Organizations should make it easier for ordinary people to control online information about themselves to protect their reputations from being permanently damaged, a privacy conference has been told.
Avner Levin, chairman of the law and business department at the Ryerson University’s Ted Rogers School of Business, praised Google’s online tool that allows people in Europe to request the search engine de-list certain links to their names under the so-called right to be forgotten.
“I think role of the [privacy] regulator is to work together with companies to find [similar] innovative solutions that are easy, cheap readily available for Canadians.” Levin told a conference of the Canadian branch of the International Association of Privacy Professionals in Toronto on Thursday.
“It’s one example of the role that companies can play when it comes to finding the balance between giving individuals control over their personal information and other rights. There is a role for the private sector to play and there is a role for the regulator, which is to push for those partnerships and find those kinds of solutions.”
That was echoed by Vance Lockton, a senior advisor for stakeholder relations at the federal Privacy Commissioner’s office. “I’m advocating the need for a tool that allows Canadians more control over shaping their online reputation.”
“It’s a particularly important issue for us,” he said, because people often turn to the commission to complain about damaging or old information about them that pops up in Internet searches. “We don’t have a terribly good answer for them right now” because the Personal Information Protection and Electronic Documents Act (PIPEDA), which the OPC enforces, may not be helpful. PIPEDA only covers commercial Web sites. Individuals who post information in their personal capacity are not covered by private sector privacy laws. And if the offending site is in another country the OPC’s hands are tied.
In some cases people understand information can’t be removed from the Internet — for example court decisions. But what they object to is older decisions being the first returns when their name is searched, which can affect
On the one hand the Charter of Rights identifies freedom of the press and freedom of expression within certain limits. On the other hand the right to be forgotten hasn’t been recognized in law here. And there are problems if the Web site is located outside Canada, as in a frustrating case involving a the OPC and a Romanian legal Web site, Globe24H (see here for background)
As the federal privacy commission outlined earlier this year in a consultation paper on what organizations should consider, online reputation involves a wide range of things – defamation, unproven gossip, phony comments attributed to a person, cyber bullying, unapproved use of personal photos news stories and divorce decisions with sordid details to name a few.
Organizations that publicly post personal data include news sites (who usually refuse to remove factually true articles or links), public social media sites (who, like Google and Facebook, are more obliging), content providers, private or semi-private social media sites (for a wide range of groups or enthusiasts including dating or so-called shaming sites) and regulators.
For example, one of those attending the conference was a counsel at the Ontario Securities Commission, who said in an interview the regulator increasingly gets requests from individuals named in posted decisions to have those rulings taken down after several years. Their argument, he said, is they have paid their fine or penalty and want to move on. So far, he said the OSC has refused all requests.
But those victimized, the privacy commission report notes, are also people like a teacher in the United States who was fired for posting a photo of herself on vacation holding a glass of wine in one hand and a beer in the other.
It’s a byproduct of the Internet that information – like a mention in a news article — which was once hard to find is now stored online forever.
The OPC consultation paper notes that regulators in Ontario and B.C. have warned employers that using social media for background checks may be a violation of provincial statutes that prohibit the collection and use of certain types of personal information.
Levin argued that merely because a factually true piece of information is on the Web doesn’t mean a person has relinquished control over what happens to it.
Canadian law has no right to be forgotten or erasure of information. However, under PIPEDA, individuals do have the right to access and to ask for corrections to personal information a commercial organization may have collected about them – but the act doesn’t apply to non-commercial sites.
Lockton said the federal privacy commission tries to first help complainants request a poster to delete information before the agency itself gets involved. Even then, if the site is offshore its power is limited to trying to negotiate a solution – if the owner of the site can be found.
But the commission has been frustrated dealing with a Romanian-based site called Globe24h, which republishes court decisions from a Canadian legal Web site. The Canadian site doesn’t index its articles to limit the privacy impact on individuals, so they won’t appear high in online searches. However Globe24h indexes them. As a result dozens of people have complained to the Office of the Federal Privacy Commissioner (OPC).
Initially, Globe24h removed some 27 cases. Lockton said, but since then has ignored the commission, including a recommended it delete Canadians case that involve personal information.
There may be other solutions, Lockton suggested. For example, he asked, do Canadian judges have to include the names of participants in family law cases? Ironically, he added Globe24h told the OPC that Romanian courts remove the names of individuals in certain court documents.
Levin and Lockton were on a panel on online reputation, along with Kevin Chan, head of public policy Facebook Canada. Chan noted that Facebook has a number of tools allowing subscribers to to control who they’re sharing posts with, what they’re sharing and the ability to retroactively change a posting. Facebook will also take down offensive material such as threats or hate material.
But he also suggested the onus is on individuals. “What can various institutional players do? We can help – whether it’s companies or NGOs or governments or regulators — but at the end of the day what we want to to achieve is not just compliance with some law or rule, but (for people to) realize this is not actually good. This kind of behaviour is fundamentally corrosive.”