Privacy Commissioner's Draft Report on a "Right to be de-indexed" is Cause for Concern

In its recent draft Position on Online Reputation, the Office of the Privacy Commissioner of Canada (OPC) has suggested the options of removing webpages from search engine results, or “de-indexing”, along with “source takedown.”  

Boasting that it “champions solutions that balance freedom of expression and the privacy interests of individual”, the Draft Position proposes de-indexing and source takedown as two solutions for increasing an individual’s control over their online reputation. The Report argues that both of these mechanisms can be found within Canada’s digital privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA).

Leaving for another day the topic of source takedown, with respect to de-indexing, there is strong reason to dispute the OPC’s claims that this mechanism fairly balances freedom of expression with individual privacy, and that it finds its source in PIPEDA.

Background on Search Engine De-Indexing

As explained in the Draft Position, de-indexing is “the process by which a particular webpage, image or other online resource is removed from the results returned by a search engine when an individual’s name is entered as the search term”.

De-indexing as a legal means to enhance an individual’s privacy and reputation online is often referred to as the “right to be forgotten”. But that term can be misleading. De-indexing does not remove the source content from the internet, but it does mean the underlying website will not be listed in the search results, making that content more obscure. Consequently, de-indexing as a legal remedy may be better described as a “right to obscurity” or a “right to oblivion”.[1]

A legal right to de-indexing was recognized by the Court of Justice of the European Union in a 2014 case, Google Spain v AEPD and Mario Costeja González. In Google Spain the Court interpreted the European Data Protection Directive[2] as bestowing on European citizens a right to require that search engines remove hyperlinks to websites containing inadequate, irrelevant or out-dated information. This right exists even if the underlying information was legally published and accurate. However, whether de-indexing is required in a particular situation will depend on several factors: the rights of the subject, the economic freedom of the search-engine company, and the public’s legitimate interest in the information, particularly where the subject is a public figure.

Freedom of expression interests – of the search engine, the original publisher, or the reader – were surprisingly muted in the Google Spain decision. Individual privacy rights clearly triumphed in the Court’s analysis. Following the Google Spain decision, search engines have been saddled with the mammoth and thorny task of applying the Court’s decision to millions of removal requests by European citizens who believe search results about them meet the criteria of being inadequate, irrelevant or out-dated.

De-Indexing Undermines Free Expression

The OPC maintains that the Draft Position “does not import a European framework into Canada”. Yet the problems that have materialized in the European experience following the Google Spain decision should sound a note of caution before de-indexing is embraced in Canadian law. The Draft Position recognizes some of the these problems, but fails to address them meaningfully.

Based on Principle 4.6 of PIPEDA,[3] the Draft Position argues that search engines should respond “to challenges that the profile presented in the form of search results is not accurate, complete, or up-to-date”. In other words, if the individual can demonstrate that the search results for their name are not accurate, complete or up-to-date, then the search engine should amend the results, most obviously by removing the link. According to the OPC, this obligation appropriately balances freedom of expression with individual privacy because the search engine does not remove the underlying content or affect its accessibility using other search terms (or by other means). All that is removed is the link between the underlying content and the search results for that particular individual’s name.

The OPC’s position downplays the significant role that search engines play in contemporary life. For a majority of people in Canada, the internet is a key source of information. And search engines are the only practical way they can access, in an organized and efficient manner, the vast amount of information available on the internet. Search engines help match websites to readers, disseminating the information publishers put on the web to their potential audience. Search engines are pivotal to free expression in 2018. As noted by the Court in Google Spain, a search engine “plays a decisive role” in transmitting information online.[4]

Legally mandated de-indexing creates a significant barrier to readers’ ability to find and read the underlying websites, and to the publishers’ ability to reach their audience – even though the information is legally published and readers are legally permitted to read it. The result is undeniably an infringement of free expression –one that should not be brushed off as justified simply because of the individual privacy interests at stake.

The problems with de-indexing are magnified by how the Draft Position envisions it would work in practice. Search engines themselves would bear the challenging task of arbitrating de-indexing requests from individuals. Once an individual challenges a search result, the search engine must consider the complaint and determine whether the link should be removed based on the requirements of PIPEDA.

Leaving aside whether it is fair to impose such a costly burden on search engines, this framework is problematic from a free expression perspective. Placing these decisions in the hands of the search engine will inevitably skew toward protecting the privacy of the individual requesting removal, and away from protecting free expression. An individual whose de-indexing request is not granted can escalate the complaint to the OPC and even the courts, at substantial cost to the search engine. To avoid such disputes, search engines can be expected to err on the side of removal.

The Draft Position also notes there is no obligation to notify publishers of de-indexing requests.  Without notice, publishers cannot counter the individual’s claims that the information is not accurate, complete or up-to-date; they cannot argue the public interest in having information indexed; and they cannot meaningfully assert their right to free expression. If PIPEDA is indeed properly interpreted in this way, then there is a serious question as to whether it passes constitutional muster, or infringes the guarantee of free expression in s. 2(b) of the Charter. The only response to these concerns in the Draft Position is that the impact will “in many cases, be minimal” because the underlying context remains on the internet. This response is too simplistic and, as noted above, overlooks the role search engines play in helping users navigate the internet.

The Draft Position Misinterprets PIPEDA

Beyond being unpalatable for policy reasons, recognizing a “right to be de-indexed” under the existing PIPEDA framework is also difficult to justify based on a fair reading of the statute.  While a comprehensive review of all legal arguments is beyond the scope of this post, two points bear special mention.

