OPC position on online reputation: search engines must de-index privacy violating personal information

Are search engines subject to PIPEDA? Should they be required to de-index web pages such as when information about an individual is inaccurate, incomplete or outdated, ;or when the linked to information is illegal? Should search engines be subject to a notice and de-indexing or demotion regime? And, should search engines be required to geo-fence to ensure that search results containing personal information about Canadians that violates PIPEDA  is not made accessible in Canada regardless of which domain a Canadian searches on? In a Draft OPC Position on Online Reputation released yesterday in response to a public consultation, the answer to each of those questions was YES.

Issues related to what has been called the “right to be forgotten” have been debated, at least since the ground breaking decision of the European Court of Justice in Google Spain SL, Google Inc v Agencia Espanola de Protecciób de Datos, Mario Costeja González, C-131/12 [2014], CURIA. The OPC, however, incisively analyzed the issues and provided a cogently reasoned basis for enabling members of the public to protect their reputations by requiring search engines to de-index web pages containing personal information in appropriate cases. Importantly, the OPC’s positions are anchored in PIPEDA’s fundamental principles. Further, they build upon the recent decisions of the Federal Court in A.T. v. Globe24h.com, 2017 FC 114 and the Supreme Court of Canada in Google Inc. v. Equustek Solutions Inc., 2017 SCC 34 which confirmed the important role search engines should engage in to protect the public from illegal content on the Internet.

Key portions of the paper was summarized by the OPC ias follows:

Solutions

It is clear that Canadians need better tools to help them to protect their online reputation.

The OPC’s draft position highlights existing protections in Canada’s federal private sector privacy law, identifies potential legislative changes and proposes other solutions for consideration.

These measures include the right to ask search engines to de-index web pages that contain inaccurate, incomplete or outdated information; removal or amendment of information at the source; and education to help develop responsible, informed online citizens.

De-Indexing and Source Takedown

Two key mechanisms identified for enhancing one’s control over their online reputation – both of which can be found within PIPEDA – are de-indexing and source takedown.

De-indexing is the process by which a webpage, image or other online resource is removed from search engine results when an individual’s name is entered as the search term. Source takedown refers to the removal of the content from the internet.

With respect to de-indexing, the OPC is of the view that PIPEDA applies to a search engine’s indexing of online content and display of search results. As such, search engines must meet their obligations under the Act.

This includes allowing individuals to challenge the accuracy, completeness and currency (the extent to which the information is up-to-date) of results returned for searches on their name. Such challenges should be evaluated on a case-by-case basis, and decisions to remove links should take into account the right to freedom of expression and the public’s interest in the information remaining accessible. Additional detail, criteria and discussion about this mechanism are presented in the report.

If an individual is able to successfully challenge the search result based on the above, it should be de-indexed. However, lowering the ranking of a result or flagging a link or content as inaccurate or incomplete could be sufficient alternatives in some cases.

With respect to source takedown, PIPEDA provides individuals the right to withdraw consent, and requires that personal information that is no longer needed be destroyed, erased or made anonymous. Taken together, this implies that individuals should have the ability to remove information that they have posted online.

Where the personal information in question has been posted by others, individuals do not have an unqualified right to remove it. However, similar to de-indexing, individuals should be provided a mechanism by which they can challenge the accuracy, completeness and currency of the information and, where such a challenge is successful, to have the information corrected, deleted or augmented, as appropriate.

In either of the above cases, where matters cannot be resolved with a website or search engine, individuals may lodge a formal complaint with the OPC.

While, in combination, the abilities to request de-indexing and/or source takedown of information in certain circumstances are similar to the “Right to Erasure (Right to be Forgotten)” in the EU’s General Data Protection Regulation (GDPR), this paper does not import a European framework into Canada. Rather, it is an interpretation of current Canadian law, and the remedies related to online reputation that can be found therein.

In the course of expanding on these positions, the OPC made some very important observations.

Search engines must comply with PIPEDA

The OPC had little difficulty concluding that search engines were covered by PIPEDA because they collect, use, and disclose personal information in the course of commercial activities.

