Right to be forgotten under debate

A recent position paper by the federal privacy commissioner is causing consternation among lawyers.

In January, the Office of the Privacy Commissioner of Canada indicated in its draft position paper on online reputation that de-indexing and source takedown are mechanisms that could be used to enhance a person’s control over their online reputation, through the Personal Information Protection and Electronic Documents Act.

The position paper states that the existing privacy law identifies potential solutions, including the right to ask search engines to de-index web pages that include “inaccurate, incomplete or outdated information.”

David Elder of Stikeman Elliott LLP says that could create a great deal of work for search engines and put a lot of power in their hands.

It also raises issues related to freedom of expression.

De-indexing is when an online resource is removed from search engine results. Source takedown is the removal of the content from the internet.

Elder, Stikeman’s chief privacy officer and chairman of its communications group in Ottawa, likens de-indexing to removing the card from the card catalogue at the library when the book itself is still available. It might make the source websites more difficult to locate and access, but it doesn’t change the fact that they exist.

“I think there are a lot of concerns there, both about history, but also for journalists, in particular, the freedom of expression,” he says.

Elder believes the 18-year-old PIPEDA was not intended to be used by people who want certain references of themselves to disappear from online searches. He says if the law is applied to de-indexing search engines, it would be “severely offside.”

In the draft position paper, the commissioner indicated its aim is to balance freedom of expression and the privacy interests of individuals. It followed a consultation process that attracted 28 submissions.

The commissioner’s initiative falls on the heels of the “right to be forgotten” approach under European law. That right, adopted as the right to erasure, was embedded in the European Parliament’s General Data Protection Regulation. It prompted discussion in North America, but there are concerns that it impedes the value Canada places on the freedom of expression.

Elder says that, during the privacy commissioner’s consultation process, there were several submissions suggesting that the right to be forgotten would be disastrous.

“In the proceedings, talking about managing online reputation, there were submissions that touched on the right to be forgotten, most of them saying this doesn’t exist and if you ever tried to go here this would be disastrous. . . . But they seemed to have gone this way anyway,” he says.

The commissioner is now accepting feedback until April 19.

Elder suspects that if the privacy commissioner’s position in his draft position paper is adopted, it will attract litigation.

But such an important issue with its possible implications, he believes, should be addressed and decided upon by Parliament and not be determined by policy.

University of Ottawa law professor Michael Geist, who focuses on technology and privacy issues, also questions whether the issue of the right to be forgotten falls under the commissioner’s powers.

He says extending PIPEDA to all search engine activity is an issue when many searches are conducted for non-commercial purposes, because the law was intended to accommodate online commerce and applies solely to commercial activities. However, Geist recognizes the need to explore issues of privacy and online reputation.

“There’s unquestionably a real issue here, to the extent that the privacy commissioner is raising awareness [about online reputation], trying to put the issues squarely on the table. I think that’s a positive thing,” he says.

“I frankly think the privacy commissioner could have used this as an opportunity to highlight how the current set of privacy rules are inadequate to deal with some of the emerging challenges.”

From a practical perspective, he says, de-indexing a person’s name may not adequately provide the desired protection because searches can be conducted in a different way. Instead of searching for the person’s name, for instance, they might focus on the issue, such as bad landlords, to achieve the same result.

“Instead, what we got was the commissioner trying to shoehorn a really challenging problem into existing law and I think in many ways it causes more problems than it solves,” says Geist.

Another concern is that the privacy commissioner’s interpretation of the principal-based PIPEDA is too narrow to apply to internet searches.

“For the most part, it works quite well and it’s quite adaptable,” says Shaun Brown of nNovation LLP in Ottawa.

“I think certain issues around what search engines do with personal information is a clear example of where our privacy legislation probably doesn’t adapt very well. It’s such a unique situation.”

The additional problem is that a general rule under PIPEDA is the requirement of consent prior to collecting, using and disclosing personal information. So, if PIPEDA applies to search engine activity, consent should also apply, says Brown.

There is concern that the European model places search engines in the role of adjudicators deciding what content should and shouldn’t be made available and whether or not that information should be indexed.

“I think there are some really valid concerns about making search engines the arbiters of those questions,” says Brown.

“I’m not even convinced if we should have a right to have personal information removed from the internet once it’s published. . . . the right to be forgotten can potentially cause so many more problems.”

He asks if the focus should rather be on other laws, such as defamation, to prevent the publication of false and misleading information about people.

He also raises the possibility that allowing the de-indexing approach under the federal privacy legislation could attract the Charter challenge that many have been anticipating since PIPEDA was introduced.

“It’s far from clear that PIPEDA would survive a challenge to rely on the federal authorities of trade and commerce power,” says Brown.

And if that happens, the jurisdiction of PIPEDA could be altered, given that some provinces have their own privacy legislation.

“That’s a question that’s always rumbling under the surface whenever we see PIPEDA being applied in a unique or more aggressive manner. That’s really what we’re seeing here,” says Brown.

If that were to happen, he says, Canada’s anti-spam legislation could also be vulnerable because it relies on the same authority.

“If either one of those laws were to be challenged on constitutionality, that would almost certainly have implications on the other,” says Brown.

“There’s some big issues at stake here.”