It may be surprising that, until this past Friday, there was considerable doubt about whether Canada’s federal private sector privacy law to online search engines. The Office of the Privacy Commissioner of Canada (OPC) had previously skirted deciding this issue.
This changed with the release of the draft OPC Position on Online Reputation. The OPC decided not only that online search engines (such as Google search, Bing and others) are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), but also that search engines may be required to “de-index” search results about an individual in some cases. In other words, the OPC has introduced a limited type of “right to be forgotten” in Canada.
It will be interesting to watch whether search engines accede to the OPC’s interpretation of PIPEDA. Certainly, we should expect to see some vigorous debate before the OPC finalizes its Guidelines. After that, perhaps the OPC will need to find a case and take it to court. The OPC’s “position” does not have the force of law. And, until the OPC completes an investigation, the OPC cannot take a search engine to court for a ruling.
Are search engines engaged in a “commercial activity”?
Search engines form an indispensable tool through which most individuals navigate the world wide web. However, in order for a search engine to be subject to PIPEDA, it must be performing a commercial activity and not be engaged in journalism or a literary activity. 
The OPC concluded that the search engine is not performing a “journalistic” or “literary” function. A search engine operator indexes content, applies proprietary algorithms to that content, and then displays results based on relevance, as predicted by those algorithms. The relevance of the search results are to some extent customized depending on the user and the user’ location. The OPC concluded that in many cases the search engines display advertising along with the search results and that this sale of advertising is “inextricably linked” to the search function. In this way, the OPC concluded that search engines are engaged in a commercial activity.
Where is the “right to be forgotten” in PIPEDA?
The OPC constructed a right to challenge search engine results by combining three principles in Schedule 1 to PIPEDA to develop an individual’s right to request de-indexing. These are the “accuracy”, “individual access”, and “challenging compliance” principles. Essentially, the OPC concluded that if the de-indexed result is inaccurate, incomplete or not up-to-date, then the search engine must balance the interests of the individual against the public interest of the web page continuing to be indexed and displayed in the search results.
Stay tuned for further debate
The OPC’s guidance is in draft. We should expect that the coming weeks will see considerable debate. The OPC has itself called for Parliament to consider the issues, and whether the OPC has “struck the ight balance”.
There will be supporters and critics of the OPC’s activism. Supporters of the OPC’s approach may cite the role of search engines in driving traffic to content. They will argue that the algorithms deployed by search engines are not transparent or neutral. If the information being returned by the algorithm does not accurately reflect information about the individual, they may rightly ask what the overriding interest is in making inaccurate information prominent in the search results or even displaying it at all if the harm to the individual exceeds other interests.
Nevertheless, there will be many critics of the OPC’s approach. It places the burden on search engines to arbitrate what results should be de-indexed or shown. Moreover, the OPC’s suggestion that search engines will need to geo-block results is a remarkable interference with the ability of individuals to obtain access to information and interferes with the freedom of expression of the authors of the underlying information. If the underlying information is the problem, there are a variety of tools for dealing with that information, such as the law of defamation, torts of invasion of privacy, and other legal remedies.
Read the full OPC Position on Online Reputation.
Professor Michael Geist penned a response to the OPC decision in the Globe and Mail, which can be found here.
Categories: Guide to PIPEDA, Privacy