinary action and findings, it would appear that this information should be less easy to remove on foot of an application of this nature than the views and feedback of patients concerned in the Austrian decision.
In Ireland, although the right to be forgotten has been considered by the courts, there has not yet been a case dealing specifically with the issue in the context of a healthcare professional. That said, the rules governing the issue of publication in relation to disciplinary sanctions in this jurisdiction are instructive in that the governing regulatory frameworks and legislation for the various healthcare professions provide very clear powers and guidelines in relation to when publication of a decision and sanction may be made, in what manner and to whom.
In the context of the Medical Practitioners Act 2007, the Pharmacy Act 2007, the Health and Social Care Professional Act 2006, to give examples, the decision in relation to publication is the preserve of the Council or Board and will most often involve consideration of the issue at oral hearing with an opportunity for submissions from the registrant involved. Although these frameworks are silent on media coverage and online commentary following a determination, given the importance and weight afforded to issues relating to publication and privacy by the legislature in this area, it would appear not unreasonable to expect that any ‘right to be forgotten’ applications by healthcare professionals here, particularly as they relate to disciplinary findings, sanctions and investigations, would be viewed in the context of this regulatory landscape.
Developments in the area, at home and abroad, will be watched with interest.
For further information please contact Lyn McCarthy lmccarthy@hayes-solicitors.ie or Ruth Prendeville rprendeville@hayes-solicitors.ie at Hayes solicitors.
Back to Full NewsShare this article:
About the Authors
Lyn McCarthy
Lyn is a partner in the Healthcare team at Hayes solicitors. Lyn advises clinical practitioners and indemnity bodies in respect of the defence of medical negligence claims and also in respect of the defence of professional disciplinary matters before Committees of inquiry.
Ruth Prendeville
Ruth is an associate solicitor in the Commercial & Business team at Hayes solicitors. She advises on an array of commercial and regulatory matters, including in the areas of privacy and data protection, intellectual property, terms and conditions of purchase and sale, advertising and promotions and commercial contracts. Her clients include those from key business industries including media and entertainment, advertising, motor, food, accountancy, manufacturing and business networking.