Should Canada adopt its own version of the “right to be forgotten”? The Office of the Privacy Commissioner of Canada (OPC) recently concluded, in a Draft Position Paper, that such a right actually exists already. According to the OPC, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) gives individuals legal power to make search engines like Google de-list search results about them, and to make individual websites take down information.
In a Comment filed last week, I argued that this interpretation of PIPEDA will create far more problems than it solves – including Constitutional problems relating to freedom of expression. Longstanding Canadian defamation law and evolving privacy tort law already address situations in which one person is harmed by another person’s online speech. They provide nuanced, time-tested doctrines and precedent to balance one party’s reputational and privacy rights against another’s free expression rights – as well as the public’s right to access information. If these laws are not fit for purpose in today’s Internet environment, legislators can update them. But effectively setting them aside in favor of new and untested standards grounded in PIPEDA would be the wrong move.
PIPEDA developed as a legal tool for a very different problem: the management of data held and processed in commercial operations. That makes it a very useful law for a different set of Internet privacy issues – like Cambridge Analytica’s acquisition of Facebook user data. But PIPEDA wasn’t designed for regulating public speech and information, and it lacks adequate doctrinal tools to do so. It has no equivalent of the robust Constitutional and tort law precedent defining the boundaries between speech and privacy rights.
Applying PIPEDA to online speech mediated by Internet platforms like Google or Facebook also creates new problems. Some provisions in PIPEDA and other data protection laws can be literally impossible for platforms to comply with, or can lead to unintended consequences. Europe’s new General Data Protection Regulation (GDPR), for example, has provisions that would seemingly compel platforms to disclose online speakers’ own personal information. Legal glitches like this are inevitable when a law designed for databases is repurposed to govern poems, blog posts, jokes, and citizen journalism put online by individual Internet users.
The OPC’s proposal also, troublingly, moves important legal decisions about individual Constitutional rights out of the hands of courts and public institutions, and into non-transparent private “notice-and-takedown” processes. This shift goes against the strong recommendations of human rights officials and civil society organizations around the world. Platform notice-and-takedown systems have a well-documented tendency to silence more speech than the law actually requires, because honoring even dubious legal allegations is the easiest course for risk-averse private platforms. Standard measures to counter this include notifying affected speakers and giving them the opportunity to “appeal” a platform’s decision. But the OPC recommends against even this modest corrective measure. That seems to leave no remedy for online publishers harmed by wrongful removal or de-listing.
These problems are significant when search engines de-index results, preventing users from finding information when they search for a person by name. Predictable errors in companies private “adjudication” process can keep us from discovering important information about anyone from corrupt politicians to dishonest accountants or mechanics. The threat to expression and information rights is significantly worse when information is, as OPC suggests, removed “at its source” online. In that situation, the information can disappear completely from the web. The open questions about OPC’s remove-at-the-source proposal are significant enough that I’ve listed them in a separate blog post, here.
A final issue raised by OPC’s proposal has to do with the allocation of power within Canada’s federal system of government. Canadian provinces have historically held legal authority over what a Parliamentary Committee called “reputational damage that occurs within the framework of personal relationships.” Expanding PIPEDA to govern individual communications posted to the Internet changes that. It effectively federalizes the kinds of disputes previously resolved by individual provinces.
As discussed in the Comment, and in my previous work on the “right to be forgotten” under the GDPR and under the Inter American Human Rights framework, there are better options. The OPC and lawmakers should not rush to remake PIPEDA as the law governing online speech.