Submission to the Office of the Privacy Commissioner of Canada in Response to the Notice of Consultation and Call for Essays — Online Reputation

Joe Bricker (University of Toronto), Hana Dhanji (University of Toronto), Manasvin Goswami (University of Toronto), and Dave Marshall (University of Toronto)

August 2016

Note: This submission was contributed by the author(s) to the Office of the Privacy Commissioner of Canada’s Consultation on Online Reputation.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Summary

This paper responds primarily to the third question posed by the Office of the Privacy Commissioner of Canada (“OPC”) in its January 2016 Notice of Consultation and Call for Essays on the subject of Online Reputation, that is, “[c]an the right to be forgotten find application in the Canadian context and, if so, how?” We write in our capacity as individual Canadians, and our submissions are aimed at regulators and government.

The “right to be forgotten” (“RTBF”) represents an attempt to deal with some of the most significant challenges to individuals’ privacy in the twenty-first century. Unfortunately, in its current form, the RTBF appears to be excessive and ill-conceived. Canadians’ rights to privacy and a safeguarded reputation are important. However, the RTBF unduly risks other fundamental interests such as the freedom of expression. Accordingly, we do not believe that the RTBF should be adopted in the Canadian context.

Our comments proceed in three sections. First, we examine the European context for the law and whether Canadian law at present affords an RTBF on similar grounds. Second, we look at why the RTBF is unsuitable in the Canadian context, focusing on a few main reasons: its drastic effect on the Charter right to freedom of expression, its limited effectiveness, and cultural barriers to its adoption. Finally, we canvass some potential alternatives that more adequately balance the competing interests at play.

Full submission:

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided

We are four students at the University of Toronto’s Faculty of Law. We write in our capacity as individual Canadians. Our remarks primarily address the third issue in the Office of the Privacy Commissioner of Canada’s (“OPC”) Notice of Consultation and Call for Essays on the subject of Online Reputation, that is, “[c]an the right to be forgotten find application in the Canadian context and, if so, how?” In offering our perspective, we hope to help regulators and government address the issues raised in the right to be forgotten” (“RTBF”) debate.

In October 2015, we represented different sides of the RTBF debate as part of the Faculty’s annual “Grand Moot,” an annual public event in which four students argue an issue of contemporary legal significance before a panel consisting of judges from the Supreme Court of Canada, the Court of Appeal for Ontario, and the Ontario Superior Court of Justice. In the course of preparing for the Grand Moot, we spent considerable time canvassing all sides of this issue. Our written legal submissions, as well as a video of the event, are available online.^{Footnote 1} We are grateful to the OPC for the opportunity to share our views. We also wish to acknowledge the support of the Faculty and legal practitioners whose assistance in preparing for the moot was invaluable (though our views remain ours alone).

In our view, the RTBF, as currently conceived in Europe, does not exist under current Canadian law. Accordingly, it would have to be created by statute. However, we do not believe that creating a statutory RTBF is either constitutional or desirable as a matter of policy. That said, we do recognize that the right responds to valid and serious privacy concerns that will not soon abate. We thus believe it would be wiser for the OPC and legislators to pursue other, more targeted alternatives, which are less troubling in their impact on Canadians' constitutionally protected freedom of expression.

Our comments proceed in three sections. First, we examine the European context for the law and whether Canadian law at present affords an RTBF on similar grounds. Second, we look at why the RTBF is unsuitable in the Canadian context, focusing on a few main reasons: its drastic effect on the Charter right to freedom of expression, its limited effectiveness, and cultural barriers to its adoption. Finally, we canvass some potential alternatives that more adequately balance the competing interests at play.

Section 1

On its face, current Canadian law might appear to offer rights similar to the European RTBF. However, we do not believe that a right as substantive or sweeping as the European RTBF exists in current Canadian law.

The European RTBF stems from the European Court of Justice’s (“ECJ”) decision in Google Spain v AEPD and Mario Consteja González.^{Footnote 2} While we are not experts in European data protection jurisprudence, we note that the ECJ’s decision in González appears to have re-purposed Europe’s Data Protection Directive—drafted in 1995, before the advent of modern search engines—to a controversial use the initial drafters likely never contemplated.^{Footnote 3}

In González, the ECJ was offering its interpretation of the Directive. The decision found that Google is a “data controller,” engaged in “processing” personal data, because its search engine algorithm crawls the web to index pages that may refer to identifiable people and then runs searches against that index. Google is therefore obliged, like all “data controllers,” to ensure the data is adequate, relevant, and not excessive.^{Footnote 4}

The Court’s decision is surprising when one considers the common-sense definitions of “data collection” and “personal data.” There is a difference between collecting publicly available, legally publishable information on the internet—what search engines do—and accidentally disclosing private information, or collecting information without consent—the kinds of problems at which the Directive appears to be more obviously targeted. To hold that Google collects “personal data” is akin to saying that a library creating a catalogue is by definition collecting “personal data” because books may discuss identifiable people. Not all data pertaining to a person should be legally protected as “personal data.” In failing to differentiate between public and private information, the Directive simply never contemplated the privacy challenges of the internet age, and neither did the ECJ attempt to wrestle substantively with these analogies.

