What the Private Sector Should Not Forget About the Right To Be Forgotten

In Gabriel García Márquez’s literary classic, One Hundred Years of Solitude, the fictional town of Macondo is hit by a deadly insomnia plague that causes its denizens to lose their memory. They forget names, notions – even the identities of people and the awareness of their own being. To counter the memory loss, they mark animals, plants and objects with their respective names. But they would soon forget their intended use, so they hang descriptive signs like this: “This is the cow. She must be milked every morning so that she will produce milk, and the milk must be boiled in order to be mixed with coffee to make coffee and milk.” When that too fails, the founder and patriarch of Macondo, José Arcadio Buendía, builds a “memory machine” – a primitive computer, if you will – that has 14,000 manual entries.

Macondo’s inhabitants are cured of memory loss after a gypsy, Melquíades, administers José Arcadio Buendía a coloured drink. Back to noticing and remembering things, José Arcadio Buendía realizes the absurdity of his living room, where objects were labelled and walls had “solemn nonsense” written on them.

Today’s internet is, among other things, an advanced memory machine and modern-day living room of José Arcadio Buendía where information – both warranted and not, accurate and otherwise – is conspicuously and indefinitely imaged or inscribed. When that information is personal or sensitive in nature and also outdated, inaccurate or incomplete, it may have damning and damaging consequences for the subject. From this stems the right under law in certain jurisdictions to “erasure” or “to be forgotten.”

Latest Case Law in Europe

On December 8, 2022, the European Court of Justice, in TU, RE v. Google LLC, Case C-460/20 (“TU, RE case”), ruled that Google and other search engine operators must, on request, remove “manifestly inaccurate” information referenced in their search results. The person requesting the removal must establish manifest inaccuracy through evidence that can reasonably be required of him or her to try to find. Such evidence need not be a judicial decision against the publisher of the website or even a decision made in interim proceedings.

The decision arose from a request by the German Federal Court of Justice for a preliminary ruling concerning relevant provisions of Article 17 of Europe’s General Data Protection Regulation (“GDPR”) that governs the right to erasure, and the directive on the protection of individuals with respect to the processing of personal data, read in light of the Charter of Fundamental Rights of the European Union. The proceeding before the German court involved a dispute between two managers of a group of investment companies on one side, and Google on the other. The former requested the latter to de-reference links to articles and thumbnail photos of the managers that showed up on a search of their names and images. The articles criticized the group’s investment models. Google refused to comply with the request, referring to the professional context in which the articles and thumbnail images were set, and pled unawareness of the alleged inaccuracy of the information.

Evolution of the Right

The right had first been established by the European Court of Justice. In a landmark case in 2014, the court ruled that Google Spain must delete data that is “inadequate, irrelevant or no longer relevant” from its search results if a data subject requests it. The nature of grievance was similar to the TU, RE case. A Spanish resident complained to the Spanish Data Protection Authority in 2010 against a Spanish newspaper and Google that the search engine’s results displayed announcements in the newspaper dating back to 1998 in relation to debt recovery and property attachment proceedings against him. He argued that the matter had been fully resolved years ago and its reference was entirely irrelevant.

The court decided that the right to be forgotten was implied in the provisions of Directive 95/46/EC (“Directive”; the predecessor law to the GDPR), namely, the data subject’s right to rectification, erasure or blocking of data where the processing does not comply with the Directive, and the right to object to the processing of personal data on compelling legitimate grounds.

Subsequently, in May 2018, the GDPR took effect. Article 17 of the GDPR outlines specific situations where the right to be forgotten applies. These include when the data is no longer necessary for the purpose for which it was collected or processed, when an individual withdraws consent, when there is no overriding legitimate interest to process the data, etc. The right to be forgotten can be trumped by exercise of the right to freedom of expression, for compliance with a legal ruling or obligation, in the public interest, for public health purposes, etc.

