Are search engines engaged in commercial activity? Is it practical to require them to obtain consent before gathering personal data? Is it appropriate to ask them to decide what information needs to be removed from their indexes?
These are just some of the thorny questions in the debate over online reputation, and the right to be forgotten. Three CBA groups – the CCCA, the Privacy and Access Law Section and the Children’s Law Committee – recently responded to the Office of the Privacy Commissioner’s Draft Position on Online Reputation and the only things the three wholeheartedly agreed on were that children must be protected online and that privacy laws, written for a different time and circumstance, need to be studied by Parliament.
“Privacy legislation, as well as the Canadian Charter of Rights and Freedoms, are interpreted today in a different context than when they were originally drafted,” the Sections say. “As the internet broadly, and search engines specifically, are significant sources of information for Canadians, online reputation and disclosure of personal information online are important issues for regulators, policy makers and legislatures to examine.”
The Sections disagree on a number of questions that are fundamental to the debate – for example, do search engines fall under the scope of PIPEDA? They are, after all, engaged in the “collection, use or disclosure” of personal information. Some say yes, others argue that they’re engaged in a more journalistic function, and therefore outside of PIPEDA’s ambit. Still others suggest, per the Supreme Court’s decision in Crookes v Newton, that search engines are more like librarians – indexing web content is about facilitating the location of web content created by others.
The disagreement extends to whether search engines are engaged in commercial activity – some say yes, some no – and whether de-indexing and source takedown obligations even exist under PIPEDA.
Some “believe that the right to be forgotten is not addressed directly in PIPEDA and the OPC’s interpretation that PIPEDA requires removal of links from search indexes or lowering of rankings to obscure search results extends well beyond an organization’s obligation under PIPEDA to update and correct inaccurate information.”
And even if PIPEDA did apply, who would apply PIPEDA? The Sections say it would be “untenable” to require search engines to obtain consent before including individuals in search results. Moreover, if there was a requirement to remove information – and consequences for not doing so – the result could be self-censorship, as companies might err on the side of caution and remove more information than necessary.
“Online reputation is an important issue that requires careful study. Parliament must be mindful, however, that PIPEDA and other private-sector privacy legislation cannot be the catch-all for issues that arise from the ongoing evolution of technology,” the Sections conclude.
“The uniqueness of the Canadian Charter context and the far-reaching implications for freedom of expression and access to publicly available information underscores the need for legislative and policy guidance in this uncharted area.”