"Can the right to be forgotten find application in the Canadian context and, if so, how?" That was one of the questions posed in 2016 by the Office of the Privacy Commissioner of Canada in its Notice of consultation on online reputation. Some twenty-eight stakeholders (individuals, organizations, universities, defence groups, etc.) participated in the consultation and seventeen briefs expressed a position on the "right to be forgotten" in Canada. The end result: 10 against, 4 neutral, 3 in favour (including one concerning the specific case of children). One can already sense Canadians' reticence regarding the "right to be forgotten".
This debate is neither theoretical nor hypothetical. Everyday courts across Canada are faced with the "right to be forgotten" in a variety of different forms. The time has come to settle what is meant by the "right to be forgotten". This concept emerged from a May 2014 decision in which the Court of Justice of the European Union ruled that search engines had to allow Europeans to ask that search results that redirected to information concerning the person that was "inadequate, irrelevant or no longer relevant" be removed. The case originated with a Spanish citizen, who challenged the indexing of his name on Google referencing newspaper articles that mentioned a debt that he had long since paid; he felt that these details were no longer relevant, and harmed his reputation. That being said, one should not confuse the right to delist (or "right to be forgotten") relating to organizations that relay and index personal information with the right to removal (or right to correction) relating to organizations that collect and process personal information.
This article aims to situate the debate on the right to be forgotten in light of three major precedents, which apparently evolved in isolation (in different provinces, distinct jurisdictions) and yet have everything in common. Indeed, the right to be forgotten is perhaps not as bare as we have been told; we might even go so far as to say that, for the moment, it has a three-piece suit tailor-made in Canada.
The pants in British Columbia: Equustek Solutions v. Google, 2015 BCCA 265
On June 11, 2015, the Court of Appeal for British Columbia, in the matter of Equustek Solutions Inc. v. Google Inc. 2015 BCCA 265, confirmed the right of an injured party to a worldwide injunction ordering a search engine, in this case Google, to remove websites promoting the sale of counterfeit products from its search results. Even though the "right to be forgotten" was not formally mentioned, it is directly echoed in this case because the ruling determines the geographic scope of delisting (an issue that has long been divisive, and remains so (available in French only) in Europe). Please consult our bulletin discussing this important decision.
Equustek Solutions Inc. (the "Plaintiff") originally instituted an action for passing off against Morgan Jack et al. (the "Defendants"), who were selling counterfeit versions of the Plaintiff's network interface products. The Defendants sold said products on various websites and then relied on the indexation of different search engines, including Google, to direct potential customers to their websites. The Plaintiff demanded that Google, as the "dominant player in the search engine market", delist the Defendants' websites. Google only agreed to delete 345 URL addresses from the search results, which the Plaintiff considered insufficient because i) the Defendants moved the content of the delisted pages on Google to other pages that remained indexed ("Whac-A-Mole" springs to mind as an illustration, in this case it was preferable to block all the sites in question), and ii) the URL addresses removed only covered google.ca and not the other search engine extensions (including google.com). The Plaintiff then applied to the Supreme Court of British Columbia for an interim injunction preventing Google from including the Defendants' websites in its worldwide search results. In its June 13, 2014 decision, Equustek Solutions Inc. v, Jack 2014 BCSC 1063 (PDF), the B.C. Supreme Court granted the Plaintiff's injunction and ordered:
" […] Within 14 days of the date of this judgment, Google Inc. is to cease indexing or referencing in search results on its Internet search engines the websites listed in Schedule A, including all of the subpages and subdirectories of the listed websites, until the conclusion of the trial of this action or further order of this court."
Google appealed this decision to the B.C. Court of Appeal. The issue was whether the British Columbia courts had jurisdiction to render a decision against a non-party, non-resident corporation, and whether the courts could impose restrictions on the corporation's activities outside of Canada. The Court of Appeal ultimately dismissed Google's appeal, ruling that the Supreme Court of British Columbia had in personam jurisdiction over Google for the following reasons:
- Under the Court Jurisdiction and Proceedings Transfer Act, territorial competence over the application at issue was enough to establish that British Columbia courts had jurisdiction to issue the injunction against Google;
- Google's indexing services provided a link between the counterfeit products and potential customers, and was therefore substantially connected to the substance of the lawsuit; and
- Although Google has no servers or offices or employees in British Columbia, it carries on business in British Columbia (by collecting data in British Columbia, distributing targeted advertising to Google users in British Columbia and selling advertising space to British Columbia businesses, etc.).
