Surprise! Canada has had a Right To Be Forgotten all along!

Oh Office of the Privacy Commissioner you scamp! Look what you’ve gone and done now.

Well, well, well. This is quite the fascinating development! Did you know we had a right to be forgotten in Canada? Me neither. And I teach that stuff at a leading Law Faculty! Boy was I wrong when I wrote this headline last year:

Forget the right to be forgotten in Canada (for now)

Well what do I know. With the proverbial stroke of its pen, the Office of the Privacy Commissioner has proven me wrong.

I better explain what’s going on here. On Friday, the OPC released a document entitled “Draft OPC Position on Online Reputation“, which sounds like a nice little stupid thing that no one would pay attention to except people like me who do this for a living. Online reputation is important, see, and again, I’ve gotta keep in the loop about this stuff. So I started to read it. AND HOLY HELL WHAT A BOMBSHELL! Errr, in as much as any internet law thingy can be a bombshell. Let’s dive in to the report so you can all understand my shock and awe.

OK first, you might have noticed the “draft” part of the title of the report. So this report is not final. Things are still going to happen. As the OPC writes:

After seeking stakeholder views on the proposals outlined in this draft position paper, the OPC will finalize its position and develop an action plan to put the new measures into practice

So still a ways to go. Back in the pre-Trump days of January 2016, the OPC called for submissions from stakeholders about online reputation and what could be done. I should have submitted something, but I was busy that year. You see, I have many clients and potential clients coming to me who feel their reputation online is in tatters, or in the process of being ruined. So I have some thoughts on the subject. Anyway, I did nothing, but the OPC received 28 submissions. The OPC then took “this feedback, in combination with our own analysis and experience, and used it to develop our position and recommendations with respect to privacy and online reputation.” This draft report is that position. And what is that position?

WE HAVE A RIGHT TO BE FORGOTTEN IN CANADA. DA F**K?????

Ok ok, I am again jumping ahead of myself here. First, the report has a sort of an introduction, discussing the need to balance freedom of expression and the privacy interests of someone whose reputation is suffering online. This is always an important point. You want your privacy, but maybe someone wants to write about the fact you paid a porn star named Stormy (who you may recognize from https://www.m-porn.xxx/) $130,000 to keep your affair quiet (e.g.). You want something forgotten, I want to know about it! Potayto, potahto. Anyway, the report has a nice little summary about the important jurisprudence in this area (freedom of expression vs. reputation), which law students should read and the rest of you can ignore. Point is, people have the right to their reputation. The report says that:

It is clear that Canadians need better tools to help them to protect their online reputation.

The OPC’s draft position highlights existing protections in Canada’s federal private sector privacy law, identifies potential legislative changes and proposes other solutions for consideration.

So what are those solutions? Let’s go through them one by one like the report does.

1. The Right to be Forgotten De-Indexing

What is de-indexing? Glad you asked! It is most certainly not the right to be forgotten according to the OPC! The report defines it as the following (it’s long but read it, it’s important):

De-indexing is the process by which a particular webpage, image, or other online resource is removed from the results returned by a search engine when an individual’s name is entered as the search term. It is important to note that de-indexing does not remove the content itself from the Internet, and does not prevent the content from being found through other search terms or by navigating the source website (for this reason, we use the term “de-index” rather than “take down” to refer to information being removed from search results). However, it does prevent the content from being linked prominently to an individual’s name in search results

Well that sounds like… the right to be forgotten? NO THE OPC WILL HAVE NONE OF YOUR LIP PROFESSOR MENDELSOHN. IT IS NOT THE RIGHT TO BE FORGOTTEN. In fact, they have handily buried the distinction in a footnote so you can find it easily:

In other jurisdictions – the European Union (EU), in particular – this has been referred to by some as the “Right to be Forgotten.” We have used the term “de-indexing” instead as it is more precise in this context. The “right to be forgotten” can encompass more than just de-indexing of search results. This said, we acknowledge that the proposals contained in this position paper, taken together, have some similarities to the EU General Data Protection Regulation (GDPR)’s “Right to Erasure (‘Right to be forgotten’).”

