Recently, the Office of the Privacy Commissioner of Canada (OPC) released an important draft Position on Online Reputation (paper). The paper takes the position that current federal privacy legislation, the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA), entitles individuals to ask search engines to de-index web pages that contain inaccurate, incomplete or outdated information about them, and creates a corresponding obligation by search engines to remove such web pages from search results. The paper also calls for procedures that would allow removal or amendment of information at the source in certain circumstances – meaning removal or amendment of the content from the actual website that posted the information, rather than simply de-indexing from search results.
The OPC proposal is similar to the "right to be forgotten" (RTBF) that was recognized by the European Court of Justice in 2014, involving the interpretation of the European Union's (EU) data protection regulation (Google Spain v. AEPD and Gonzàlez). This judgment requires search engines, such as Google, to remove links or "de-list" search results about individuals that contain "inadequate, irrelevant or no longer relevant, or excessive" personal data. Since 2014, Google alone has received requests to de-list over 2,045,700 links under the EU privacy law (Google's Transparency Report). The EU has passed a new EU General Data Protection Regulation (GDPR) that is expected to come into force in May 2018, which will codify an RTBF into EU law.
Canadian courts have not recognized the RTBF as part of Canadian law. While significant similarities exist, the OPC asserts that its approach "does not import a European framework into Canada. Rather, it is an interpretation of current Canadian law, and the remedies related to online reputation that can be found therein."
In the paper, the OPC states that PIPEDA provides an RTBF by providing individuals with the right to withdraw consent to the use of personal information, and by requiring that personal information be retained only as long as necessary. Combined, the OPC states that these requirements mean that individuals "should have the ability to remove information they have posted online." In cases where personal information about an individual has been posted by others, individuals do not have an "unqualified right to remove it," but should be provided with a mechanism to challenge its accuracy or completeness.
The paper states that the OPC has considered how to strike an appropriate balance between individual privacy interests and broader societal values, such as freedom of expression. It does not specifically address online material from the media, whose journalistic activities are exempt from PIPEDA, though it does reject the argument that search engines are exempt because they serve journalistic or literary functions (on the basis that they do not distinguish between journalistic/literary and other material).
In considering other critiques of the de-indexing concept, the OPC argues that concerns surrounding the appropriate territorial scope of any de-indexing requirement under PIPEDA can be addressed by "geo-fencing" techniques that can limit search results to searches originating in Canada. Similar questions about the appropriate scope of the RTFB and whether it can apply in jurisdictions outside the EU have arisen in France, and a case on this issue is currently pending before the European Court of Justice.
The paper also contains other recommendations beyond de-indexing and source takedown that, if accepted, could result in significant changes to the privacy landscape in Canada. These include:
- A proposed federal law creating an absolute right for youth to remove any content from the internet that they have posted themselves or that they and others (such as a parent or guardian) have provided to an organization to post.
- The development of an industry-wide code of practice for takedown policies, privacy details and procedures.
The OPC intends to engage in further consultations with stakeholders before finalizing its position. It also calls for Parliament to study the issues and potential procedures raised in the paper. A full text of the paper can be found on the Office of the Privacy Commissioner of Canada's website.
We wish to acknowledge the contribution of Paul Schabas to this publication.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.