In the end, this matter is primarily concerned with the territorial scope of delisting, in a context where counterfeit products were being sold, rather than the existence and implications of such a "right to delist" (or "right to be forgotten"). The Court of Appeal emphasized that the delisting had to be effective on all the search engine extensions, including .com, and observed that a partial delisting would be tantamount to an ineffective delisting. There remains, however, an aftertaste of "too little" being done with respect to the legal, ethical and political foundations of such a right to delist in Canada, as well as its potential repercussions in other areas of law, beyond those singular cases of passing off. Given that Google has applied for leave to appeal to the Supreme Court of Canada, and was given leave in February 2016, we will have to wait for our highest court to decide before knowing the real impact of this case on the "right to be forgotten".
The jacket in Quebec: C.L. c. BCF Avocats d'affaires, 2016 QCCAI 114
(available in French only), ruled for the first time on the right to be forgotten; we refer here to the bulletin we published on that decision.
In that matter, a legal assistant (the "Applicant") quit her job at a law firm (the "firm") and asked that her profile on the website be removed in its entirety (name, photograph and position). The firm then took all the necessary steps to remove the Applicant's information according to the uncontradicted evidence (physical server, social media, memory cache). Despite this, one result concerning the Applicant with a reference to the "People" page on the firm's website continued to appear on different search engines. The Applicant believed this was detrimental to her job search because she felt that [translation] "potential employers would obviously conduct a web search and would find a connection to a firm that she believed would provide poor references". The Applicant then applied to the Commission d'accès à l'information for a correction so that her name would no longer be connected to the firm's website.
The heart of the issue can be summarized thus: can the Applicant exercise her right to correction under the Act respecting the protection of personal information in the private sector, even though the firm had taken all the necessary steps to remove the disputed information? Based on several arguments, the Commission replied in the negative. In substance, the firm clearly has to take all reasonable steps to correct/remove the Applicant's information (internally, on its Intranet website), which it did, but that did not amount to a duty to delist (externally, on the rest of the Web). Further, the Commission held that [translation] "an individual's right to have inaccurate, incomplete or ambiguous information in a file concerning him or her corrected is not in the nature of the "right to be forgotten", which seeks to remove information from the public space". The Commission then added that it was not even [translation] "certain that this right, which is recognized in Europe, is applicable in Quebec".
The Commission's decision appears i) to ensure that the right to correction provided in the Civil Code of Québec and the Private Sector Act in no way implies a right to delist, and ii) to demonstrate a certain skepticism regarding the usefulness of importing, or even transposing, this European right to be forgotten into the Quebec and Canadian jurisdictions.
The vest at the federal level: A.T. v. Globe24h.com, 2017 FC 114
On January 30, 2017, the Federal Court in A.T. v. Globe24h.com 2017 FC 114 (PDF) rendered an important decision on the principles of open court, international comity and territoriality in personal information matters in a digital age. As we will see, this matter touches on several aspects of the right to be forgotten, because it involves the online indexing of court decisions.
Several individuals complained that the Globe24h.com website, hosted and operated in Romania, republished Canadian court decisions containing their personal information, thereby allowing the personal information to be indexed by search engines. What is truly shocking is that Globe24h.com was willing, for a fee, to delist and remove the personal information. On June 5, 2015, the Office of the Privacy Commissioner of Canada issued its PIPEDA Report of Findings #2015-002 concluding that "a website that generates revenues by republishing Canadian court decisions and allowing them to be indexed by search engines contravened PIPEDA".
A Canadian citizen (the "Applicant") decided to go further against Globe24h.com and its owner-operator Sebastian Radulescu (collectively the "Respondent"), and applied to the Federal Court under section 14 of the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Note that the Applicant did not challenge the publication of decisions concerning him on legal information sites, such as CanLII or Soquij, but rather, the ease with which access to these decisions are available (immediately visible on search engines) and the related costs to remove them. In other words, the issue was the open court (too broad according to the Applicant), and the costs for delisting everything, and not the publication of the decisions as such.
The Federal Court reasoning focussed on three aspects. First, with regard to the facts of the case and the existing jurisprudence, the judge held that PIPEDA should be applied extraterritorially to the Romanian Respondent based on the "real and substantial connection" test. Second, according to the Federal Court, the collection, use and disclosure of personal information by the Respondent was not "appropriate" under the PIPEDA and not exclusively "journalistic" in nature (the decisions are in fact available for free online and the Respondent did not add any value, especially by way of analysis). Third, the Federal Court stated that the "publicly available" exception (section 7 PIPEDA) did not apply to the case at bar because it is to be read in conjunction with paragraph 1(d) of the Regulations Specifying Publicly Available Information (setting out the condition that information republished must "relate directly" to the purpose for which it appears in the decision). Not to mention that the Respondent's activities undermined the administration of justice (loss of confidence in the judicial system if personal information is so easily accessible, but can be "removed" for a fee). The mercantile aspect of the use sought was not lost on the Federal Court, which ultimately declared that the Respondent had contravened PIPEDA.
