Can the Right to be Forgotten Find Application in the Canadian Context?
Christopher Berzins
August 2016
Note: This submission was contributed by the author(s) to the Office of the Privacy Commissioner of Canada’s Consultation on Online Reputation.
Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.
In an article published late last year, I addressed this very question.Footnote 1 I suggested that in the wake of the European Court of Justice’s (ECJ) Google Spain decision,Footnote 2 Canadian privacy commissioners, as well as provincial ombudsmen, are likely be faced with formal complaints from individuals seeking to have personal information about them removed from the Internet on the basis of the right to be forgotten. In my view, such complaints are likely to be directed against search engines, such as Google, and against public bodies that have posted personal information on the Internet.
Whether such complaints will be successful is an open question but, in my view, Canadian privacy legislation does provide a number of avenues to advance such claims. That being said, without some statutory direction, the challenges in implementing a right to be forgotten are considerable. I will briefly consider each of these issues.
With respect to the application of Google Spain, the OPC Discussion Paper notes that it only affects search engines, allowing the original information to remain on the web site where it was posted.Footnote 3 This point needs qualification. The Google Spain decision resulted from a complaint by Mr. Costeja González to the Spanish Data Protection Agency against both Google and La Vanguardia, the newspaper that had published information that was appearing in Google searches of Mr. Costeja González’s name.Footnote 4 Although his complaint against La Vanguardia was unsuccessful, he prevailed against Google which then appealed, with the case ending up before the ECJ. However, unlike La Vanguardia, some "publishers", such as public bodies, will not be able to defend a complaint based on journalistic considerations. Therefore, one should not unduly circumscribe the potential impact of Google Spain; the logic may extend to public bodies posting information on the Internet for a variety of transparency and regulatory related purposes.
It is becoming increasingly evident that serious reputational harm can occur when sensitive personal information appears in name based search engine results. Individuals may then try to mitigate such harm by attempting to have such information removed. As was the case with Mr. Costeja González, they are likely to approach search engines such as Google as well as the body that initially posted the information on the Internet. If rebuffed, such requests to remove information may result in formal complaints. In Canada, those complaints will most likely be made to Canadian privacy commissioners and, in the case of public bodies, possibly to provincial ombudsmen as well.
Given that Mr. Costeja González’s complaint against Google was successful, individuals might choose to proceed initially against Google, or other search engines. As I’ve argued previously, sophisticated search engines were in their “relative infancy”Footnote 5 when Canadian private sector privacy legislation was introduced so it remains to be seen how that legislation will apply to their activities. The Discussion Paper notes that “[i]n Canada, no right to be forgotten or erasure laws exist per se.”Footnote 6 However, there is a reasonable argument that in providing responses to name based search inquiries, search engines such as Google are involved in the collection, use, and disclosure of personal information which is clearly done without the consent of the individuals in question. And as I’ve argued previously, it is questionable whether any of the exclusions or permissible disclosure provisions in Canadian privacy legislation would apply to a search engine’s activities. For example, it would seem to be a stretch to fit this activity within the exclusion for artistic, journalistic, or literary purposes. It is equally questionable whether this activity would fit within the PIPEDA provisions that allow an organization to collect publicly available personal information without consent, given that the provision of name based search results arguably would not "relate directly" to the purposes for which the information was made publicly available. Both of these conclusions would appear to be supported by the OPC’s findings in the Globe24h.com investigation, which is considered in the Discussion Paper. In short, if search engines are engaged in the collection, use, and disclosure of personal information without the consent of the affected individuals and none of the permissible exceptions in Canadian private sector privacy legislation apply to this activity, this would appear to provide a reasonable basis for a complaint requesting removal from search engine results.
However, individuals adversely affected by information appearing in name based search engine results may also seek to have the information removed at source. Where the initial publisher is a public body that is subject to public sector privacy legislation, this may lead to complaints to the relevant privacy commissioner about the public body’s authority to make personal information available on the Internet. As I’ve argued previously in a number of articles, in many instances there will not be explicit statutory authority supporting disclosure.Footnote 7 Therefore, many public bodies may have to rely on a “consistent purpose” analysis to justify disclosure.
Public bodies may also be faced with complaints that the original purpose for making the information public no longer applies and that the information ought to be removed. These types of claims are likely to be advanced in the context of administrative tribunals’ adjudicative decisions, the licensing, disciplinary, and enforcement decisions of regulatory bodies, and public information disclosures by law enforcement bodies. Such complaints may have greatest resonance in privacy statutes containing a “reasonableness” test.
It is also possible that removal complaints could be directed towards provincial ombudsmen. Given the extremely broad jurisdictional language contained in most ombudsman statutes, there is arguably room for an ombudsman to conclude that disclosure practices of a public body were unreasonable or unjustifiable, especially if unsupported by clear statutory authority.
That being said, implementing a right to be forgotten in the context of public bodies will prove to be exceptionally challenging without some statutory direction.Footnote 8 For example, how does one decide the point at which an individual’s request to have information removed should prevail over the public interest in disclosure? How do you incorporate competing public interest considerations into the decision making process without bringing more attention to the removal request? Who should get to speak on behalf of the public interest in disclosure? And what factors ought to be considered when balancing the competing claims? It is possible to establish a framework to address these questions but, nonetheless, the issues will be difficult and likely contentious, if the debate around the Google Spain decision is any guide.
Christopher Berzins, Senior Legal Counsel, Ontario Securities CommissionFootnote 9
- Date modified: