The Federal Court recently refused a request, made by CBC and a group of media organizations, to intervene in a case involving the Office of the Privacy Commissioner of Canada (OPC) and Google. The OPC brought a reference to the Federal Court seeking advice on the interpretation of Canada’s privacy laws and how those laws might apply to Google search. The critical question to be addressed by the court is whether Google’s search engine service is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Secondarily, there is an issue of whether Google search is an activity of “journalism, artistic or literary purposes”, which would provide Google with broad exceptions from the requirements of PIPEDA. Although the court dismissed the media group’s request to intervene, the court left the door open for the media to apply again at a later stage of the proceeding.
The OPC’s reference case to the Federal Court ranks among the most important of Commissioner Therrien’s initiatives since he was appointed as Commissioner in June 2014. The outcome of the case will have broader implications for the jurisdiction of the OPC over social media and other technology companies offering personal assistant services. This is because a key question will be how the OPC should apply what is sometimes called the “primary characterization” rule to defend their position that they are not subject to PIPEDA because they are not engaged in a commercial activity (more on this below).
The case is also an important prelude for determining whether individuals have a “right to be forgotten” or, more precisely, a right to de-indexing of search results that appear when their name is searched in a search engine. If there is a right to de-indexing, it is a very limited one, at least as framed by the Commissioner. The individual must first demonstrate that the search results for the individual’s name is inaccurate, incomplete or out-of-date. The OPC will then need to balance any right to de-indexing against of other important rights such as freedom of expression and the public interest. Even then, the right does not extend to search results produced by subject-matter searches that do not directly involve querying the individual’s name.
Re-examining the primary characterization rule
The core of the case, as framed by the Commissioner, requires the court to re-visit how it approaches what constitutes a “commercial activity” for the purposes of PIPEDA. As readers may know, PIPEDA does not apply to all data processing in Canada in the private sector. Leaving aside the employment context for certain federally-regulated entities, PIPEDA applies when personal information is collected, used and disclosed in the course of a commercial activity. You might think that such an important concept would be defined in PIPEDA. However, you would be wrong.
In the past, the Federal Court has endorsed an approach that is known as the “primary characterization” rule. The rule was established by the Federal Court in State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada. In that case, thee plaintiff and the defendant were involved in litigation following a motor vehicle accident. The defendant’s insurer had an investigator collect evidence about the plaintiff for the purposes of defending the lawsuit. The question arose whether this evidence was subject to PIPEDA. Was it gathered as part of a commercial activity? Was it relevant whether the insurer was in the business of defending its insureds? Or, was the sole issue whether the very act of collecting evidence to defend litigation was or was not a commercial activity?
The court in State Farm said that the characterization of the activity should not change merely because of who was conducting it. So, even if the insurer could be classified as a commercial organization, the primary purpose of collecting evidence was to defend a personal injury lawsuit and that was not a commercial activity in itself.
I conclude that, on a proper construction of PIPEDA, if the primary activity or conduct at hand, in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action, is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf. The primary characterization of the activity or conduct in issue is thus the dominant factor in assessing the commercial character of that activity or conduct under PIPEDA, not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties. In this case, the insurer-insured and attorney-client relationships are simply incidental to the primary non-commercial activity or conduct at issue, namely the collection of evidence by the defendant Ms. Vetter in order to defend herself in the civil tort action brought against her by Mr. Gaudet.
State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736 at para. 106.
The reasoning in the case has an unintended effect. It opens the door for Google and personal assistant technology companies to try to argue that they are not subject to PIPEDA when they collect, use or disclose personal information when performing a task as a personal assistant. Consider how this plays out in an analysis of Google search. During your March break, you type in a search term to look up information about a place to go on your next vacation or the latest news about a certain ongoing political scandal. Is that a commercial activity? Google might argue that the focus should be on the primary activity which is your search, which is a non-commercial activity, and a key component of your right to freedom of expression. If Google is correct, then there is a massive hole in PIPEDA (one of several).
However, the problem with the application of the primary characterization rule to Google search is that it purposefully ignores the total context. This is strange in the realm of privacy law – which is very contextual. It is stranger still because courts rarely purposefully ignore the total context when considering the scope of an organization’s duties.
Looked at from the vantage point of the total context, Google has created an entire ecosystem of advertising and search engine optimization. It does not wait passively for an individual to have a question. It has created a search product that it barters for individuals’ data and eyeballs and that is subsidized by advertising. Its product involves (i) indexing and caching webpages for publishers, (ii) developing proprietary algorithms to rank those pages, (iii) offering advertising to promote results above other search results, and (iv) collecting from the consumer information in order to feed that advertising model and algorithmic improvement. And, of course, you aren’t necessarily seeing the results that you want to see. You are seeing the results that Google has curated for you to see: ads frequently on top; results thereafter. Google search is a product. The fact that Google barters with individuals for access to that product does not make it any less commercial.
Far from being the broad doctrine that Google would like to invoke, the primary characterization rule in State Farm rested on a foundation built on the underlying reality that State Farm was indemnifying the defendant and subrogated to the rights of the defendant. There was an identity of interest involved between the insured defendant and the insurer with respect to the evidence gather activity.
