PREVIOUS CASES

 

 

 

 

Case #1

A business contacted us complaining about nasty and untrue reviews posted on a site for business services. The reviews contained some demonstrably false personal data about the staff of the business. We submitted a complaint to the website that published the reviews and asked for their removal under Article 17 of GDPR (Right to Erasure/Right to be Forgotten). After an exchange of correspondence arguing about the right of privacy of staff versus the right of customers to read reviews, the website conceded that the reviews were both unreliable and irrelevant to the nature of the business. The site deleted the reviews.

Case #2

A man was found guilty of a public order offense and received the Probation Act in 2016. Various Irish newspapers covered the story. The Probation Act was designed to prevent criminal convictions and give people a second chance. Despite this, the man found that his professional life was ruined due to internet coverage and he was unable to secure an income. We took up the case and scanning the Hansard debates (UK Parliament Debates) from the early 1900s clearly established that the Probation Act aimed to give people a second chance and that the search engines positioning of the story in a search for our client’s name destroyed the intent of the legislation. It took over two years of correspondence with the search engine until we were able to get them to delist the links. 

What was interesting in this case was that the search engine repeatedly changed the reason not to remove the links in correspondence with us. This confirmed our suspicion that the systems for assessing the request for erasure are arbitrary and far too subjective. This has somewhat improved more recently but remains a problem.

Case #3

A man contacted us in relation to an entry on his medical file held by a GP. The file had allegations made by his ex-wife, who had severe mental health issues, to a GP in the practice they both used. The allegations were false, unfounded, and had never been made before or indeed to the Police. The man became aware of these allegations when seeking to make an appointment with his usual female GP, the clinic administrator informed him he would have to see a male GP due to ‘security and safety concerns.’ The clinic then refused to explain what these were, citing ‘patient confidentiality’. Upon taking up his case we successfully obtained his medical file (through Article 15 of GDPR) where we could see that allegations were inputted into his file as established facts. Upon this discovery, we instructed the GP offices to delete the entry from the man’s medical record, but they refused arguing that the opt-out in ‘public health’ was applicable. After intervention from a medical regulatory body we contacted, the GP office agreed to remove the entry and they sent the man a written explanation and apology.

Case #4

A man contacted us regarding the coverage of his trial for assault. In this trial, he was found guilty, and it received coverage in a number of newspapers in Ireland. An internet search for his name displayed the details of this crime and his guilt. However, our client subsequently appealed the sentence and won, meaning he was ultimately found not guilty. This received no coverage in the newspapers and hence the final outcome of the judicial process was not captured in a search for his name. We successfully argued with the search engines that the listing of his original trial, where he was found guilty, was unfair and did not tell the full story, giving an unfavorable and inaccurate portrayal of him. They delisted the press articles on their search engine.

Case #5

A woman who had been bought a gift voucher for a massage contacted us as she had been unable to get her health data erased from the beauty salon where the massage had taken place. At the time of the appointment the salon had handed her a lengthy form they said she had to fill out ‘for GDPR’. This form asked all sorts of irrelevant private questions about her health and lifestyle when she was only getting a massage there. After the massage, she emailed the salon asking them to delete her health data. The salon refused for ‘insurance reasons’. We made contact with the salon, pointed out the flaw in their reasoning, informed them they processed our client’s data illegally, and requested immediate deletion of all the information they held about her. They refused to do so and so we contacted the Irish Data Protection Commission who mediated in the dispute, ensured the woman had her data deleted, the salon made an apology and a full refund was provided to the woman for the original massage.