Grappling with the right to be forgotten

Justin Trudeau’s minority government has a lot on its mind this year — passing the revamped NAFTA treaty, amending the medically assisted dying law and dodging an early election, just for starters.

Somewhere in that to-do list is a vague plan to update privacy law. It’s buried in the mandate letters issued to Innovation, Science and Industry Minister Navdeep Bains and Heritage Minister Steven Guilbeault after the fall election. The letters instruct them to “establish a new set of online rights,” including “the ability to withdraw, remove and erase basic personal data from a platform.”

To many people working in privacy law, that looks like a pitch to establish a “right to be forgotten” (RTBF for short) in Canadian law. Ministerial mandate letters are aspirational, like campaign platforms. But RTBF is still deeply controversial in some quarters — and some argue the government may be getting ahead of itself.

RTBF is relatively new. In 2014, the EU’s Court of Justice upheld a privacy regulator’s decision to order Google to delete extant links to an old article about a Spanish lawyer whose property was auctioned off to pay debts. The court concluded the article was no longer relevant, and its subject had a right not to be associated with it online — a right to be “forgotten.”

In 2018, Canada’s Office of the Privacy Commissioner released a draft position paper embracing both approaches to RTBF: “de-indexing” — which removes inaccurate or outdated personal information from a search engine’s results without deleting it — and “source takedown,” which erases the source material itself.

The Personal Information and Protection of Electronic Documents Act (PIPEDA) gives Canadians the right to “challenge the accuracy and completeness” of personal information collected about them, and to demand that organizations collecting that information amend or delete it if it’s found to be inaccurate or incomplete. PIPEDA applies only to commercial transactions; Google argues that since the search engine function is free to use — and is merely acting as a conduit between publishers and their audience — it isn’t commercial. Google also argues the law’s exception covers the search function for journalism.

The OPC referred the question of the search function’s commercial status to the Federal Court. We’re still waiting for that decision.

And that’s where things stood until the mandate letters were issued. A request to the government for clarification for this article went unanswered. Chantal Bernier of Dentons, who served as interim privacy commissioner from 2013 to 2014, said the Trudeau government may be keeping the wording in the mandate letters blurry for a reason.

“I used to write mandate letters myself, and I think the wording used here indicates a direction more than anything else,” she said. “I don’t read this language as more aggressive or less aggressive than the (European example). I see it as the government leaving itself some latitude for policy development.”

Privacy lawyer Timothy M. Banks said the wording suggests something short of RTBF — something that would affect personal information on platforms but not search engines themselves, which are the subject of the Federal Court reference.

“It seems to me the government is signaling here they don’t want to go after data analytics — they just want people to be able to remove personal data,” he said. “It’s an approach that recognizes a lot of businesses depend on their ability to analyze that data.”

David Fraser, who’s representing Google in the reference case, said the federal government should wait for the reference decision before making plans to implement RTBF.

“My personal view is that I don’t think you’re ever going to see a RTBF law in Canada that’s consistent with the Charter of Rights,” he said, citing the likely conflict between a RTBF and the Charter right to free expression. “In Europe, privacy is an explicit constitutional right. But it’s not in the Canadian Constitution, even though the Supreme Court has described our privacy statutes as a quasi-constitutional… I expect you’re going to see a lot more consultation by the government on these issues. You may think it’s been studied to death, but this is clearly premature.”

Fraser said there’s another shoe still to drop: the European Union is expected to review Canada’s existing privacy laws soon, to decide whether it will continue permitting free data exchanges between Canada and Europe.

“I think we would be well advised to wait until we have this important input before we start tinkering with our law.”

Even if the Trudeau government is bent on getting a RTBF law through a minority Parliament, it has more to worry about than just the outcome of the court reference. Michael Geist, Canada Research Chair in Internet and E-Commerce Law at the University of Ottawa, said Europe’s introduction of RTBF opened the floodgates to a massive number of applications for de-indexing.

“Google’s own numbers show there have been a very large number of requests, and a lot of them are apparently not legitimate. So that’s one thing we know about a RTBF law in Canada — it would be widely used,” he said.

“To have a large number of requests for de-indexing information that is otherwise accurate and lawful? That would be tested in the courts, obviously.”

In fact, it’s hard to imagine a single legal reform that would be tested more, and more often, than RTBF would be upon its introduction. Alexis Kerr of Norton Rose Fulbright wonders how such a law would avoid edging into provincial jurisdiction.

“Who’s got the power to act in this space?” she said. “The provinces are responsible for setting the age of majority, for example. The government is going to have to tread lightly to avoid stepping on the provinces’ jurisdiction.

“Here’s another complicating factor. PIPEDA regulates the collection of personal information in the context of commercial activity. In many cases, RTBF claims do not implicate commercial activity — they implicate private actors.

“The question has to be raised — is this entirely a privacy issue? Does it not have something to do with inappropriate uses of private information? And might there not be better tools to address it, such as human rights complaints?

“I’m sure there will be more public consultations, and there should be. We have to be wary of unintended consequences.”