If the Privacy Commission is minded to pursue a right to be forgotten through existing legislation, we note that the Personal Information Protection and Electronic Data Act (“PIPEDA”) appears to allow a similar approach to that taken in González.^{Footnote 5} Some efforts in this direction were made in the case of Globe24h., which was indexing Canadian court decisions potentially containing personal information and thus making them searchable through Google.^{Footnote 6} Nonetheless, we believe there are significant barriers to using PIPEDA to implement a full-fledged RTBF, and that any systematic attempt to do so should await the results of the present consultation. PIPEDA provides that information cannot be used, disclosed, or collected without knowledge or consent, with narrow exceptions. It also specifies that “[p]ersonal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.”^{Footnote 7} It can be retained only “as long as necessary for the fulfillment of those purposes.”^{Footnote 8} The problems with applying PIPEDA to create a European-style RTBF are two-fold. First, PIPEDA is likely not procedurally adequate for the task of administering the hundreds of thousands of complaints that will inevitably be submitted, as the OPC must conduct an investigation and issue a report before a complainant can pursue remedies in court. Second, unlike the European Directive, PIPEDA does not specifically allow the OPC or data subject to require that a search result be de-listed. Accordingly, we believe that if an RTBF is to be implemented in an effective way, it will need to be implemented through legislation.

Section 2

In our view, the RTBF would be an unwelcome development in the Canadian context. We believe it is unsound from a constitutional perspective. We also believe it is also unsound policy. Given the limitations noted briefly above associated with implementing the RTBF via PIPEDA, a Canadian RTBF would most likely have to be created through legislation. Yet in our opinion, this is undesirable for several reasons. The first is that search engines produce constitutionally protected expression. There is much academic debate over how to conceive of the exact expressive interest at stake, but regardless of the precise conception one adopts, it is clear that the RTBF has a drastic impact on free expression. Under the Charter, moreover, the Supreme Court has granted wide latitude to what counts as protected expression, holding that anything which “conveys or attempts to convey a meaning” falls within the scope of the guarantee.^{Footnote 9}

There are three broad sets of free expression interests at stake in this debate. One set of interests is those of the search engines in themselves as speakers, exercising free speech. A number of scholars have taken the view that search engines themselves are “speakers.”^{Footnote 10}American courts have also endorsed this view in a number of cases.^{Footnote 11} Making this argument inevitably involves drawing analogies to other, more familiar forms of constitutionally protected speech. One of the most plausible is that search engines offer an opinion about the highest-quality, most relevant results to a user. On this view, search engine results constitute value judgements about the relative quality of web content, as websites with high-quality media and high traffic generally perform better in search engine rankings.^{Footnote 12}They can also be seen as a form of advice provided to search engine users, similar in principle to any advice a human might have provided if directly consulted about a search query One might also see search engines as exercising editorial discretion about what to include and what to exclude from a list of search results, in rather the same way as the editor of a newspaper.^{Footnote 13} The Supreme Court has acknowledged that subject to reasonable limits under s.1, the Charter protects the write to speak or not to speak, whether in refusing to write a letter of recommendation^{Footnote 14} or refusing to display health warnings on a tobacco package.^{Footnote 15} All of these analogies are underscored when one considers that different search engines produce different results for the same search terms, often unique to individual users.

It may seem counter-intuitive to view large commercial search engines, whose primary business is selling advertisements, as exercising freedom of speech. Yet this objection fails for several reasons. The Supreme Court has acknowledged that commercial speech is entitled to protection.^{Footnote 16} Further, these search engines embody the judgments and preferences of hundreds of engineers with respect to the relevance of content. The point may also appear more intuitive when one considers the desire of certain countries to censor search engine results. In the American case of Zhang v Baidu, a New York court ruled that the Baidu search engine’s implementation of Chinese censorship laws was—ironically—protected under the First Amendment.^{Footnote 17} In essence, search engines like Baidu reflect the government’s opinion about what is relevant to users, rather than allowing the search engine designers to decide themselves. The second set of free expression interests at stake is those of internet content creators.

