Canadian Government Leaning Towards A Right To Be Forgotten It Can Enforce Anywhere In The World

Privacy

from the I-for-one-welcome-our-new-Canadian-overlords dept

It looks as though the “Right to Be Forgotten” will be crossing the Atlantic and setting up shop just north of the United States. The Canadian Privacy Commissioner has already stated existing Canadian privacy laws allow for this, but there’s been no statutory adoption of the Commissioner’s theory.

The idea that Canadians should join their European counterparts in being able to selectively erase personal information continues to be pushed by the Privacy Commissioner. Speaking at a recent conference in Toronto, Privacy Commissioner Daniel Therrien reiterated his belief Canadians should be offered this dubious “right.”

Therrien said he continues to support the concept of “the right to be forgotten” — which has been adopted in other jurisdictions through the European Union’s General Data Protection Regulation.

“[I]nformation about individuals is much easier to find with the internet, thanks to search engines and other functions. The information that is found will often be taken out of context. It is easily replicable and is very difficult to delete,” said Therrien.

“All to say that information that went to reputation before the internet, that may be information known to a small circle of people, with the internet, is now potentially known to many, many people. Out of context, that information may be inaccurate and, moreover, may create real consequences for people. Reputation matters.”

Reputation does matter. That’s the problem with the RTBF. While there are legitimate uses, there are also plenty of people willing to abuse it to obtain an unearned reputation. Fortunately, this abuse is routinely called out by press outlets hit with RTBF requests to delete unfavorable coverage or criticism.

The Privacy Commissioner’s pitch continues and the Canadian Parliament seems amenable to the idea. The committee handling privacy, information access, and ethics has issued a report nudging the Canadian government towards the adoption of the Right to Be Forgotten. But its conclusions are somewhat contrary to the Privacy Commissioner’s assertions. The committee likes the idea but points out these protections are not built into Canada’s existing privacy laws.

The Committee’s first finding in this regard was that when online reputational damage occurs in the context of personal relationships rather than commercial transactions, PIPEDA does not apply (since the latter only applies to the collection, use and disclosure of personal information in a commercial context).   Moreover, the Committee noted that the Criminal Code treats a number of related offences, such as regards the publication of intimate images without consent. Accordingly, the Committee clarified that the scope of their analysis was limited to the protection of privacy and online reputation in the context of commercial transactions.

With this, the committee appears to believe it can amend PIPEDA to include a “right to be forgotten,” but one more expansive than the European model. According to this, it would appear to cover things like revenge porn.

As regards the right to erasure, the Committee noted that PIPEDA does not expressly contain such a right, although the principles of “consent”, “limited retention” and “accuracy” may be applied in some instances to give effect to a limited right of erasure in certain circumstances.

For example, according to Principle 4.3.8 of Schedule 1 to PIPEDA, an individual has the right to withdraw consent to the collection, use and disclosure of his/her personal information. If this is then combined with the limited retention principle, pursuant to which an organization may only retain personal information for so long as it is necessary for the fulfilment of the purposes for which it was collected, then (in some circumstances) an individual may successfully argue that, upon withdrawal of their consent, the organisation that holds their information should destroy it.

[…]

In this context, several of the Committee witnesses argued that PIPEDA should be amended to create a more comprehensive right of erasure (to address situations of cyberbullying or revenge porn, for example) that would be similar in scope to the right of erasure found in the GDPR.

It’s not that revenge porn and cyberbullying should be ignored. It’s more of a question whether amending the law will fix the problem without a lot of collateral damage. Fortunately, some of the committee members have expressed this exact concern, noting the potential PIPEDA amendments would likely adversely affect Canadian freedom of expression.

Unfortunately, there’s a larger problem that’s not discussed in the report: the recent Equustek decision. In this lawsuit, Canada’s top court declared delisting orders issued in Canada were valid worldwide. Google challenged this decision in the US (Equustek did not make an appearance), obtaining a judgment finding the Canadian decision could not be applied extraterritorially. The committee believes the ruling could be read as covering personal information, not just trade secrets (which were central to the Equustek case). It also appears to indicate that any delisting requests can be enforced worldwide, no matter where the recipient of the order resides.

Further, the committee apparently believes the tech companies that will be delisting info aren’t properly equipped to evaluate the public’s interest in removal/non-removal when handling requests. This suggests the Canadian government may take a more hands-on approach if it decides to create a Right to Be Forgotten. Fortunately, some of the committee comments suggest they fear over-compliance rather than under-compliance, which may mean the Canadian government’s involvement may actually include policing requests for abuse of the law.

Even with these cautionary comments, the concern remains that Canada will create its own version of RTBF, but with the added nasty side effect of the nation’s highest court declaring orders issued in Canada must be executed by companies located in other countries. The committee’s report [PDF] spends no time discussing this unfortunate ruling or its adverse effects if the world’s tech companies are subjected to extraterritorial delisting orders. But that’s what will happen if PIPEDA is amended: Canada will be giving its citizens the opportunity to engage in worldwide censorship.

Filed Under: canada, right to be forgotten