There is no identity of interest between Google and either the individuals for who it is conducting a search or the individual who is the subject of the search. Unlike the situation in State Farm, Google did not wait for instructions on the search and then go out and find the result the individual wanted. The product was developed independently and in advance of the individual ever asking the question.
Proposed narrow right to de-indexing
Beyond whether or not Google search is subject to PIPEDA, the case is also be a prelude to a broader examination of whether PIPEDA contains some form of a “right to be forgotten” or, more accurately, the right to require de-indexing of search results in limited cases.
The OPC argued in its draft Position on Online Reputation that PIPEDA recognizes a limited right to de-indexing in clause 4.9.5 of Schedule 1 to PIPEDA, which provides that organizations must amend information that is demonstrated to be incomplete, inaccurate or not up-to-date. Furthermore, with respect to information provided by the individual, the OPC notes that there is a right to withdraw consent in clause 4.3.8 and an obligation, in clause 4.5.3 on organizations to destroy, erase or anonymize information that is no longer needed.
Far from a broad “right to be forgotten”, the OPC envisions a modest right to practical anonymity when the search results are produced through a commercial search engine and certain factors are met.
First, the search results that are subject to this possible right are those that result from a search of the individual’s name. You could not challenge a search result merely because information about you was included in the search result. There is no rewriting history. Let’s use a hypothetical person “Jasmyne Churrck”. Say you were to search “Jasmyne Churrck” and you came up with a story about Jasmyne Churrck’s 1974 arrest for cannabis possession, Jasmyne could challenge that result – potentially. However, she could not challenge the result if the search was “cannabis illegal 1974” and the very same story came up.
Second, in order to succeed in her challenge, the search would have to be inaccurate, incomplete, or no longer current.
Third, the right to a remedy would need to be balanced against freedom of expression and the public’s interest in being able to find the information through a search of the individual’s name. If Jasmyne Churrck in my hypothetical was a public figure, that would count against any relief. However, a person with a unique name who ranks highly solely because of her unique name might would have a better argument for a remedy.
Finally, the placement of the search result would be a relevant factor. If my hypothetical involved “Jasmin Church”, this might be a more common name with the result only showing up later down in the search results. That might count against any de-indexing.
The news media piles on
Google is not content to have the issues about whether its search engine is subject to PIPEDA decided on the interpretation of PIPEDA alone. Google wants the reference to be expanded to include consideration of the Charter of Rights and Freedoms. In particular, Google seeks to have the court examine whether, if the OPC did recommend that Google de-index search results, this would contravene the right for freedom of expression under section 2(b) of the Charter. A decision on Google’s motion to expand the case has not been decided.
In the meantime, the CBC and the media sought to intervene. This move seems tactical and designed to improve the likelihood that the Charter 2(b) issue would be addressed outside of the total context of the case and the Commissioner’s application of PIPEDA to the facts of the case. Google and the media companies want to pre-empt the Commissioner. So, they have attempted to turn the case of the OPC suppressing freedom of expression, despite the fact that all concerned know very well that the OPC has no order-making powers. If the OPC were to recommend de-indexing in a particular case, and Google refused, the OPC or the complainant would have to go to court for an order. No deference is provided to the OPC. We are a long way from suppressing anything.
Thankfully, Prothonotary Tabib saw that the media’s argument for why they needed to be involved relied on some “speculative leaps”.
Indeed, even if the reference confirmed PIPEDA’s application to Google’s search engine service, the OPC would still have to conduct its investigation into the complaint, find it well founded, in the sense that the search results at issue return inaccurate, incomplete or incorrect information, determine that de-indexing is an appropriate remedy in the circumstances and determine that deindexing does not infringe Charter protected rights. If and when the OPC reaches that determination, its powers are limited to issuing a non-binding recommendation. The ultimate act of deindexing would in turn either require Google to voluntarily comply with the recommendation or that the Court comes to the same series of conclusions in a subsequent de novo review of the matter in the context of an application to the Court pursuant to s 14 of PIPEDA, brought by the complainant or the Privacy Commissioner.
Reference re subsection 18.3(1) of the Federal Courts Act, R.S.C. 1985, c. F-7, 2019 FC 261 at para. 17.
It should be noted, that the court did not preclude the media organizations from renewing their request after Google’s motion to expand the case is decided.
A case to watch
This case is likely to be the most important case the OPC has ever argued under PIPEDA. Apart from deciding whether Google search is subject to PIPEDA, the court will also have to decide, in the alternative, whether Google is engaged in journalism when it produces search results, which will have broad implications for the scope of that exemption.
If Google succeeds in arguing it is not engage in a “commercial activity”, it bodes poorly for PIPEDA’s ability to address multi-sided tech company uses of data in personal assistant services where so-called free services are subsidized through the collection and use of data and its brokering or renting for advertising or other purposes.
The case is also interesting, of course, for the issue of the right to be forgotten or de-indexing. Although I am sympathetic to the arguments regarding freedom of expression, I can’t help but feel that Google and the media companies might end up on the wrong side of history on this one. Nevertheless, the final word is likely to be the Supreme Court of Canada’s some time in the future.
Categories: Guide to PIPEDA, Office of the Privacy Commissioner of Canada, Privacy, Right to Be Forgotten
Leave a Reply