Even scholars who do not believe that search engines are themselves exercising free expression agree that they are a vital conduit to the free expression of others.^{Footnote 18} Search engines provide a catalogue of the internet’s contents in the same way that a library catalogue does for a library. Yet they are arguably more important than that analogy suggests, because they are the means by which most web content is accessed. In 2011, a Pew Internet study found that 92% of online adults use search engines to find information online.^{Footnote 19} As Justice Abella remarked in Crookes v Newton, without hyperlinks “the web would be like a library without a catalogue: full of information, but with no sure means of finding it.”^{Footnote 20} Any law which targets hyperlinks, then, will have a drastic impact on free expression. The expression to which search engines link is very often vital to what the Supreme Court held to be the three main rationales for free expression: the search for truth, self-fulfillment, and democratic self-government.^{Footnote 21}

The third group of actors potentially exercising free expression consists of Internet users. While users’ interests are often confined to privacy and the protection of reputation in the context of the RTBF debate, internet users may also have a valid claim to free expression in what they see online. The Supreme Court of Canada has recognized that s. 2(b) of the Charter protects listeners as well as speakers.^{Footnote 22} In short, the ability to have free access to information is vital to the free speech of other speakers beyond the original content creators.

Most free expression cases in Canada to date have been decided at the s. 1 stage of analysis: that is, after acknowledging that free expression rights have been infringed, courts have gone on to consider whether the infringement is a reasonable limitation in a free and democratic society. Without conducting a full s. 1 analysis in the way a court might, we believe that the RTBF is not a reasonable limitation, for a few broad reasons.

We believe that in a free society, people should generally be free to publish and link to factually true information. The RTBF allows information that is factually true to be suppressed in accordance with a host of vague and subjective criteria. Perhaps the most important criterion for whether links are taken down will ultimately be whether somebody chooses to object or take offence. We do not deny the problems associated with the permanence and indelibility of information on the internet. Yet potentially having unflattering or irrelevant search results associated with one’s name is, to a large degree, the price of living in a society which values free expression. In our view, relevance or irrelevance, adequacy or inadequacy, excessiveness or otherwise, properly belong in the eyes of 3 billion beholders—the rough number of people who use the internet.^{Footnote 23}

In addition, current EU attempts to impose a global RTBF are troubling in that different countries will necessarily have different conceptions about what relevant search results are relevant. When one considers the number of countries in which free expression is not robustly protected, the problem becomes even thornier.^{Footnote 24} If Canada were to insist on a global RTBF, applying across all national versions of a search engine—which we acknowledge is the only way of effectively preventing discovery of results de-listed under the RTBF—it would be difficult in principle for Canada to insist that other countries with more limited conceptions of civil liberties should not be entitled to global application of their internet laws.

Even if everyone could agree on them, criteria for removal would be challenging to apply in a fair and consistent way. The information available on the internet is vital to the three free expression rationales above. Under the law of defamation, aimed at protecting citizens from false claims, courts are well-equipped to judge factual truth. In contrast, it is impossible for any authority to know a priori how or why a piece of information might be relevant, or to whom. It is also impossible for any authority to know a priori how the removal of one result will reverberate across the internet. The result could be an internet torn apart with holes and gaps, with no individual user being able to account for what shows up in search results and why.

One possibility for enforcement is delegating this duty to search engines, as occurs in Europe. However, there are serious concerns about allowing private corporations to make these determinations. While Google’s efforts in this respect are impressive, Google’s process is largely opaque and lacks procedural fairness. Putting this responsibility in the hands of an adjudicative body instead of search engines would perhaps enhance procedural fairness, but would be extremely costly. Search engines would also have little incentive to contest cases in such a system, dulling the adversarial process and further endangering free expression interests.

The European experience shows that the RTBF is often used to suppress things that the public arguably should be able to know. The BBC and the Telegraph both maintain running lists of articles that have been affected by the European RTBF, illustrating their objection in principle to what they regard as overreach.^{Footnote 25} Stories taken down are sometimes innocuous, such as a 2009 slideshow of photographs of people with red hair.^{Footnote 26} Yet sometimes there is a strong case that they are in the public interest. Search engines were also forced to remove links to a Telegraph story about a director jailed for 8 years in 2006 for stealing £34 million.^{Footnote 27} A future business partner may wish to know that information. A Telegraph article on the “war plan” of Norwegian terrorist Anders Behring Breivik was similarly taken down, despite understandable public interest in the motivations for his heinous attack.^{Footnote 28} In no case can readers determine who submitted the complaint or why the result was ultimately taken down. The objectionable content could well be outside of the main thrust of the article.