In our view, by indexing webpages containing personal information, and returning links to those pages in search results, search engines are collecting, using and disclosing personal information within the meaning of PIPEDA. When users search for information about an individual by name, search engines can create a detailed profile of all relevant information concerning that individual and return that information to the user. Search engines themselves acknowledge that their activities may involve personal information and they have policies to remove certain kinds of personal information, such as social insurance numbers, from their results.

Although most search engines are free, most also display advertisements alongside search results. The ability of search engines to sell this advertising space would not exist were it not for the search service they provide. The two functions have been described as “inextricably linked”.

Search engines are not neutral passive intermediaries

The OPC went on to elaborate on the role played by search engines. In the opinion of the OPC, search engines are not passive intermediaries. Rather, as authorities in other areas of the law such as defamation and intellectual property law outside of Canada have also found, they are active participants deciding what content to prioritize, demote, or de-index from search results.

For the analysis that follows, it is important to clarify the role of search engines. Search results do not simply and indiscriminately provide links to all web content associated with a search query. Rather, they are intended to provide users with results that a search engine considers most relevant to a user’s search query.

For instance, we note that:

Search results will often differ between users, based on what is considered ‘most relevant’ to him or her (personalized results).

Websites that are considered “low quality” are regularly given diminished prominence in search results, or removed entirely.

Search engines make efforts to ensure that “fake” news stories are flagged, defamatory search suggestions are removed, etc…

Thus, with respect to searches for an individual’s name, search engines use personal (and non-personal) information to create a dynamic profile of what they consider to be the most “relevant” information available online which is available to be indexed in relation to that individual.

Search engines should de-index web pages that link to illegal content on receipt of a notice

Section 5(3) of PIPEDA has an overarching requirement that an “organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate under the circumstances”. This obligation is, as explained by the OPC “superimposed on an organization’s other obligations to ensure that their purposes for collection, use and disclosure of personal information are limited to only those which a reasonable person would consider appropriate in the circumstances.”

On this basis the OPC expressed the view that it would not be reasonable for a search engine to return as “relevant” in relation to a search of an individual’s name and given prominent placement in search results “[w]here that content is unlawful, or unlawfully published (e.g. where it contravenes a publication ban, is defamatory, or violates copyright; etc.)”.

The OPC also endorsed the principle, accepted by many courts in the Commonwealth, that search engines should be required to take these actions on receiving notice of the claims.

As such, we consider that a search engine, once notified of one of the above circumstances by the individual whose personal information is at issue, should be required to remove the links to the content in question from its search results for searches performed on the individual’s name. These categories do not necessarily represent an exhaustive list of all such circumstances, for there may be others that emerge or evolve over time.

We are of the opinion that this represents an appropriate balance with freedom of expression, while having a significantly positive impact on an individual’s privacy rights. In particular, we note that in these scenarios a search engine’s actions do not remove the underlying content and do not affect its accessibility using other search terms. All that is removed is the link between the content in question and the individual’s name in search results. In the situations identified above, we consider that the limited prejudicial effects on access to the information in question are clearly outweighed by the beneficial impacts that removing the links in search results can have on the individual’s privacy and dignity.

In submissions to the OPC, it was suggested that it is inappropriate for a private sector organization to make decisions balancing privacy rights against the right to expression – in other words that search engines should not be subject to a notice and de-indexing or demotion obligation without a court order or other oversight process. The OPC did not accept this submission expressing the view that search engines already engage in this activity; they should have this obligation because the problems that need addressing arise from their own actions; and because it promotes access to justice.

While this is a legitimate concern we also note that organizations do regularly engage in such balancing to some extent– for instance, in establishing terms of service which may result in content, statements or even entire accounts being removed. Search engines, in particular, already have in place mechanisms to consider de-indexing requests and remove content which is potentially harmful (e.g. credit card numbers; images of signatures) or illegal (e.g. copyright infringement) from their search results…

Beyond this, it is important to note that search engines have created the situation in which content is so readily linked to an individual’s name and are actively perfecting algorithms to personalize search results over time as part of their business model.

Some have suggested that de-indexing requests should only be considered by an oversight body or a court given the fundamental rights at stake. While individuals and search engines should ultimately have access to review by an independent arbiter in contested cases, we consider it appropriate to have search engines providing the first level of review of a de-indexing request. Indeed, having search engines initially assess de-indexing requests arguably promotes, rather than hinders, access to justice and the rule of law by providing a practical and expedient remedy for individuals.

