On July 8th, the Federal Court ruled in the Office of the Privacy Commissioner’s (OPC) favour in a decision that touched PIPEDA’s application to search engines and what has become known in privacy law as “the right to be forgotten.” The decision brings clarity on whether search engines like Google, and potentially businesses with similar business models, will be subject to PIPEDA when they handle personal information.
The decision results from a reference filed by the OPC with the Federal Court involving an OPC investigation of Google. The OPC’s investigation began in 2017 after an individual complained to it that news articles Google displayed in its search results contained outdated and inaccurate information and disclosed sensitive information about him. He also complained he had endured direct harm, including physical assault, lost employment opportunities, and severe social stigma, because Google links these articles to his name in search results.
But even before the complaint was launched, the OPC began consultations on whether a right to be forgotten existed in Canada. The result was the OPC’s 2018 draft Position on Online Reputation. In that paper, the OPC stated that Canadians need better tools to help them protect their online reputation, including tools like de-indexing and source takedown. De-indexing is the process by which a webpage, image or other online resource is removed from search results when an individual’s name is entered as the search term. Source takedown means the removal of this content from the internet.
In its draft position, the OPC argues that PIPEDA applies to a search engine’s indexing of web content and displaying of search results, so search engines need to comply with PIPEDA by allowing individuals to challenge the accuracy, completeness, and currency of search results attached to their name. When an individual is successful in their challenge, the OPC argues, the search engine should de-index the inaccurate, incomplete, or outdated results.
PIPEDA also gives individuals a right to withdraw consent and requires that personal information that is no longer needed be destroyed, erased, or made anonymous. The OPC argues this gives individuals the right to remove information they have posted online. If the information was posted by someone else, the individual does not have an unqualified right to remove it, but they should be able to challenge the accuracy, completeness, and currency of the information.
Returning to the complaint, Google responded to it by saying that PIPEDA did not apply to its search engine because it was not a commercial activity within the meaning of PIPEDA (due to constitutional constraints, PIPEDA only regulates the collection, use, and disclosure of personal information in the course of commercial activities). Google also argued that even if its search engine was a commercial activity, it fell under PIPEDA’s exception for organizations who collect, use, or disclose personal information only for a “journalistic” purpose. Lastly, Google submitted that an interpretation of PIPEDA requiring it to delist lawful public content was against its freedom of expression as protected in the Charter of Rights and Freedoms. Without addressing Google’s constitutional argument, the OPC referred Google’s jurisdictional arguments to the Federal Court through the reference process that allows federal offices to refer certain legal questions to the Court.
In brief, the issues considered by the Court were:
- Does Google’s search engine service collect, use, or disclose personal information in the course of commercial activities when it indexes webpages and provides search results in response to a search for an individual’s name?
- Does Google’s search engine service involve the collection, use, or disclosure of personal information for a journalistic, and no other, purpose?
Regarding the first issue — whether Google’s search engine collects, uses, or discloses personal information — this was never really in question. Google collects personal information when its web crawlers access text on public webpages and transmit it to Google’s servers for indexing. It uses personal information to make its search engine as comprehensive and valuable as possible for users and advertisers. And Google discloses personal information through the “snippets” that appear in its search results.
Google attempted to argue, however, that because there was no evidence advertisements appeared alongside search results when searching the complainant’s name, the activity was not commercial in the usual and traditional sense. The Court disagreed. Underlining the popularity and profitability of Google’s search engine and advertising business, the Court noted that even if Google provides free services to content providers and search engine users, it has “a flagrant commercial interest in connecting these two players.” Google users provide Google with personal information when using its search service and Google uses that information for profit. The Court went further stating that “every component of [Google’s search engine] business model is a commercial activity as contemplated by PIPEDA.”
On the second issue, the Court found that Google’s purposes for handling personal information for its search engine are not journalistic, and “certainly not exclusively so.” The Court concluded this after, among other considerations, applying the test introduced in another Federal Court decision used to determine whether an activity should qualify as journalism. According to this test, an activity should qualify as journalism only where its purpose is to,
- inform the community on issues the community values,
- it involves an element of original production, and
- it involves a self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation.
The Court found none of these factors applied to Google. Google makes its information universally accessible (broader than informing a community); it does not “produce,” rather it only displays search results; and Google makes no effort to determine the fairness or accuracy of its search results. Even if there was some journalistic purpose to Google’s activities, the Court found that its primary purpose — to index and present search results — was not journalistic.
Thanks to this decision, we have more clarity on whether PIPEDA applies to search engines and similar services and the factors courts will look to when making that assessment. We also now have a concrete example of how courts will apply the journalistic activity test, as it was not fully considered in the original Federal Court decision in which it was introduced.
As for Google, unless it appeals the decision, the OPC will continue its investigation and issue a Report of Findings and recommendations likely aligned with its draft Position on Online Reputation. If Google does not implement those recommendations, the OPC could take Google to the Federal Court again in a “de novo” application. In any case, this decision will continue to have important implications on whether Canadians will someday enjoy a legal “right to be forgotten,” and may well be seen as the first step should it come to be.