First, in order for PIPEDA to apply to search engines, one must conclude that they “collect, use or disclose” personal information “in the course of commercial activities” (s. 4(1)(a)).  There is good reason to doubt this proposition, at least insofar as it relates to a search engine’s indexing activities (and to be clear, this post is focused only on those activities). 

A key principle of PIPEDA is that “[a]n organization is responsible for personal information under its control”.[5]  But search engines do not control the content of the websites that appear in their search results.  Instead, they continuously crawl the internet, organize online content, and use sophisticated algorithms to provide users with hyperlinks to those parts of the internet that already exist in the public sphere.  Or, as the Supreme Court recently put it, search engines simply “lead” or “direct” people to websites.[6] 

These activities do not fit easily within the PIPEDA basket of “collecting, using or disclosing” personal information.  A more apt description might be that search engines facilitate user access to public websites; it is those websites that, in turn, may collect, use or disclose personal information.  In this sense, search engines are analogous to someone who communicates the existence of website content via hyperlinking. The Supreme Court has held that hyperlinking activity “does not involve exercising control over [website] content”, and thus will not normally attract liability for defamation.[7]  As other commentators have noted, this finding in the defamation context does not automatically mean that search engines fall outside the scope of PIPEDA.[8]  But it does capture the critical distinction between the role played by search engines and the role played by the actual publishers of websites that collect, use or disclose personal information.[9]

Second, the consent obligations that would attach to search engines under PIPEDA are so unworkable that they further support the conclusion that PIPEDA was never intended to apply to search engines first place. 

PIPEDA requires organizations to obtain the “the knowledge and consent” of any individual before “the collection, use, or disclosure of personal information, except where inappropriate.”[10]  Even given their most generous interpretation, the narrow exceptions to consent set out in PIPEDA would not cover more than a fraction of a search engine’s activities.[11] Nor is it reasonable for search engines to conduct a case-by-case analysis to see if the nuanced analysis required for “implied consent” is met with respect to a given individual’s information on a particular site.[12]

This means that if PIPEDA did apply to search engines, then they would have to obtain some kind of “consent to being indexed” from most individuals whose personal information is contained in an indexed website that may be displayed in response to a user’s search. Such an unreasonable and impractical burden could not have been what was intended by the legislature.

Even the Draft Position recognizes that “it may not be practicable for … a search engine to obtain consent to index all webpages on the Internet that contain personal information”. But rather than analyze whether this significant gap in the legislative scheme can be reconciled with the conclusion that PIPEDA applies to a search engine’s indexing activities, the Draft Position merely calls on Parliament to “consider new, properly framed exceptions to consent to deal with such situations”. 

This approach fails to account for a key principle of statutory interpretation: legislation needs to be interpreted contextually, looking at the words of the legislation as a whole. In this case, the particular words that determine the application of PIPEDA to search engines – whether they “collect, use or disclose” personal information – need to be interpreted in light of PIPEDA’s provisions on consent. To extend the scope of PIPEDA to organizations or activities that are not workable under the current consent regime requires either ignoring the principle of contextual interpretation (which would be an error of law), or concluding that the legislature’s purpose was to effectively shut down search engines (which could not have been the case).

The Road Ahead

Although we remain in the early days of debating whether Canadian law should (or already does) recognize some kind of “right to be forgotten”, the Draft Report marks an important step towards actualizing such a right.  The OPC has invited a further round of consultation and comments on the Draft Report, following which the OPC has said it will “finalize our position and develop an Action Plan that will put these new measures into practice.”  Time will tell where this all leads.

Regardless of what position the OPC takes, it will be up to the courts to determine conclusively whether such a right actually exists in PIPEDA – and, if so, whether it is constitutional.  But ideally, rather than testing how far one can stretch old legislation to cover the novel concepts of de-indexing and source takedown, Parliament will address these issues directly by examining, debating and (if necessary) passing legislation that deals with how the right to be forgotten ought to be incorporated into Canadian law, if at all.

[1]  See I Shapiro and B MacLeod Rogers, “How the ‘Right to be Forgotten’ Challenges Journalistic Principles,” (2017) 5 Digital Journalism 1101 at 1104.

[2]  Directive 95/46/EC, which relates to the protection of privacy rights in data processing systems.

[3]  PIPEDA, schedule 1, Principle 4.6.

[4] Google Spain, at para 36.

[5]  PIPEDA, schedule 1, Principle 4.1.

[6]  Google v Equustek, 2017 SCC 34 at paras 26 and 52.

[7]  Crookes v Newton, 2011 SCC 47 at para 26 (emphasis in original).  See also paras 27-28.

[8]  See M. Rosenstock, “Is There a ‘Right to Be Forgotten’ in Canada’s Personal Information Protection and Electronic Documents Act?” 14 Can. J. L. & Tech 131 at 143.

[9]  See, for example, AT v Globe24h.com, 2017 FC 114, where the Court held that a website operator breached PIPEDA by publishing Canadian court decisions containing personal information, such that the content would be picked up by search engines.

[10]  PIPEDA, schedule 1, Principle 4.3.1.

[11]  PIPEDA, section 7, and schedule 1, Principle 4.3.6.

[12]  PIPEDA, schedule 1, Principle 4.3.6.  See also Royal Bank of Canada v Trang, 2016 SCC 50.