The Law in Canada

Public Consultation

The right to be forgotten under Canadian law has had a rather checkered history. In 2015, the Office of the Privacy Commissioner of Canada (“OPCC”) named “Reputation and Privacy” as one of its strategic privacy priorities for 2015-2020. In furtherance of this, in January 2016, the OPCC launched a public consultation and call for essays on online reputation. This was followed by the release of a draft position paper on online reputation (“Position Paper”) in January 2018 in which the OPCC held that the Personal Information Protection and Electronic Documents Act (“PIPEDA”) – the Canadian federal law that governs how private sector organizations collect, use and disclose personal information in the course of commercial activities – applies to a search engine’s indexing of online content and display of search results. “Organization,” as defined in PIPEDA, includes an association, a partnership, a person, and a trade union.

Indexing refers to a search engine’s organization of information on websites or web pages to make it available in search results. The Position Paper noted that by indexing web pages containing personal information and displaying them in search results, search engines collect, use and disclose such information within the framework of PIPEDA. The OPCC also advocated the right of individuals to request de-indexing of their information from the search results (but not the internet) and source takedown (removal of information from the source database).

Reference re Subsection 18.3(1) of the Federal Courts Act, 2021 FC 723 (“Reference case”)

In October 2018, the OPCC referred two questions to the Federal Court of Canada, namely:

1. Does Google’s search engine, collect, use or disclose personal information in the course of commercial activities within the meaning of section 4(1)(a) of PIPEDA when it indexes web pages and displays search results in response to searches of an individual’s name?
2. Is Google’s search engine excluded from the application of PIPEDA by virtue of section 4(2)(c) because it is solely for journalistic, artistic or literary purposes?

The reference had its genesis in a complaint to the OPCC that Google contravened PIPEDA by displaying links to news articles containing the complainant’s sensitive personal information, in response to a search of his name. The complainant believed that the information was inaccurate and outdated, and caused him direct harm, including physical assault, social stigma and lost employment opportunities. Google declined the complainant’s request to remove the links, following which the OPCC notified Google of the complaint.

On the first question, Google agreed that it collects, uses and discloses personal information by indexing and displaying search results in the course of commercial activities, as contemplated by PIPEDA. But it argued that as an online intermediary, it merely conveys content published by third parties to users of the search engine. The Federal Court rejected this position. The court held, even though the use of Google’s search engine is free for both content providers and users of the search engine, that it has “flagrant commercial interest in connecting these two players.” In exchange for the information displayed in search results, the users provide personal information such as location, preferences, interests, consumption patterns, etc. This information is utilized for profit, evident in the search engine giant’s annual multibillion-dollar advertising revenue.

On the second question, the court agreed that Google facilitates access to news media, associated with “publishing” information. However, it makes the search results “universally accessible,” which goes well beyond journalistically reporting to a community. Secondly, it neither creates nor controls the content of the search results. There is also no effort on the part of Google to determine the fairness or the accuracy of the search results. As a result, Associate Chief Justice Jocelyne Gagné held that the operation of Google search engine does not satisfy the definition of journalism introduced by the same court in 2017, in AT v. Globe24h.com, 2017 FC 114 (“Globe24h case”).

Notably, the Federal Court declined to rule on Google’s submission that the requirement to delist search results is contrary to the freedom of expression enshrined in the Canadian Charter of Rights and Freedoms (“Charter”). The court cited lack of adequate evidentiary record to address constitutional issues. The court also found Google’s argument circular – for PIPEDA to infringe Google’s Charter rights, the Charter must first apply to it.

What the Private Sector in Canada Should Not Forget

Obligations Under PIPEDA

The evolving jurisprudence in Canada has focused on search engine operations so far, but it applies to all private organizations that use, collect or disclose personal information within the framework of PIPEDA. For example, a former employee or a customer can request their personal information to be deleted from an organization’s systems and records. The Reference case is a clear indication of the direction Canadian courts are heading to establish individuals’ right to be forgotten.

