In The News: Canada’s Privacy Commissioner Proposes Tools To…

Because the Learn section of TalkRights features content produced by CCLA volunteers and interviews with experts in their own words, opinions expressed here do not necessarily represent the CCLA’s own policies or positions. For official publications, key reports, position papers, legal documentation, and up-to-date news about the CCLA’s work check out the In Focus section of our website.

On January 26, 2018, the Office of Privacy Commissioner of Canada (“OPC”) released a draft policy position paper on the issue of protecting one’s “online reputation.” In the draft paper, the commissioner interprets the Personal Information Protection and Electronic Documents Act (PIPEDA) as providing individuals with the right to request search engines to “de-index” any links to websites that contain demonstrably inaccurate, incomplete, or outdated information about the individual and providing individuals the qualified right to request the owner of a commercial website to modify or remove any such misinformation. This article provides a detailed summary of the two key proposals made by OPC in the draft paper and offers some brief critical commentary.

Competing Interests: Protection of One’s Online Reputation and Freedom of Expression

Allowing unrestricted access to personal information on the internet that is inaccurate, misleading, or outdated, may have a harmful and long-lasting impact on the individual’s life, especially if that misinformation is used to make decisions. Many employers, for example, use internet search engines as part of their job application screening process. That said, the OPC also recognizes that a person’s interest in protecting his or her online reputation needs to be balanced against a countervailing interest of another person’s right to freedom of expression—a value that is enshrined in the Charter.

Accordingly, by its own admission, the OPC does not seek to propose any new, independent right to protect one’s online reputation in the draft policy paper. Instead, the OPC argues that, properly interpreted, PIPEDA implies certain protections for an individual’s online reputation.

Proposal #1: De-Indexing

 PIPEDA is the primary Canadian statute governing the way private sector organizations may collect, use or disclose personal information in the course of their commercial activities. Pursuant to paragraph 4(1)(a), PIPEDA applies to “every organization in respect of personal information that […] the organization collects, uses or discloses in the course of commercial activities.” The OPC argues that the activities of search engines fall within the scope PIPEDA.

When a user searches the name of a person, the search engine’s algorithm uses all of the personal information about the person being searched that exists on the internet to create a list of websites containing the most relevant information about that person. This, according to the OPC, constitutes “collection, use or disclosure” of personal information within the meaning of PIPEDA. Secondly, the search engine’s primary aim in using the personal information is to generate revenue from advertisers. In other words, personal information is being used by the search engine in the course of commercial activity. Therefore, since search engines “collect, use, or disclose” personal data in the course of a commercial activity, the OPC argues that search engines are subject to the provisions found in PIPEDA.

According to the OPC, the existing principals under PIPEDA, namely, principle 4.6, 4.9 and 4.10, imply a right to de-index. De-indexing is a means by which search engines remove certain links from the search results of specific search terms (such as a person’s name), or lower the ranking of certain websites in the search results. It is important to note that de-indexing does not remove the content itself from the source website nor does it prevent the content from being accessed by navigating directly to the website.

The relevant principles from PIPEDA read as follows:

• Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
• When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending on the nature of the information challenged, amendment involves the correction, deletion, or addition of information
• The extent to which personal information shall be accurate, complete, and up-to-date will depend upon the use of the information, taking into account the interests of the individual.

Recall that a search engine’s algorithm uses the personal information about an individual that is publically available on the internet to render a relevant search result of the person’s name to the user. According to the OPC, it is therefore incumbent upon the search engine under principle 4.6 to ensure that the search engine is using accurate, complete, and up-to-date information. Moreover, where an individual is able to demonstrably show that the personal information used by the search engine is inaccurate, incomplete, or outdated, principle 4.9.5 implies that the individual has a right to have the search engine amend the search result for accuracy, completeness, and currency. According to the OCP, the most readily available means to make such an amendment is to de-index the website from the search result or lower the ranking of the website in the search results. That said, the OPC is sensitive that not all inaccurate information on a website will warrant it being de-indexed. According to the OPC, principle 4.61 requires that search engines be sensitive to the use of the personal information and the interests of the individual. For example, where personal information on a website is inaccurate for satirical purposes, it seems unlikely that de-indexing that website from the search results would be appropriate.

