Sir Timothy John Berners-Lee, the British engineer credited with inventing the World Wide Web, called it “dangerous.” Jimmy Wales, founder of Wikipedia, described it as “deeply immoral.” The New York Times warned darkly that it could “undermine press freedoms and freedom of speech.”
“It” is the 2014 ruling by the Court of Justice of the European Union upholding a regulatory agency’s decision to order Google to delete any links to an old news article about an auction of some property belonging to a Spanish lawyer. The court agreed the old story was no longer relevant, introducing to the EU what many have called a new human right — the “right to be forgotten.”
The debate over the propriety of a right to be forgotten — RTBF, for short — has been raging on both sides of the Atlantic ever since. Its proponents say it’s the only way to protect personal privacy in an age when online information is practically permanent and universally accessible. The Office of the Privacy Commissioner got the ball rolling in Canada with a call for submissions on RTBF and online reputation in 2016, and the release of a draft position paper on the subject in early 2018.
In it, the OPC embraced both aspects of RTBF: “de-indexing,” which removes inaccurate, incomplete or merely outdated personal information from a search engine’s results without deleting it, and “source takedown,” which erases the offending data itself from the internet. “In either of the above cases,” the position paper says, “where matters cannot be resolved with a website or a search engine, individuals may lodge a formal complaint with the OPC.”
It sounds simple. It isn’t. Any attempt to introduce a RTFB to Canadian law — a right which, in the European context, means private-sector search engine firms de-indexing online material without seeking the content provider’s consent — would collide with the Charter of Rights’ guarantee of freedom of expression. That raises an awful lot of questions — many of them centred on what search engines do for a living.
“There’s a conflict of rights here,” says Nick Slonosky, chair of the Canadian Corporate Counsel Association. He helped draft the Canadian Bar Association’s response to the OPC’s paper.
“Freedom of expression is a fundamental right in this country. Balancing that with the individual’s interest in protecting personal information — you’re crossing into uncharted territory.”
The OPC bases its argument for a RTBF in Canadian law on its interpretation of the Personal Information Protection and Electronic Documents Act — specifically, the section which says organizations subject to the law must ensure the personal information they collect is as “accurate, complete and up to date as is necessary for the purposes for which it is to be used.”
PIPEDA gives individuals the right to “challenge the accuracy and completeness” of the personal information collected about them, and to demand that the organization which collected it amend — or delete — personal information that falls short. PIPEDA only applies to information collected through commercial transactions. While search engines offer their services for free, they also use that service to attract eyeballs to the ads that supply their revenue. The OPC argues that means search engines fall under PIPEDA’s authority.
Not so fast, say some lawyers in the privacy field: if the search is free, the search is not commercial — and PIPEDA doesn’t apply. Many argue search engines’ core function is closer in kind to journalism than to ordinary commerce — which, again, would leave them outside PIPEDA’s grasp.
“PIPEDA doesn’t cover the simple search function,” says Suzanne Morin, chair of the CBA Privacy and Access Law Section. “It’s totally open to Parliament to change that, but it would have to satisfy itself that the search function is a commercial activity, which I think would be a significant hurdle.”
While the CBA’s response to the OPC’s paper carefully states that it doesn’t “take a position on matters of policy best left to Parliament,” it points to several practical problems with enforcing RTBF. How, for example, could search engines possibly be expected to keep up with PIPEDA’s consent requirement for the tens of thousands of webpages they index containing personal information?
Moreover, could PIPEDA’s statutory withdrawal right (“an individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice”) give Canadians the power to prevent search engines from indexing anything about them, for any reason? Wouldn’t that, for instance, allow a campaigning politician to scrub the internet of embarrassing statements made in the past — a kind of privatized censorship?
And how appropriate is it to task search engines — created by private, for-profit firms — with the responsibility of deciding, case-by-case, whether information should be private or public? “In Europe, search engines aren’t even required to consult with the content providers whose work is being questioned, including news media outlets,” says David Fraser, a privacy lawyer and partner at McInnes Cooper. “That seems more than a little perverse to me.
“How is a search engine expected to decide what’s in the public interest? It’s a really hard determination to make. Will they do the due diligence?”
Morin points out that the European courts are forcing search engines to do the work. “Google fought it at every step, but these companies are doing thousands of these (RTBF) orders now.”
Canada and the EU have very different legal approaches to privacy. In Europe — where a lot of voters still remember what it was like to live in a surveillance state — freedom of expression and the right to privacy have equal weight in law. In Canada, freedom of expression is a core Charter right, while privacy is “read in” to Section 7 of the Charter. Any attempt to introduce RTBF as a right on a level with freedom of expression would be certain to wind up before the Supreme Court.
“You’d be taking a chance,” says Slonosky. “Once information is in the public domain it can no longer be considered ‘private’.”
It all boils down to this: RTBF’s legal status in Canada depends on which tools politicians ultimately choose to employ, if any. And the people who practice privacy law are counseling caution.
“Privacy can’t become a catch-all for all evils — an attempt to address society’s flaws that would be best addressed somewhere else,” says Morin.
Doug Beazley is a regular contributor to CBA PracticeLink.