Google Canada has lost its bid for an exemption from federal privacy law for its search engine results, raising the possibility that a digital “right to be forgotten” may be recognized in Canadian law.
In a decision last week Federal Court Associate Chief Justice Jocelyne Gagne dismissed Google’s arguments that the Personal Information Protection and Electronic Documents Act (PIPEDA) doesn’t apply to its search engine results because the search side of the company isn’t a commercial enterprise, and because search results are used for journalism. PIPEDA’s obligations don’t apply to journalistic endeavors.
Google lost on both counts. “Google promotes its advertising business by highlighting the popularity of its search engine,” the judge wrote at one point. Even if it provides free services to content providers and the user of the search engine, “it has a flagrant commercial interest in connecting these two players,” she added. It is a commercial entity, the judge concluded.
As for asking for an exemption based on PIPEDA’s journalism exception, the judge said Google isn’t a publisher. It has no control over the content of search results, the search results themselves express no opinion, and Google does not create the content of the search results.
The case started in June 2017 with a complaint before the Office of the Privacy Commissioner of Canada (OPC), and, unless Google Canada appeals, it will go back there for more argument now that the question of whether PIPEDA applies to search engine results has been settled.
Even if it does, privacy commissioner Daniel Therrien still has to rule on whether it applies in this complaint, and if it does what remedy he will order.
The right to be forgotten
The case involves the so-called right to be forgotten. An unnamed man complained to the OPC over Google search results for his name. He said the prominent results contain outdated and inaccurate information, and they disclose sensitive information. As a result he has allegedly suffered direct harm, including physical assault, lost employment opportunities and has experienced severe social stigma.
The OPC initially said the man should first ask Google to remove the links from searches for his name. Under Google’s policies the company says it can review complaints about content and “consider blocking, limiting, or removing access to it.”
However, Google Canada said the man should ask the websites with the allegedly inaccurate information to change their content. In January, 2018 the OPC published a draft paper suggesting in certain circumstances PIPEDA — which covers the collection of personal information by a commercial entity — might apply to search engines. Two months later, in replying to the man’s complaint, Google argued it isn’t covered by PIPEDA. That led the privacy commissioner to refer questions about PIPEDA’s applicability to the Federal Court.
The judge’s decision was not unexpected, privacy lawyer Barry Sookman of the McCarthy Tetrault law firm said in an email. “It was a tough argument to make that Google’s collection of personal information was not for a commercial purpose and that it has the journalist exception. Google lost that argument in Spain as well before the European Court of Justice.
“The bigger question, which went unanswered, and which is central to the whole case, is whether our privacy law violates the Charter of Rights and Freedoms if it doesn’t facilitate Google’s search engine service. The privacy commissioner opposed Google making that argument, and that has the effect of delaying the ultimate decision as to whether Google must comply with right to be forgotten requests.”
Related: Debate on the right to be forgotten
The so-called right to be forgotten has been debated in privacy law circles around the world ever since people realized that search engines may pull up old, later updated news stories. Sometimes they are at the top of a search (“man charged with XXX”), while newer results (“charges dropped”) are far below. Backers of the right to be forgotten argue search engines at the very least should list the most recent results first. News organizations fear the right would oblige them to delete old, but accurate, stories. In fact the CBC supported Google’s position, arguing the case could allow the privacy commissioner to “make one-sided decisions about journalistic publications without input from the content creator.”
The right to be forgotten rose to prominence when the European Union included the Right to Erasure in the General Data Protection Regulation (GDPR). Briefly, it says a person shall have the right to obtain from the controller of data the erasure of personal data it holds without undue delay under certain circumstances.
With no clear statement in PIPEDA, in 2018 federal privacy commissioner Daniel Therrien suggested companies create codes of practice on if and how they will meet requests that personal information publicly published be de-indexed or taken down. But he also noted PIPEDA gives people the right to demand the personal data businesses hold be accurate and complete.
The federal government’s proposed overhaul of PIPEDA, the Canadian Consumer Privacy Act (Bill C-11 includes a right of erasure in Section 55. However, one source noted it isn’t the same as the right to be forgotten., noting the proposal doesn’t require search engines to de-index websites containing personal information.
The proposed law is still stuck in first reading and will die if the government calls an election.