Although de-indexing appears to be an innovate solution to protect one’s online reputation in a manner that also balances the search engine’s freedom of expression (since de-indexing neither removes the website from appearing on other search results nor does it remove the actual content from the source website), there is a potential problem with the OPC’s interpretation of PIPEDA as it relates to search engines. In particular, it is unclear whether PIPEDA intended to bring search engines within the ambit of certain provisions. It is important to remember the search engines search through a collection of personal information that is already publicly available on the internet and then simply presents the links to websites in an order that the engine’s algorithm finds most relevant to the search term. It is not clear, therefore, whether the search results themselves (i.e., the very links to websites or even the order in which the links are presented) can be measured for its accuracy or currency under principle 4.9.5 in PIPEDA. Given the interpretive challenge of finding search engines to fall within the scope of PIPEDA, it would be advisable to seek legislative clarity on the matter.

Proposal #2: Source Takedown/Amendment

In addition to a right to de-index, the OPC argues that the provisions under PIPEDA imply a qualified right to seek modification or removal of inaccurate, incomplete, or outdated information about themselves that is contained on commercial websites. OPC provides two situations where this proposed right would be applicable: (1) where a user of a website, such as a social media platform, posts information about herself that she later wishes to modify or remove and (2) where an individual wishes to request an owner of a commercial website to remove or modify inaccurate, incomplete, or outdated information posted about her by a third-party on the website.

The relevant provisions in PIPEDA to source takedown/amend are as follows:

• An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization shall inform the individual of the implications of such withdrawal.
• Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.
• When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending on the nature of the information challenged, amendment involves the correction, deletion, or addition of information

In the first situation where the user of a commercial website, such as a social media platform, wishes to modify or remove information about herself that she has posted earlier, the OPC claims that principle 4.3.8 and 4.5.3 taken together imply that the individual has a near absolute right to remove the information, except to the extent that it is subject to legal or contractual restrictions.

The OCP recognizes that the second situation, where a third-party posts information about an individual on a commercial website that is inaccurate, misleading, or outdated, raises more difficulties and requires a balance between one’s interest in protecting his or her online reputation with the author’s freedom of expression. Nevertheless, according to OCP, principal 4.9.5 provides that, at a minimum, there be some formal mechanism whereby an individual is able to request that such information is removed or amended from the website.  This, according to the OPC, provides an appropriate balance with freedom of expression.

Unfortunately, the OPC does not offer any guidance as to how one’s freedom of expression should be weighed against another person’s interest in his or her online reputation other than to claim that such a balance should be done with regard to the public interest. However, this balancing exercise creates a false parity between the right to freedom of expression and the right to online reputation. Whereas the former is a constitutionally enshrined right, the latter has thus far gained limited recognition in the context of defamation or libel.[1] Requiring organizations under PIPEDA to remove or modify content that is otherwise lawfully published may raise difficult Charter challenges.

Given the interpretive challenge of finding search engines to fall within the scope of PIPEDA and the potential charter challenges against source takedown/modification, it would be advisable to seek legislative clarity on the issue of protecting one’s online reputation. Perhaps it is more appropriate to create an independent right to protect one’s reputation or seek an amendment to PIPEDA to make such a right more explicit.  Nevertheless, despite these challenges, the OPC draft paper is an important step in furthering the discussion on protecting one’s online reputation, which is becoming an increasingly contentious issue as more of our personal information makes its way onto the internet.

[1] See Hill v. Church of Scientology of Toronto, [1995] 2 SCR 1130, at para. 121 and Grant v. Torstar Corp. [2009] 3 SCR 640, para 51