On 27 April 2018, ARTICLE 19 submitted its comments to the Office of the Privacy Commissioner of Canada (OPC), in relation to its ‘Draft Position on Online Reputation’ (Draft Position). The OPC’s proposal purports to enable Canadians to ‘protect their online reputation’, through a combination of proposals for legal reform, the creative interpretation of existing federal data protection law, and greater education on privacy and reputation matters. Overall, whilst ARTICLE 19 welcomes the Draft Position as a helpful starting point for discussion on the protection of freedom of expression and reputation in the digital age, in our view the proposals require significant improvement to ensure freedom of expression can be fully protected.
In our comments, we express concern that the OPC’s proposals fail to sufficiently protect the right to freedom of expression, which includes the public’s right to know, in favour of establishing protections from potential reputational harms resulting from outdated, incomplete or inaccurate information available online. In proposing a system whereby individuals would be able to file requests with search engines to de-index information associated with their name entirely, or lower its ranking in search results, the OPC in effect recommends that Canada adopt a ‘right to be forgotten’ framework, similar to the one developed in the EU. ARTICLE 19 has several concerns about this approach, which we address in detail in our response.
First and foremost, the Draft Position does not make the case for why individuals’ online reputation is not adequately protected by existing remedies, such as civil defamation provisions, and why a so-called ‘right to be forgotten’ is needed in Canada. Whilst the OPC refers to concerns from Canadians that they are ‘not in control’ of their online reputation, no concrete evidence is provided that justifies such a belief. Moreover, the implications of granting individuals the ability to ‘control’ their reputation for the public’s right to access and share information that is legitimately in the public domain, are not adequately unpacked.
With that in mind, we question the legitimacy of the OPC deriving a ‘right to de-indexing’ and an additional ‘right to source take-down’ through a creative interpretation of existing data protection legislation. This framing would open the door towards individuals seeking to protect against damage to their reputation caused by the availability of information about them that is not only true, but of an eminently public nature, (such as reporting on court proceedings), by using data-protection legislation. In our view, if such rights are to be recognised they should be grounded in the right to privacy, and given legal force through legislation developed explicitly for that purpose, by the Canadian Parliament.
Our submission identifies significant shortcomings in the proposed mechanism through which individuals would seek to exercise their right to ‘de-indexing’. In particular, we are concerned that the OPC envisages deputising decision-making regarding de-indexing requests to private companies, rather than leaving the complex task of balancing rights to the courts or another independent adjudicatory body. This task is further complicated by the fact that the Draft Position fails to set out a comprehensive set of criteria to be considered when undertaking such a balancing exercise, as well as the rules of interpretation, including, for example, the public interest of the information, and whether there has been significant harm to an individual’s reputation.
The lack of procedural safeguards outlined in the Draft Position, in relation to both ‘de-indexing’ and ‘source take-down’ requests, raises further concerns for freedom of expression. In this regard, we recommend, for example, that the Draft Position include a requirement that data publishers be notified and put in a position to challenge ‘right to request de-indexing’ requests or decisions, to ensure that the case for freedom of expression can be fairly represented.
Finally, the proposal that the OPC would itself become the supervisory authority empowered to hear complaints from individuals whose requests have been refused, is particularly problematic. As a regulator exclusively mandated to protect the right to privacy, it is, in our view, unlikely that the OPC will afford the necessary weight to freedom of expression considerations raised by particular cases.