On Friday, January 26, 2018, the Office of the Privacy Commissioner of Canada (OPC) released a draft of their position regarding online reputation and on how Canadians can better protect their online privacy and rights.
The draft report is the result of a 2016 consultation on online reputations. Through this consultation, the OPC was soliciting input from interested stakeholders about new and innovative ways to protect reputational privacy. Reputation and Privacy is one of the OPC’s four strategic privacy priorities. A summary of the 28 submissions received is posted online on the OPC website.
Summarizing the report
The draft report sets the OPC position as follows: That members of the public should have better tools in place to protect their online reputation. One of the solutions suggested is requiring search engines to de-index web pages containing personal information in appropriate cases.
The report includes a statement indicating that the right to de-index search results with respect to inaccurate, incomplete or outdated personal information, such as one’s name, (similar to the European Union (EU) 2014 right to be forgotten or right to erasure) is already covered under the Personal Information Protection and Electronic Documents Act (PIPEDA) and other provincial privacy law. In the opinion of the OPC, search engines are covered by PIPEDA because they collect, use and disclose personal information in the course of commercial activities.
The OPC is basing an individual’s right to request de-indexing on three principles found in PIPEDA: the principles of “accuracy”, “individual access”, and “challenging compliance,” to conclude that if the de-indexed result is inaccurate, incomplete or not up-to-date, then the search engine must balance the interests of the individual against the public interest of the web page continuing to be indexed and displayed in the search results.
If that interpretation is held, it opens up potential de-indexing requests to search engines (i.e., Google, Microsoft Edge, Firefox) who must comply with the Act, and complaints to the Privacy Commissioner of Canada should search engines refuse to comply. The position is also based on recent decisions of the Federal Court in A.T. v. Globe24h.com, 2017 FC 114 and the Supreme Court of Canada in Google Inc. v. Equustek Solutions Inc., 2017 SCC 34 which confirmed the important role search engines have to actively protect the public from illegal content on the Internet.
The removal or amendment of information at the source; and education to help develop responsible, informed online citizens is also part of the solution.
The report explained that de-indexing is the process by which a web page, image or other online resource is removed from search engine results when an individual’s name is entered as the search term. Source takedown refers to the removal of the content from the internet.
“With respect to de-indexing, the OPC is of the view that PIPEDA applies to a search engine’s indexing of online content and display of search results. As such, search engines must meet their obligations under the Act.
This includes allowing individuals to challenge the accuracy, completeness and currency (the extent to which the information is up-to-date) of results returned for searches on their name. Such challenges should be evaluated on a case-by-case basis, and decisions to remove links should take into account the right to freedom of expression and the public’s interest in the information remaining accessible. Additional detail, criteria and discussion about this mechanism are presented in the report.
If an individual is able to successfully challenge the search result based on the above, it should be de-indexed. However, lowering the ranking of a result or flagging a link or content as inaccurate or incomplete could be sufficient alternatives in some cases.
With respect to source takedown, PIPEDA provides individuals the right to withdraw consent, and requires that personal information that is no longer needed be destroyed, erased or made anonymous. Taken together, this implies that individuals should have the ability to remove information that they have posted online.
Where the personal information in question has been posted by others, individuals do not have an unqualified right to remove it. However, similar to de-indexing, individuals should be provided a mechanism by which they can challenge the accuracy, completeness and currency of the information and, where such a challenge is successful, to have the information corrected, deleted or augmented, as appropriate.
In either of the above cases, where matters cannot be resolved with a website or search engine, individuals may lodge a formal complaint with the OPC.
While, in combination, the abilities to request de-indexing and/or source takedown of information in certain circumstances are similar to the “Right to Erasure (Right to be Forgotten)” in the EU’s General Data Protection Regulation (GDPR), this paper does not import a European framework into Canada. Rather, it is an interpretation of current Canadian law, and the remedies related to online reputation that can be found therein.
In our view, by indexing webpages containing personal information, and returning links to those pages in search results, search engines are collecting, using and disclosing personal information within the meaning of PIPEDA. When users search for information about an individual by name, search engines can create a detailed profile of all relevant information concerning that individual and return that information to the user. Search engines themselves acknowledge that their activities may involve personal information and they have policies to remove certain kinds of personal information, such as social insurance numbers, from their results.
Although most search engines are free, most also display advertisements alongside search results. The ability of search engines to sell this advertising space would not exist were it not for the search service they provide. The two functions have been described as ‘inextricably linked.’”
Based on the above, the OPC view is that since search engines already engage in the indexing activity and are covered under PIPEDA, they should have the obligation to de-index and takedown “because the problems that need addressing arise from their own actions; and because it promotes access to justice.”
The other aspect of the report deals with standardized takedown request forms and calling on Parliament to establish a stronger ability for youth to request and obtain the deletion of information they themselves have posted on social media, and in appropriate cases, information posted about them online by their parents or guardians when they reach the age of majority.
Other proposed solutions focus on educating all Canadians about available mechanisms to control reputation, such as through website privacy settings, and other emerging privacy enhancing technologies.
The report reiterates the request by the OPC to provide the OPC with stronger enforcement powers, such as order-making and imposing fines, and allowing it to proactively examine how organizations are responding to de-indexing requests.
OPC wants feedback on the draft report
The OPC would like to receive feedback on the draft report by April 19, 2018 before finalizing it. The OPC is interested in answers to the following questions:
- Is the position clear?
- Of the positions taken in this paper, have we struck an appropriate balance between individuals’ right to privacy and the right to free expression? Why or why not?
- Are there gaps that have not been identified in the position that require further direction from the OPC?
Additional questions for organizations:
- Is the position useful to your organization in terms of guiding behaviour? What additional guidance might be required to provide additional clarity?
- Are there areas of the proposed position that would pose challenges and how would you minimize them?
- How long will it take for your organization to implement the guidance recommendations into your policies and practices?
Responses can be sent by email to OPC-CPVPconsult2@priv.gc.ca in accordance with their feedback criteria and procedures. Please indicate your name, contact information and category which best represents your perspective (e.g., individual, organization, academic, advocacy group, information technologist, educator, etc.)
After consulting with interested stakeholders, the OPC will finalize its position and develop an action plan to put the new measures into practice.
Thoughts on the report
The OPC specifically states in its report that it does not want to import the European Union (EU) “Right to be Forgotten” and “Right to Erasure” framework into Canada. In the opinion of the OPC, all of the solutions and considerations outlined in the report, are already established in Canadian law (i.e., PIPEDA) and just need to be applied with backup. Also, these solutions and considerations need to be balanced between the right to privacy and other values (beliefs, ideals, standards) highly held in a democratic society and already established in the Canadian Charter of Rights and Freedoms such as freedom of expression and public interest. These seems to be the key principles coming out of the report.
The OPC believes that organizations (including search engines) already engage in such balancing measures, and that search engines in particular already have mechanisms in place to evaluate de-indexing requests and remove potential harmful or illegal content from their search results. That PIPEDA already requires that organizations act as an initial responder by mandating that organizations “put procedures in place to receive and respond to complaints or inquiries about their policies and practices relating to the handling of personal information”.
It will be interesting to see whether search engines and interested stakeholders agree with the OPC’s interpretation of PIPEDA and are ready to comply.
Source: Office of the Privacy Commissioner of Canada draft of their position regarding online reputation.