This will go down in internet law history as the “Infamous Footnote 9”. Mark my words! Let’s pick apart this Infamous Footnote 9:

this has been referred to by some as the “Right to be Forgotten”

Uh, no, not by some, by everyone. Go ahead and ask one. How about Michael Geist? He wrote yesterday Why the Canadian Privacy Commissioner’s Proposed Right to be Forgotten Creates More Problems Than it Solves. He doesn’t even spend ten paragraphs like I’m doing figuring this out! He just says it is. Back to IF9:

The “right to be forgotten” can encompass more than just de-indexing of search results

Now this is a tricky one. The original RTBF (I’m gonna start using that acronym before this typing kills me) comes from “The Google Spain Case” as us in the biz call it. It’s got a longer name but we’re lazy (well I am – see “RTBF”). I wrote about the case back in 2014. I quoted the Court which said that:

the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties…

So, de-indexing! RTBF! Back to IF9 for the confusion:

some similarities to the EU General Data Protection Regulation (GDPR)’s “Right to Erasure (‘Right to be forgotten’).”

Well that is true, I’ll give the OPC that. They’re similar! But back to the “broader” question – the GDPR, which comes into effect in May this year (I’ll write about it soon!) defines the RTBF aka the Right to Erasure as:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies…

And then lists a bunch of situations. So yes, the RTBF aka the Right to Erasure (I’m skipping over that particular terminology discussion now because there is already enough in your head) in the GDPR is broader than just having search engines “de-index” some listings. HOWEVER, the GDPR is not yet in effect, and the fact is everyone in my biz (including me, but smarter people than me) say that the RTBF is the right to have Google de-index the search results. THAT’S WHAT THE GOOGLE SPAIN CASE SAYS. So yeah, take your IF9 OPC and stick it somewhere.

ANYWAY.

The OPC says that Canadians need a RTBF / de-indexing right to help control their online reputations. I pretty much agree with them on that! I’ve written enough times on this blog about how I have people come to me who really need some de-indexing. My heart goes out to them, but I didn’t think I could do anything for them, because we don’t have a RTBF in Canada like they do in the EU.

Boy was I wrong! Let’s go back to the executive summary:

With respect to de-indexing, the OPC is of the view that PIPEDA applies to a search engine’s indexing of online content and display of search results. As such, search engines must meet their obligations under the Act.

???? Look, as mentioned, I teach Privacy Law. PIPEDA (the Personal Information Protection and Electronic Documents Act) is at the heart of what I teach. I know it pretty well! There ain’t no RTBF in there!

Well the OPC found one. Let me (try to) explain how.

Point 1 – search engines are covered by PIPEDA. The OPC doesn’t give a crap that PIPEDA applies to companies collecting information “in the course of commercial activities” and Google searches are free. Google makes money! Well they got that right. Also, PIPEDA applies to companies who “collect, use and disclose” Personal Information (“PI”) and Google (and other search engines, let’s not forget Bing!) collect, use and disclose PI. PI is as simple as a name (pretty personal!). The report pretty much glosses over the collect, use and disclose business. Just believe it, ok?

Point 2 – Google does…stuff with the PI. Seriously, there is a heading “What Do Search Engines Actually Do?” Stuff. This is all relevant.

Point 3 – search engines have certain obligations under PIPEDA. Because they are covered by it (see Point 1). What obligations? Glad you asked. It’s Privacy Class time! PIPEDA is most famous for its 10 Principles. The 10 Principles are the heart of PIPEDA, even though they are stolen from somewhere else (it’s true! Here’s the original PDF). They are found in PIPEDA Schedule 1, and they outline how private organizations must treat your PI when they “collect, use and disclose” it from you. The report cites the ones they think help to make up the RTBF / de-indexing right, which are 6, 9, and 10 (and some “sub-principles”). Here:

6: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

6.1: The extent to which personal information shall be accurate, complete, and up-to-date will depend upon the use of the information, taking into account the interests of the individual. Information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.

9: An individual shall be able to challenge the accuracy and completeness of [his or her personal information] and have it amended as appropriate.

9.5: When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending on the nature of the information challenged, amendment involves the correction, deletion, or addition of information.

10: An individual shall be able to address a challenge concerning compliance with the above principles to the [individual or individuals] accountable for the organization’s compliance.