Apart from constitutional considerations, we believe that the RTBF responds to several features of European culture that are not present in Canada to the same degree. In general, Canadians have different conceptions of privacy from Europeans.^{Footnote 29} As James Q. Whitman has noted, Europeans tend to view the right to privacy as upholding one’s right to an image, name and reputation. In contrast, the Anglo-American view of privacy—to which Canadian common law much more closely adheres—tends to view privacy as rooted in liberty, hewing to Samuel Warren’s and Louis Brandeis’ declaration that privacy is the “right to be let alone.”^{Footnote 30} In addition, Canada generally has a longer-running tradition of legally protected free speech than most EU member states. These reasons likely help suggest why to date, there seems to have been little popular clamour in Canada for the adoption of an RTBF.

Section 3

While our submissions are aimed primarily at the applicability of the RTBF, our opposition to a freestanding RTBF does not entail a rejection of the pressing concerns that animate the proposal. The proliferation of personal information on the Internet has the potential to drastically undermine individual interests in privacy and reputation. There may be cases where these consequences substantially outweigh any broader social interest in free expression. While the European RTBF is a poorly crafted response to these problems, governments can and should explore more narrowly tailored legislative routes to provide vulnerable individuals with sorely needed redress. This approach (referred to hereafter as the “specific legislation” method) better reconciles the competing values at stake in the RTBF discussion.

The “specific legislation” method seeks to bolster privacy protection without unduly compromising freedom of expression. It does so through a series of targeted bills/statutes. Crucially, most of these are aimed at removing harmful information per se, rather than hyperlinks to harmful information. “Revenge porn” legislation in the United States, United Kingdom and Canada is a helpful example, as are laws in almost every liberal democracy that compel the removal of defamatory online material.^{Footnote 31} Unlike a freestanding RTBF, these laws identify a specific type of problematic online activity and provide affected individuals with recourse through the courts. Other examples can easily be envisaged. Legislation can be drafted allowing friends or relatives of murder victims to apply for the removal of online media depicting or detailing the death of their loved ones. Similarly, it could be made illegal to engage in housing or employment discrimination on the basis of certain kinds of information discoverable online (for instance, spent convictions or unproved accusations). Even California’s “minor eraser” legislation—in essence, a RTBF for online activity as a minor—represents a more narrowly tailored approach to privacy protection than the European RTBF.^{Footnote 32}

We believe that the examples discussed above could be effective and useful so long as they adequately and explicitly protect free expression interests. Admittedly, some specific laws may not be more respectful of freedom of expression than the European RTBF, as the criticism of Nova Scotia’s Cyber Safety Act suggests.^{Footnote 33} Further, relying on a patchwork of individual bills and statutes to protect privacy interests creates a risk of some sympathetic individual cases slipping through the cracks. It also makes privacy protection contingent on political will and action, both of which can be slow and unpredictable. Nonetheless, in making the trade-off between privacy and reputation on the one hand, and free expression on the other, the specific legislation approach remains preferable for three reasons.

First, while some laws like the Nova Scotia Cyber Safety Act may suffer from problems of overbreadth, this is not a concern with the specific legislation approach per se, but rather with the poor drafting of some statutes. Second, while there is undoubtedly a risk that some sympathetic individual cases will not be captured by the specific legislation approach, the definition of “sympathetic” should itself be subject to democratic contestation, not the preferences of individual judges/decision makers. While the specific legislation approach also contemplates a role for the courts, it provides a much narrower scope for judicial discretion by clearly specifying—through a series of targeted bills or statutes—the types of situations in which a remedy will be appropriate. Admittedly, the ability of individuals to gain redress under this approach is somewhat tied to their membership in a “class” of affected persons (e.g. relatives of murder victims). However, the potential inability to account for some unique individual cases is significantly less problematic than the concerns about institutional legitimacy, competence and consistency inherent to the European RTBF. Finally, while the political system might be slower in responding to privacy concerns than an individual decision maker under the European RTBF, this is a price worth paying to ensure that robust protection of individual rights impairs freedom of expression as minimally as possible.

Conclusion

To conclude, we believe that the RTBF does not exist under current Canadian law, and that it should not be pursued further. Nonetheless, we believe that there may be room for more tailored alternatives to respond to specific issues. Once again, we are grateful for the opportunity to comment on this issue and would be happy to elaborate further on any of the points discussed here.