The right to be forgotten, which opens the door to public requests for the removal of search results that are "inadequate, irrelevant or no longer relevant", has been among the world's most controversial privacy issues since it was first established in Europe in 2014. The new right responds to concerns with potential reputational harms from inaccurate or misleading information online, but faces the challenge of balancing privacy protections with the benefits of the internet for access to information and freedom of expression.
The Privacy Commissioner of Canada waded into the debate on Friday with a new draft report concluding that Canadian privacy law can be interpreted to include a right to de-index search results with respect to a person's name that are inaccurate, incomplete, or outdated. The report, which arises from a 2016 consultation on online reputation, sets the stage for potential de-indexing requests in Canada and complaints to the Privacy Commissioner should search engines refuse to comply.
The commissioner envisions a system that would allow Canadians to file de-indexing requests with leading search engines, who would be required to evaluate the merits of the claim and, where appropriate, remove the link from the search index or lower its rank to obscure the search result. Moreover, the commissioner would require search engines to actively block Canadians from accessing the offending links by using geo-identifying technologies to limit access in Canada to the results.
Read more: Canada's privacy czar rules on right to dispute online search results
There is a need to address the risks associated with online reputation, but the Privacy Commissioner's proposal raises a plethora of concerns.
First, the claim that existing law includes a right to de-index search results stands on shaky ground. In addition to the broader questions regarding its consistency with freedom-of-expression protections under the Charter of Rights and Freedoms, there is reason to doubt whether the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to search results.
Federal privacy law is limited to commercial activity, yet search results are typically provided at no cost to the user nor the sites being indexed. Indeed, all the activity behind search – indexing content, developing algorithms to identify relevant results, and the display of those results – fall outside a conventional commercial transaction. There may be paid results or other advertising displayed with some search results, but those are arguably secondary to the indexing, ranking, and display of the relevant links.
Second, the report's conclusions stand at odds with the majority of responses generated by the Privacy Commissioner's consultation. The feedback from leading internet services, media companies (including The Globe and Mail), academics, and civil society groups cautioned against creating a right to be forgotten in Canada. Without a foundation for its approach arising from the consultation, participants can be forgiven for wondering whether the report's recommendations were a foregone conclusion.
Even if the report can be justified as consistent with existing privacy law, the proposed approach features a remarkable level of micro-managing of search engine activity. The de-indexing right is limited solely to search results for a specific name, meaning that alternate searches will not be affected. For example, an embarrassing court decision might be blocked for a person's name, but parallel searches for facts arising from the case would not.
The report also suggests that rather than de-indexing a link, search engines might instead be asked to lower the rank of a search result or flag the result as inaccurate or incomplete. This would vest editorial power in search engines they have generally been reluctant to assume. While algorithmic decision-making is far from neutral and deserves greater scrutiny, using privacy law to justify intentionally obscuring results by lowering ranks transforms information intermediaries into knowledgeable publishers.
Once the revised search results are developed, the report has further recommendations on who can access them, calling on search engines to use geo-identifying technologies to block access in Canada to offending links. Mandated use of blocking technologies as well as a parallel recommendation for a notice-and-takedown system for content that is not found under current Canadian law represents a dramatic departure from the existing internet rules of the road. These forms of regulation cannot simply be read into PIPEDA by the Privacy Commissioner, but rather should require careful review and legislative reforms by Parliament.
Perhaps most troubling is that the report empowers search engines to play the role of judge and jury over the relevance and harm associated with links to content.
Companies such as Google have attracted increasing concern over their ubiquitous role in how we access information. If implemented, the Privacy Commissioner's report would troublingly expand that role by granting internet giants the power to determine upon request whether a search result is incomplete or outdated as well as whether it should be de-indexed, lowered in ranking, or flagged as incomplete.
In the search for a solution to online reputational harm, the proposal creates more problems than it solves.
Michael Geist holds the Canada Research Chair in internet and e-commerce law at the University of Ottawa, Faculty of Law. He can be reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.