Look – the word deletion is in there! I highlighted it for you! You still following?

Point 4, to summarize the above – you can challenge (10) the accuracy (9), and “up to dated-ness” (6.1) of the info Google holds about you. If it’s not up to date, the info should be amended (9); and the OPC says the “most obvious means to make such an amendment is to de-index the offending result and remove the link.”

Q.E.D. PIEPDA has a RTBF de-indexing right.

Mind. Blown.

But wait, there’s more! PIEPDA also says that an “organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate under the circumstances.” So the OPC spends some time discussing the “circumstances”, i.e. when de-indexing should occur. They give two examples:

1. Where that content is unlawful, or unlawfully published (e.g. where it contravenes a publication ban, is defamatory, or violates copyright; etc.)
2. Where the accessibility of the information may cause significant harm to the individual, and there is either no public interest associated with the display of the search result, or the harm, considering its magnitude and likelihood of occurrence, outweighs any public interest.

I am guessing for the most part we are all fine with 1. It’s 2 that may be questionable. Who decides when a piece of information may cause “significant harm” which “outweighs any public interest”? The OPC says the search engine themselves should have mechanisms in place. Sure, why not. They have the funds! (seriously the OPC pretty much says this). But seriously, I was not happy in Google Spain when the search engines were given this power, I am certainly not going to be particulalry happy about it here north of the 49th.

ANYWAY, the OPC has some factors to help search engines determine what’s in the public interest, and then go on with some other points about this newly discovered right to… something. They are contained in a section entitled “Critiques with respect to de-indexing”, one of which is that de-indexing should not operate worldwide lest we offend other jurisdictions (tell that to the Supreme Court!). So the OPC says “geo-fencing techniques should be applied so that de-indexing of search results is limited to searches originating from within Canada.” Sounds kinda reasonable I guess, if you can pull that off.

2. Everything Else

I said above I would go through the report’s solutions to the problem one by one. I lied. The rest of it is boring. For completeness’ sake, here are the other solutions discussed in the report:

Removal/amendment of information at the source
The special case of youth
Improving sites’ practices
Improving education
Promoting further research
Legislative solutions.

Here are some choice out-of-context quotes!

This ability to delete self-posted information should be near-absolute

an individual should be able to challenge the accuracy, completeness, and currency of the posted information and the source website or social media platform (if commercial) should have a mechanism in place to provide an adequate response

we recommend that Parliament also consider providing youth with some ability, upon reaching the age of majority, to request and obtain removal of online information posted about them by their parents or guardians

Organizations have a role to play

the need for continued education on privacy is obvious

The “Legislative Solutions” section has some good bits in it. The OPC says that even though they found a RTBF / de-indexing right in PIPEDA, Parliament should look into it anyway. Cop-outs. They take the opportunity to say the OPC needs better enforcement mechanisms under PIPEDA which everyone has said for years. Finally,

if it becomes clear that a particular collection, use or disclosure of personal information is highly offensive to Canadians, Parliament should consider formalizing restrictions or prohibitions of that activity (such as has been done for non-consensual distribution of intimate images). This option will also be beneficial for addressing the challenges posed by the person-to-person interactions that can be extremely harmful, but which are outside PIPEDA’s reach and not covered by existing criminal laws.

We’ll get rid of all of that bad stuff eventually!

SUPERTERRIFFIC FUNTIME ANALYSIS HOUR

Look, I am still having problems processing all this with my mind being blown and all. And it’s a draft report, so who knows what will happen in the long run. If you go back and read my take on the original RTBF in the Google Spain case, you’ll see I was skeptical! I was really pretty dismissive of the European Court’s decision. But since then, as I said above, I have dealt with enough shit (well, my clients’ shit) that I have come around to the idea that some sort of a RTBF / de-indexing right might not be a bad idea.

BUT YOU DON’T JUST WHIP ONE OUT OF YOUR ASS, OPC.

Ahem. Sorry. Let”s give the last word to Geist, in his post linked above:

Perhaps most troubling is that the report empowers search engines to play the role of judge and jury over the relevance and harm associated with links to content

As I was saying myself, though admittedly less eloquently but with more swearing (as usual).