The Office of the Privacy Commissioner of Canada (the “OPC”) recently released a draft policy position regarding the protection of online reputation. The OPC will finalize its position after seeking stakeholder views on the proposals presented in the draft policy position.
The draft policy position considers whether the existing legal framework in Canada has mechanisms in place to resolve reputational concerns with content published on the internet. The OPC also proposes steps for Parliament to follow in order to further embolden the protection of online reputation.
While the OPC is careful to state that it is not suggesting the adoption of the “right to be forgotten” that was introduced in the EU’s General Data Protection Regulation, its interpretation of existing law coupled with its proposals indicate a push in the same direction.
Existing Protection of Online Reputation
According to the draft policy position, existing privacy rights and obligations set out in the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”), already enable individuals to seek the removal or practical obscurity of old and/or inaccurate information from the internet.
PIPEDA is federal privacy legislation that applies to private sector organizations who collect, use or disclose personal information in the course of commercial activities in all provincial jurisdictions that do not have substantially similar legislation.
Websites are Sometimes Required to Remove or Amend Personal Information
The OPC observes that much of the personal information that is published by websites involved in commercial activities is provided directly by individuals about themselves (i.e., on social media platforms). In these circumstances, the OPC says, the websites must remove personal information if ever requested to do so by the individual who posted it. The OPC implies this requirement from the PIPEDA principles mandating that: (1) individuals may withdraw consent to the collection, use or disclosure of their personal information; and (2) information that is no longer needed must be destroyed, erased or made anonymous.
Where personal information about an individual is published online by someone other than that individual, however, the OPC concedes that PIPEDA does not presently, either expressly or through implication, provide for an absolute right of removal. An individual may only seek to challenge the publication of the information on the basis of accuracy or appropriateness.
Search Engines are Sometimes Required to De-index Personal Information
The draft policy position opines that the obligations of PIPEDA apply to search engines. In so doing, the OPC observes that by indexing webpages containing personal information, and returning links to those pages in search results, search engines are collecting, using and disclosing personal information. The OPC further observes that most search engines display advertisements along with these search results and, therefore, collect, use and disclose personal information in the course of commercial activities.
PIPEDA permits individuals to challenge the accuracy, completeness and currency of search results returned for searches in their name. The OPC notes that, in certain circumstances, proper application of PIPEDA will require the de-indexing of search results. In other circumstances, however, in order to accommodate the public’s interest in freedom of expression and information remaining accessible, simply lowering the ranking of a search result will be sufficient to meet the obligations of PIPEDA.
Proposals for Further Protection of Online Reputation
Personal Information about Youth
The draft policy position argues, specifically, for a lower standard for youth to have personal information about them de-indexed or removed from the internet. The OPC’s position in this regard recognizes the inherent vulnerability of children in addition to their reduced cognitive and maturity levels. The OPC suggests that the consent given by youth to the collection, use and disclosure of their personal information cannot be considered meaningful.
On the basis of the above, the draft policy paper urges that any challenge to the publication of personal information about youth should heavily favour de-indexing or removal.
The OPC also observes that many parents will post information and pictures of their children that may seem “cute”, but may still be harmful to them in the future. On this basis, the draft policy position recommends that Parliament consider providing youth with an express ability to request and obtain removal of online information posted about them by their parents or guardians.
Improving Education about Online Reputation
The OPC and the privacy regulators for each of the provinces and territories have issued a joint letter to the Canadian Council of Ministers of Education calling for privacy protection to be incorporated into the curriculum for digital education. The objective of such education is not only to develop an understanding of online privacy to protect their own interests, but also to respect the interests of others.
Legislative Amendments
While the draft policy position acknowledges the applicability of PIPEDA to search engines, the OPC recognizes that many of the statutory obligations are not easily obtainable (i.e. obtaining consent directly from individuals). The OPC recommends that Parliament consider amending the legislation in order to respond to such concerns.
The OPC also calls for enhancing the powers of the OPC to include stronger enforcement mechanisms, such as order-making and fining powers.
Lastly, the OPC suggests that Parliament consider a specific legislation to address online reputation directly.
The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.
© McMillan LLP 2018
