Taking Information Down from Source Websites Under Data Protection Law

Should Canada adopt its own version of the “right to be forgotten”? The Office of the Privacy Commissioner of Canada (OPC) recently said that such a right actually exists already under the Personal Information Protection and Electronic Documents Act (PIPEDA). In a Comment filed with the Office of the Privacy Commissioner (OPC) last week, I argued that using PIPEDA and similar laws to regulate online expression would be a mistake. The Comment raised concerns, summarized here, about abandoning existing legal doctrines that have evolved over time to balance privacy and free expression; putting important and delicate new legal questions in the hands of private technology companies; and federalizing an area of law previously governed by individual Canadian provinces.

The Comment also responded to a particularly unclear portion of the OPC’s recommendation, which indicates that the Personal Information Protection and Electronic Documents Act (PIPEDA) gives individuals legal power to make individual websites take down information. This goes well beyond the rights recognized by the European Court of Justice in its “right to be forgotten” case, and raises the following important questions, excerpted from the Comment and slightly modified for the Stanford CIS blog.

The implications of removing data from online sources vary depending on which sources are affected.

First, does the proposal apply directly to online publishers, such as the operator of a personal webpage about gardening, poetry, sports, or history? Presumably the answer turns in part on commerciality. Does such a site become “commercial” enough to fall under PIPEDA if it relies on advertisements, subscriptions, or online tip jars for support? Can some or all publishers claim exemptions based on “journalistic, artistic, or literary” use of information?

If “sources” regulated under PIPEDA are not publishers themselves, but only commercial hosts of third party content, other questions arise. Many publishers depend on web hosts like Amazon Web Services as infrastructure providers. Can individuals bring removal demands directly to these technical hosting services, and bypass the publisher? That would take a publisher’s ability to control and defend her own speech out of her hands – unless she assumed the expense and complexity of running her own server. Is the legal answer different if a publisher uses a more end-user-oriented hosting platform, such as Medium or Facebook?

How about consumer review sites like Yelp? Can waiters, mechanics, doctors, and accountants now remove negative reviews based on PIPEDA? Are consumer reviews protected as journalistic works? Does the answer depend on Yelp’s judgment about what criticisms are professionally relevant (slowness, rudeness, bad breath) as well as which factual claims are accurate?

Does a hosting service’s legal obligation vary depending on its size and capabilities? The OPC’s Position Paper states that users should be able to delete social media posts “independently, without having to make a request subject to the organization’s response.” Facebook or YouTube certainly have the means to provide such deletion tools. Many more modest businesses and websites that allow users to post comments, however, do not.  Must they stop permitting user comments? Similar questions arise with respect to small platforms’ investment in geoblocking technologies for regionalized legal compliance.



Add new comment