Lastly, while we believe it is reasonable for search engines to assume this first level of responsibility, they are welcome to engage with regulators (and/or other relevant stakeholders) in the development of their de-indexing request assessment process.

In submissions to the OPC, it was also suggested “that to establish and operate processes to adjudicate de-indexing requests was too high of a burden to place on search engines, and may hamper competition.” This too was rejected by the OPC. It recognized that the mechanisms to handle complaints might not be an insignificant cost. However, it pointed out that “all organizations are required under PIPEDA to “put procedures in place to receive and respond to complaints”.” In other words, search engines do not hold a special place above the law. In a footnote, it went on to state that “search engines are in the business of making information more accessible, and, in the cases of the most widely used search engines, they generate substantial revenue from doing so; it does not seem unreasonable that this would engender an obligation to address any inappropriate or harmful impacts caused by their own actions.”

Search engine de-indexing is an effective way of protecting reputations online

The OPC addressed submissions suggesting that search engine de-indexing would not be effective. This was expressly rejected:

Some have argued that de-indexing is an ineffective remedy, since the underlying content remains available online. In our Office’s experience from past investigations, there is a difference between having information available to those who explicitly seek it out directly from source websites for specific purposes (for example, a lawyer doing jurisprudential research in CanLII or a journalist seeking out past articles on a given issue), and, the same information being “stumbled upon” or “fished out” by a snooping friend, colleague, neighbor or other acquaintance through a simple query search by an individual’s name…

The OPC believes that removal of links from search results in the limited circumstances identified above will have a significantly positive impact, even where the source information remains.

Search engines should use geo-fencing de-index webpages

The OPC also considered whether it would be sufficient for search engines only to de-index web pages for Canada specific domains e.g. google.ca. It rejected this as it would not be effective enough to protect against access by Canadians from other domains e.g. google.com.

The appropriate territorial scope of de-indexing is an on-going global debate. As a guiding principle, the OPC is of the position that de-indexing based on PIPEDA should be effective in order to be meaningful, but also limited in order to respect other jurisdictions’ authorities. We do not believe that de-indexing results from searches made on the Canadian domain for a search engine (e.g. “google.ca”) is sufficient as the information will still remain easily accessible via the .com or country-specific domains. However, we also believe that de-indexing results globally could potentially unduly interfere with the sovereignty of other countries. In order to ensure that the protections afforded by PIPEDA to individuals are effective yet do not impermissibly extend beyond Canada, we believe that geo-fencing techniques should be applied so that de-indexing of search results is limited to searches originating from within Canada.

It is unfortunate that the OPC did not fully explain its rationale for concluding that global de-indexing “would potentially unduly interfere with the sovereignty of other countries”. In the Globe24.com case, the Federal Court had ordered a Romanian web site remove content worldwide that violated PIPEDA. In the Google v Equustek case, the Supreme Court affirmed a global de-indexing order against Google in a trade secret misappropriation case. In a world in which respect for privacy rights is becoming ever more important, it is unclear that orders that would extend beyond Canada would violate or always violate principles of comity. There might well be cases where protecting the personal information of Canadians abroad would in the public interest and would be recognized as a valid exercise of domestic sovereignty. It is perhaps for this reason, that the OPC caveated its opinion on the territorial scope of a search engine’s responsibility by stating “While an admittedly imperfect solution, we believe that for now, geo-fencing strikes the appropriate balance between effectiveness and appropriate territorial scope. We may revisit this position as Canadian and international law evolves.”

The OPC should be congratulated for producing such a well reasoned and analytically sophisticated  position paper. The paper recognizes the dilemma faced by individuals in vindicating their reputations online. It also recognizes that search engines facilliate the dissemination of inacurate, incomplete, and outdated information through itheir personalized search results. It further recognizes that search engines can and must play a role in addressing harms they themselves contribute to. The paper is a welcome development in both Canadian privacy law and in its recognition that online intermediaries like search engines are well placed and have responsibilities for addressing online harms.

Next steps

The OPC is seeking stakeholder views on the proposals outlined in the draft position paper. It will then finalize its position and develop an action plan to put the new measures into practice.