1 February 2018
The Office of the Privacy Commissioner of Canada (‘OPC’) released, on 26 January 2018, its draft position on online reputation (‘the Draft Position’), i.e. the right to be forgotten (‘RTBF’), in which it analysed existing obligations, and proposed new duties, on search engines and social media networks to remove content relating to individuals’ personal data posted online at their request (‘the Draft Position’). The Draft Position follows a public consultation in January 2016 addressing the existence of, and possible amendments to, such rights under Canadian law, including the Personal Information Protection and Electronic Documents Act (S.C., 2000, c. 5) (‘PIPEDA’). In particular, the OPC discussed both PIPEDA’s existing statutory principles that could constitute such a right, and the factors relevant in assessing whether the indexing or listing of the content was for a ‘reasonable purpose’ under Section 5(3) of PIPEDA.
Alex Cameron and Antoine Guilmain, Partner and Associate respectively at Fasken Martineau DuMoulin LLP, told DataGuidance, “In Canada, search engines are generally regarded as neutral information intermediaries, not publishers, and are not required to monitor the information they transmit or store. However, PIPEDA requires organisations who control the posting of personal information on the internet in the course of their commercial activities to permit the withdrawal of consent, to maintain accurate information and to retain personal information only as long as necessary for identified purposes. In this way, PIPEDA strikes a balance between facilitating search engine operations while ensuring that individuals have rights in relation to their information on the internet. One could argue that these principles under PIPEDA already contain somewhat of a RTBF, through the abovementioned principles. The principles have proven their worth over time and should continue to be cornerstones of Canada’s privacy laws.”
More involved removal of information, such as information posted by other users would be expected to be much more complex
According to the OPC, the search engine should be required to remove the links to content from its search results once requested to do so by an individual, where, cumulatively, the indexed content about was unlawfully published, such as by being defamatory or violating copyright law; and the accessibility of the information may cause significant harm to the individual, and the harm, considering its magnitude and likelihood of occurrence, outweighs any public interest. In making such an assessment, the OPC also outlined that, in the case of children or youth, considerations should typically weigh more heavily in favour of de-indexing or removing the content. As such, the OPC called on Parliament to create a legal right for young people to request and obtain the deletion of information they have themselves posted on social media.
Cameron and Guilmain concluded, “Individuals have the right to withdraw consent and organisations should only retain personal information for as long as necessary, subject to legal or contractual restrictions, and to the extent that this is technically feasible. As such, implementing account deletion requests would be expected to be feasible [for social media networks] in many cases. However, [as suggested by the OPC], more involved removal of information, such as information posted by other users, would be expected to be much more complex and involve the consideration of third party rights and interests.”
After a consultation on the Draft Position, the OPC will be developing an action plan that will put its proposed measures into practice.
Kaveh Lahooti | Privacy Analyst