The "right to be forgotten" can be perceived in three ways in this decision. First, in paragraph 76, the Federal Court appears to establish a "lesser right to delist" court decisions: indeed, they should not be indexed by search engines due to the sensitive information contained therein. Then, in paragraph 88, the Federal Court raises the possibility of asking search engines, including Google, to remove links to decisions published on Globe24h.com from their search results. Lastly, in paragraph 104, the Respondent is ordered to "remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches" [emphasis added]. What scope does such an order encompass: does it simply mean to modify the indexation parameters of the website, to ask Google to delist each decision, to make sure that all search engines delist, to take steps to do so with sites like Wayback Machine?
A suit too large for an idea that is too elusive
Let us take a final look at our three-piece suit. First, the pants raise the issue of the territorial scope of delisting one or all the search engine extensions (2015 BCCA 265 - PDF). The jacket then reminds us that the right to correction, provided in most Canadian personal information protection laws, does not include a right to delist as such (2016 QCCAI 114). Finally, the vest enshrines some form of "lesser right to delist" concerning judicial decisions in the context of outrageous mercantilism (2017 FC 114 - PDF).
This suit doesn't fit well and is uneven. Creating a right to delist specific to court decisions, despite the damning facts in Globe24h.com case, appears contradictory to the decision of the Commission d'accès à l'information du Québec, and raises numerous questions about the other ways decisions are used (a legal blog that would be relatively descriptive, for example). This is a good illustration of the adage "bad facts make bad law". However, the idea of imposing an extraterritorial scope to delisting in an unjustified case of passing off should not prevent us from conducting a true reflection on the existence of a right to delist (or "right to be forgotten") as a whole. The following excerpts provide pause for more serious thought on the issue:
"Remembrance is a right. That flows from an abuse of rights. From an abuse of the right of individuals where the law has not prohibited torture, deportation, genocide, war crimes, crimes against humanity. From a violation of positive law where the statement of such crimes and their punishment is codified. Such right to remembrance precedes and transcends the duty of remembrance. […] Remembrance being the grave of victims, and the technicalities, of preserved arrogance, injurious candour or procedural boasting, are instruments of profanation. They work to absolve the crime and alter the collective conscience. The acts committed have a name; they must receive a legal status. Their authors are identified. Time extinguishes the possibility of a proceeding, but this absence does not erase the gravity of the facts. The victims are human beings, not abstractions." (available in French only)
"Embarrassing photos from ten years ago in which we have been tagged, messages we sent and received by messaging, chat conversations, searches conducted using search engines like Google or Yahoo!, online purchases, or information on our private lives published by third parties on a portal; can the Internet 'forget' this information? […] This new law (or the extension of the right to 'habeas data') would, for example, prohibit companies from holding more than a given amount of information on a person, require that certain images be removed from social media, or a search engine to exclude inaccurate rumours that have damaged a person's reputation from its results. […] this digital forgetfulness would be inappropriate for matters of public interest: a civil servant asking for the removal of a video in which he was shown accepting a bribe or a physician trying to have a file disclosing a prohibited professional practice disappear, to name but a few examples." (available in French only)
We are somewhat reticent to recognizing a general "right to be forgotten" for reasons that are not only legal (this general concept is used everytime, although difficult to define, but pragmatic (the technological reality does not always allow for an effective delisting), and ethical-political (we believe that the values of remembrance and accountability should prevail over those of information self-determination and lack of accountability). More specifically, we feel that the court decisions in this matter, such as the one in Globe24h.com, confuse the "right to be forgotten" (a questionable right when faced with the factual, or even historical, reality,) and the authorized (or not) use of personal information.
In any event, a tailor will have to spend time coordinating and adjusting the three-piece suit that is the "right to be forgotten", which for the moment appears to us to be too large for an idea that remains elusive. The consultation by the Office of the Privacy Commissioner of Canada cited above represents a good effort in this regard. The Supreme Court of Canada might have more to say on this subject in Equustek, although it might not be the best occasion to determine Canada's position on the "right to be forgotten", since the context is infringement (not directly related to personal information protection). One thing, however, is certain: the right to be forgotten is inseparable from the saying "He that has no head needs no hat"!