The European Union shook up the privacy world in 2014 with the creation of "the right to be forgotten," creating a system that allows people to seek the removal of search results from Google that are "inadequate, irrelevant or no longer relevant." The system does not result in the removal of the actual content, but rather makes it more difficult to find in light of the near-universal reliance on search engines to locate information online.
Since the European decision, Google has received nearly 700,000 requests for the removal of links from its search database resulting in the evaluation of 1.8 million URLs. Moreover, privacy authorities in Europe – led by France's national regulator – have adopted an aggressive approach on the right to be forgotten, ruling that the link removal should be applied on a global basis.
While the Canadian courts have grappled with the question of removing links from the Google search database (a key case on the issue is awaiting a decision from the Supreme Court of Canada), there has been little sense that Canada would establish its own right to be forgotten. That may have changed last week as the Federal Court of Canada issued a landmark ruling that paves the way for a Canadian version of the right to be forgotten that would allow courts to issue orders with the removal of Google search results on a global basis very much in mind.
The case – A.T. v. Globe24H.com – involves a Romanian-based website that downloaded thousands of Canadian judicial and tribunal decisions, posted them online and demanded fees for their swift removal. The decisions are all public documents and available through the Canadian Legal Information Institute (CanLII), a website maintained by the legal profession in support of open access to legal materials (I am a former board member).
Since most decisions on CanLII are not indexed in Google, their availability is not widely known and their content does not typically come up in search queries. Globe24H.com opened its database to Google, however, leading to the discovery of the decisions for many for the first time. When users contacted the site, they were told that a "free" removal service could take six months or more. If they paid for the removal, the content was quickly deleted without issue.
The Privacy Commissioner of Canada received dozens of complaints about the website and issued a report in June, 2015, that it violated Canadian privacy law. The case moved to the federal court, which agreed with the Privacy Commissioner's privacy findings, but was left with the question of whether it could do anything about it.
The court first ruled that it was entitled to assert jurisdiction over the foreign website, noting that the courts have applied Canadian privacy law to foreign organizations for many years. Given the connections to Canada, it ruled that it met the "real and substantial connection" standard required under the law.
Yet even if Canadian law could be applied to the site, enforcing the ruling posed a more difficult challenge. The court concluded that it could issue an order both requiring the site to comply with the law and declaring that it was currently violating it. The declaratory order was expressly adopted with Google in mind.
The court noted that the declaration could be used to submit a request to Google seeking the removal of the offending links from its search database. While acknowledging that there was no guarantee that Google would act, it was persuaded by the Privacy Commissioner that "this may be the most practical and effective way of mitigating the harm caused to individuals since the respondent is located in Romania with no known assets."
In doing so, the court may have created the equivalent of a Canadian right to be forgotten and opened up an important debate on the jurisdictional reach of privacy law as well as on striking the balance between privacy and freedom of expression. While more onerous than a direct request to Google, the court's approach suggests there is now a road map for the global removal of search results of content that may be factually correct, but which also implicates the privacy rights of individuals.