Google Search Engine Service Is Subject to PIPEDA

Written by Christina Catenacci, BA, LLB, LLM, PhD, Content Editor, First Reference Inc.

On September 29, 2023, the Federal Court of Appeal decided that Google’s search engine service is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Both Laskin J.A. and Gleason J.A. rejected all of Google’s arguments and swiftly dismissed Google’s appeal. However, there was a dissent in this case-Webb J.A. would have allowed the appeal.

What happened?

Google’s mission is to organize the world’s information and make it universally accessible. Google Search (Search) is the world’s leading Internet search engine; millions of searches are carried out each day. There are three main functions: crawling, indexing and displaying search results. When someone searches, Search uses algorithms to display search results linking to the relevant web pages in the index, ranked from most to least relevant.

Website operators control whether their content is displayed by Search. In fact, it is possible for these operators to configure their servers to refuse to respond to requests for access from one of Search’s crawlers. In this way, it is possible to prevent the contents of that URL from being indexed and displayed by Search. Similarly, news organizations control what stories appear in Search as part of their overall journalistic mission: They decide what to publish on their website, decide whether to remove or change any information on their website and use robots.txt files to direct Google on which stories from their websites to include in Search.

The complaint

In June 2017, the complainant made a complaint to the Privacy Commissioner of Canada (Privacy Commissioner) alleging that Internet searches of his name using Search were yielding links to news articles about him containing outdated, inaccurate and sensitive information. Also, the complainant stated that Google’s disclosure of this information was directly exposing him to harms including physical assault, employment discrimination, severe social stigma and persistent fear. Therefore, the complainant sought the Commissioner’s assistance in having links to his sensitive personal information de-listed from Google’s search results.

The Privacy Commissioner first suggested that the complainant approach Google and ask it to remove the links. Google said no, and advised the complainant to resolve any disputes directly with the website owner (providing instructions on how to request a change).

Google’s response to the complaint was that the Privacy Commissioner had no jurisdiction because PIPEDA did not apply:

• It was not engaged in commercial activity when it presented search results (section 4[1][a] was not triggered, quoted below).
• It served a journalistic purpose when it provided search results leading to journalistic content, and therefore it was excluded from PIPEDA (4[2][c] applied, quoted below).
• Any interpretation of PIPEDA that would prohibit Google from providing search results leading to journalistic content would contravene the Canadian Charter of Rights and Freedoms (Charter).

The relevant paragraphs of PIPEDA were as follows:

“s. 4 (1) This Part applies to every organization in respect of personal information that.

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

…

(2) This Part does not apply to

(a) any government institution to which the Privacy Act applies;

(b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose; or

(c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

At this point, the Privacy Commissioner initiated a public consultation on the issue of online reputation and asked whether a “right to be forgotten (the right to have publicly available private information about the person removed from the Internet) could apply in Canada. The result was a paper regarding online reputation.”

In addition, the Privacy Commissioner decided to refer two of the jurisdictional issues raised by Google to the Federal Court in regard to two questions:

• Does Google, in the operation of its search engine service, collect, use or disclose personal information in the course of commercial activities within the meaning of paragraph 4(1)(a) of PIPEDA when it indexes web pages and presents search results in response to searches of an individual’s name?
• Is the operation of Google’s search engine service excluded from the application of Part 1 of PIPEDA by virtue of paragraph 4(2)(c) of PIPEDA because it involves the collection, use or disclosure of personal information for journalistic, artistic or literary purposes and for no other purpose?

The Privacy Commissioner decided to not refer the Charter issue to the Federal Court.

Simply put, the prothonotary stated that there was no basis on which the application for a reference should be struck out. Although Google appealed the prothonotary’s order bringing a motion to the Federal Court, this motion was dismissed. As well, Google’s submission about determining the constitutionality of PIPEDA was rejected.

The reference at the Federal Court

As to the first question, the reference judge decided that the question should be divided into a part examining whether Google disclosed, collected or used personal information, and a part asking whether it did so in the course of commercial activities. The reference judge decided that yes, Google disclosed, collected or used personal information, and yes, it did so in the course of commercial activities.

As to the second question, the answer was no, since Google could not meet the definition of journalism and could not rely on the journalism exception. The definition of journalism stated:

“an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation”

That is, Google made information universally accessible (this was much broader than informing a community about issues that the community valued), Google never created anything (it only displayed search results) and Google never tried to determine the fairness or the accuracy of its search results (the publishers did this).

Moreover, the reference judge examined the phrase “and for no other purpose” (in section 4[2][c] of PIPEDA), and found that the exemption under paragraph 4(2)(c) applied only where information was collected, used or disclosed exclusively for journalistic purposes. Clearly, the purposes of Search extended beyond journalism. Thus, the reference judge stated, “Google’s purposes for collecting, using and disclosing personal information […] are not journalistic, and they are certainly not exclusively so.”

In response, Google appealed to the Federal Court of Appeal and argued that the reference judge erred. The first argument was that the reference judge did not consider the Charter issues, assumed that the Privacy Commissioner had jurisdiction to consider the Charter and proceeded to answer the reference questions without considering the Charter.

The second argument was that the reference judge erred by deciding that the journalistic exception in section 4(2)(c) did not apply. Google highlighted that the principles of statutory interpretation supported a broad interpretation of “journalistic purposes,” it was an error to accept and apply the definition used to examine “journalism,” and there was a failure to consider that paragraph 4(2)(c) applied to specific information.

The appeal

With respect to both arguments, the Federal Court of Appeal decided that the reference judge made no errors. As a result, the court dismissed Google’s appeal.

The Privacy Commissioner’s response

On October 3, 2023, Privacy Commissioner Philippe Dufresne issued the following statement:

“I welcome the Federal Court of Appeal decision upholding the Federal Court’s decision that Google’s search engine service is subject to federal privacy law.

The court agreed with my Office’s position that Google is not exempt from the Personal information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, under the journalistic purposes exemption.

The court’s decision brings welcome clarification to this area of the law.”