In one of the most significant and controversial interpretations of Canada’s private sector privacy law since its inception, the federal Privacy Commissioner has suggested, to the surprise of many, that the existing law supports a right for individuals to require search engines to de-index web content that contains their personal information.
Following a public consultation initiated in 2016, the Office of the Privacy Commissioner of Canada (OPC) recently released a draft position paper that asserts that the Personal Information Protection and Electronic Documents Act (PIPEDA) provides a right to apply to search engines to “de-index” (i.e., remove) certain search results that damage an individual’s reputation. De-indexing rights do not affect the source websites, but do make them more difficult to locate and access.
The OPC’s interpretation would provide a right loosely similar to the “Right to be Forgotten” that exists under European law, although the OPC was careful to note that its interpretation was strictly based on Canadian law, and not connected to the European framework.
The OPC’s analysis
In the paper, the OPC detailed the interpretive steps that led to its conclusions, including its critical finding that by indexing websites that contain personal information, search engines engage in the “collection, use or disclosure” of personal information – the key threshold test for the application of PIPEDA.
The OPC then determined that the application of PIPEDA would give rise to the following obligations on the part of search engines:
- Accuracy, completeness and currency. Noting that PIPEDA requires that personal information be as accurate, complete and up-to-date as necessary for the purpose for which it was collected, and taking into account the interests of the individual, the OPC reasoned that search engines must consider challenges by individuals regarding the accuracy or completeness of personal information, and de-index results (or potentially demote or “flag” results) where the individual has demonstrated the results to be inaccurate or incomplete.
- Appropriate purposes. Noting that PIPEDA is also qualified by the general limitation that “organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances,” the OPC determined that it is reasonable for search engines to display links to an individual’s personal information when that individual’s name is searched. However, the search engine should de-index web content that discloses personal information (e.g., materials under a publication ban), or where the public interest in accessing the personal information is outweighed by “significant harm” that its availability might cause to the individual.
Under the OPC’s proposed framework, search engines would evaluate initial complaints on a case-by-case basis and assess whether harms associated with disclosure outweigh public interest factors. The OPC provided some guidance in terms of balancing the public interest in accessing personal information with privacy, noting that there is greater public interest in public figures and matters of public debate, and less public interest in a person’s private life (as opposed to professional life), information about minors, and outdated information about an individual’s criminal record.
Where a decision is made to de-index search results, the OPC said that search engines should use “geo-fencing” techniques (e.g., using Canadian IP addresses) to apply the de-indexing broadly across Canada, as opposed to simply applying the de-indexing to “.ca” domains of the search engines.
While the OPC acknowledged the tension between privacy rights and freedom of expression guarantees under the Charter of Rights and Freedoms, the OPC was of the view that they had struck an appropriate balance consistent with case law – and encouraged Parliament to review and clarify the application of PIPEDA to search engines.
In addition to clarifying the application of PIPEDA on search engines, the OPC made several recommendations concerning youth privacy, including:
- Establishing a near absolute right for youth to remove information about themselves that they have provided to an organization.
- Providing some ability for youth, upon reaching the age of majority, to request the removal of online information posted about them by their parents or guardians.
In addition to obvious concerns about the tension between the OPC’s position and constitutional guarantees for freedom of expression, the OPC’s finding of the application of PIPEDA to search engines is also likely to prove contentious as some would argue that search engines – at least when enabling their core search functionality – do not really “collect” personal information in the way that the term is usually understood in the privacy context. Rather than collecting and assembling dossiers of information tied to identifiable individuals, search engines merely facilitate the location of web content posted by others, through the linking of keywords to web content and sites; they don’t so much collect information as assemble links to information posted by others.
The OPC’s interpretation that search engines collect, use or disclose information has not been addressed directly by the courts; however, in other contexts, the courts have given some consideration to the treatment of linking web content. In the seminal case of Crookes v. Newton, a defamation case, a majority of the Supreme Court of Canada noted that hyperlinks are not publications, but rather, mere references that take the user to other sources. A similar analysis applied to the applicability of PIPEDA might conclude that indexing web content does not amount to a collection or use of personal information, but rather to a mere indexing of references to such content.
Moreover, accepting a finding the PIPEDA applies to search engine indexing means that search engines are necessarily subject to the Act as a whole, not just to certain provisions or principles. In fact, the full application of the law would create significant operational and compliance issues for search engines. In this regard, the OPC itself acknowledged (but sidestepped) the significant fact that, “it may not be practicable for an intermediary such as a search engine to obtain consent to index all webpages on the Internet that contain personal information.” The impossibility of applying the consent requirement to search engines would mean widespread and unavoidable non-compliance with what is arguably the fundamental requirement of PIPEDA, suggesting that, in fact, the law was not intended to apply to such activity.
Similarly, the consent requirement in the Act includes a general right to withdraw consent, subject only to legal and contractual restrictions. Far beyond the purposive and “balanced” approach that the OPC has proposed, applying this statutory withdrawal right to search engines would suggest that individuals would have a general right to prevent search engines from indexing any personal information about them, for almost any reason.
Coincident with the publication of its position paper, the OPC called for comments from interested stakeholders, requesting that any submissions be received by 19 April 2018. It is expected that the regulator’s position will be finalized (and possibly revised) thereafter, at which time an action plan will be established to put the new measures in practice.
The OPC does not have order making powers under PIPEDA and any final paper would not have legal effect. Nevertheless, the OPC’s paper suggests an expansive interpretation of PIPEDA going forward – particularly in the area of internet and technology – and also points to potential legislative changes in the future.