PIPEDA does not provide a right to erasure like the GDPR does, but individuals can invoke the principles of accuracy (principle 4.6 of Schedule 1) and appropriateness (subsection 5(3)). The accuracy principle requires personal information to be “accurate, complete, and up-to-date as is necessary for the purposes for which it is used.” This is a contextual determination that accounts for the interests of the individual who has the right to challenge the accuracy and completeness of their information, and have it amended by the concerned organization. Certainly, old and outdated information that is no longer true or reflective of a person’s current situation can hardly be claimed to be “accurate, complete, and up-to-date.”

The appropriateness principle states that an organization may collect, use or disclose personal information only for the purposes that a “reasonable person would consider are appropriate under the circumstances.” For example, information that causes significant harm to the individual may fail this principle. “Significant harm” is defined in section 10(7) of PIPEDA as including “bodily harm, humiliation, damages to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.”

A balancing provision in PIPEDA is section 20(2) that empowers the OPCC to make information public in consideration of the public interest.

Consumer Privacy Protection Act

Importantly, the upcoming Consumer Privacy Protection Act (“CPPA”), set to replace Part 1 of PIPEDA and introduced by the Digital Charter Implementation Act, 2022, provides an individual, under section 55(1), with a right to request an organization to dispose of their personal information in three instances:

1. if such information was collected, used or disclosed in breach of the CPPA;
2. if the individual withdraws consent; or
3. if the information is no longer necessary for the organization’s continued provision of a product or service requested by the individual.

There are a number of exceptions under section 55(2) when an organization may refuse a request of disposal. They relate to non-severability of information, establishment of the organization’s legal defence or exercise of legal remedies, other requirements under law, etc. The OPCC will oversee compliance with the CPPA through compliance orders, audits and investigations, and will have powers to impose significant administrative monetary penalties on organizations violating its provisions.

Once the CPPA becomes law, individuals will have a near-absolute right to control and decide if, when and how an organization should hold and use their personal information.

Extra-Territorial Application of GDPR

The GDPR, by virtue of Article 3, can have extra-territorial application on Canadian organizations. It, of course, applies to Canadian companies that have affiliates, branches or employees in the European Union (“EU”), and process personal information in the EU, either directly or through third parties. If EU data subjects’ personal information is processed, the GDPR will apply irrespective of where the processing occurs.

That is not all. A Canadian company that has no affiliates, branches or employees in the EU, but controls or processes personal information of data subjects residing in the EU in relation to its provision of goods or services to such subjects, or monitors their behaviour in the EU, is also bound by the GDPR. For example, a Canadian company that uses cookies, tracking pixels or web bugs to monitor activities of EU data subjects on its websites or mobile applications would be bound by the GDPR.

What this means is that, among other provisions, the right to erasure in the GDPR, as well as EU judgments that interpret it, can apply to Canadian companies if certain criteria are met. It is critical for Canadian companies to determine with precision the context and scope of their business activities in this regard.

Constitutional Challenge on the Horizon?

The Federal Court did not address the Charter question in the Reference case. But, in addition to the possibilities of an appeal by Google, a challenge to the application of PIPEDA or the CPPA (which retains the exceptions of journalistic, artistic or literary purposes) on constitutional grounds – for impeding the freedom of expression – cannot be ruled out in the future.

In the Reference case, the Canadian Broadcasting Corporation/Société Radio-Canada, as an intervener, largely followed Google’s position except for an important nuance. It argued that if the content of the search results is the “work-product” of a “recognized news media,” the exemption from PIPEDA of journalistic purpose should apply. The public broadcaster urged the court to apply the test of journalism laid down in the Globe24h case if the work-product does not come from recognized news media (like Google, which is not considered a mainstream news medium). This means that the court should determine if Google’s search results are journalistic with respect to the personal information contained in such results.

This is a moot question that mainstream news media would want to see answered by the courts in their favour, particularly because search engines like Google play a huge intermediary role in the dissemination of news to consumers.

Bottom Line

In summary, the “right to be forgotten” is tricky in Canada. It exists, but may not always be enforced or enforceable. Businesses need to carefully consider the impact of not responding positively to a request for removal of personal information from a database.