Companies should create a Code of Practice clarifying if and how they will oblige people who demand personal information online be taken down and their online privacy policies, says the federal privacy commissioner.
That recommendation was one of several made in a draft proposal on helping people protect their online reputation released this morning for public comment by Privacy Commissioner Daniel Therrien.
At a minimum, such a Code would respect and implement what the commission calls “no-go zones” (actions companies shouldn’t do) it has already suggested, the report says. It would also uphold the right for people to ask search engines to de-index or take-down articles about themselves individuals find offensive. “Ideally, such a Code would, over time, establish a reasonably consistent experience that would allow Canadians to understand the basis by which organizations are making decisions with respect to their de-indexing or takedowns requests.
De-indexing content does not remove it from the web, but only removes links to the source content from search results for searches on an individual’s name.
“Canadians need better tools to help them to protect their online reputation,” Therrien said in a statement on the release of the discussion paper.
“There is little more precious than our reputation. But protecting reputation is increasingly difficult in the digital age, where so much about us is systematically indexed, accessed and shared with just a few keystrokes. Online information about us can easily be distorted or taken out of context and it is often extremely difficult to remove.”
Therrien is not proposing the federal Personal Information Protection and Electronic Data Act (PIPED) include a so-called “right to be forgotten,” which is part of the European Union’s General Data Protection Regulation (GDPR) which comes into effect May 25. Instead he suggests that provisions in PIPEDA now can be interpreted to give people that power.
PIPEDA already says an individual shall be able to challenge the accuracy and completeness of his or her personal information and have it amended as appropriate. It also says when an individual successfully demonstrates the inaccuracy or incompleteness of personal information, an organization shall amend the information as required. Depending on the nature of the information challenged, amendment involves the correction, deletion, or addition of information.
Canadians should also be permitted to easily delete information they’ve posted about themselves on a commercial forum. for instance, a social media site, says the draft suggestions. In cases where others have posted information about an individual, they have a right to challenge and seek an amendment to demonstrably illegal, inaccurate, incomplete and out of date information, the report says.
Search engines and websites have an obligation to assess requests from individuals for information to be de-indexed or taken down, adds the report. Most do through existing customer complaints channels. If a matter cannot be resolved, individuals have a right to complain to the Office of the Privacy Commissioner of Canada.
The report’s suggestions were criticized by Halifax privacy lawyer David Fraser. “I don’t think its a correct interpretation of the law, certainly not in light of the Charter (of Rights). I also think it’s bad public policy.”
If a news story isn’t accurate then the content provider and not a search engine should remove it, he argued, by persuading the site that information isn’t accurate. “Putting search engines into the position of having to also be the arbitrator of whether information on the Internet is fair is completely unreasonable and untenable.”
“I do a lot of work in the area of cyber-bullying on behalf of victims, so I’m not heartless on the topic” of online reputation. “But I also recognize we also have a Charter of Rights and Freedoms that guarantees we have a right to freedom of expression. It doesn’t guarantee the right to privacy, at least with respect to individuals and private sector entities.” Such a right wouldn’t withstand a Charter challenge, he believes.
The question is whether there is enough of a problem with online reputation that the law needs to intervene, he said, instead of the private sector creating mechanisms to do it in a fair and balanced way. Many of problems he’s seen aren’t ‘Bob on his Facebook page said something mean about me.’ but something written by a news media site. “And I cannot imagine in a million years that we can fashion a mechanism that would require the removal of content that is otherwise true or was accurate at the time” and still meet the Charter’s right to freedom of expression, he said.
Therrien also recommends Parliament study of this issue of online reputation and people’s rights to have online information about them de-indexed or removed in the context of balancing freedom of speech and right to privacy.
The report is also calling on Parliament to establish a stronger ability for youth to request and obtain the deletion of information they themselves have posted on social media, and in appropriate cases, information posted about them online by their parents or guardians when they reach the age of majority.
De-indexing has become a concern among people who, for example, were convicted of an offence years ago but are dismayed that when someone searches their name the first thing that pops up is a news report of the crime. The news story may rank high because of the way a search engine indexes a story. While not removing content from the internet “de-indexing can have an important impact on an individual’s reputation and right to privacy,” the report argues. But the report also argues that requests should be dealt with by search engines on a case-by-case basis: De-indexing may not be mandatory, it says. In some situations, other solutions (such as lowering the ranking of a result, or flagging it as inaccurate or incomplete) may also be appropriate.
It also argues a single inaccurate statement or the omission of a single fact, within an otherwise wholly accurate webpage, may not warrant de-indexing of the page – particularly where the inaccuracy or omission does not materially impact the interests of the individual.
The commission believes Canadian-based search engines (for example, “google.ca”) are covered by PIPEDA. The report acknowledges that de-indexing information here doesn’t mean it would apply to the “.com” version of a search engine, but PIPEDA can’t be applied outside this country.
“De-indexing is a means of providing an effective remedy to individuals for certain privacy harms, but it is not without challenges and is not a perfect remedy for all harms to online reputation,” says the report. “We have taken the position that PIPEDA requires organizations, including search engines, to assume accountability for their actions, and provide some challenge-type mechanism that individuals can resort to when challenging compliance with relevant principles.”
As for the right to have information removed from a Web site or made anonymous, the report argues principles in PIPEDA “imply that individuals should be provided the ability to remove information which they themselves have provided to an online forum that is involved in commercial activity,” for example, a social network or online forum. “For instance, individuals should be able to delete one or more social media posts without having to delete their entire account, and they should be able to do so independently, without having to make a request subject to the organization’s response,” says the draft report. Some sites already allow this.
If personal information about a person is provided by another PIPEDA doesn’t give the first person an unqualified right to have that information removed, the draft report argues. However, the law may allow information to be challenged for accuracy and appropriateness.
Comments on the report are due by April 19.
(NOTE: This story has been updated from the original to include comments from David Fraser)