The Court of Justice of the European Union, exercising jurisdiction over twenty-eight E.U. member states, issued a landmark decision in Google Inc. v. Agencia Española de Protección de Datos.
In May 2014, the Court of Justice of the European Union (CJEU), exercising jurisdiction over twenty-eight E.U. member states, issued a landmark decision in Google Inc. v. Agencia Española de Protección de Datos. The CJEU in this case pronounced a broad precedent: all European residents now have the right to stop Google and other data controllers from linking to information deemed "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in light of the time that had elapsed."1 In Europe, this new right to be forgotten is considered as a way for individuals to better protect their online reputations. In the U.S., many are of the view that this new right instead raises freedom of speech and freedom of information concerns.2 The lack of consensus on the relevancy of a right to be forgotten illustrates, to a certain extent, the cultural transatlantic clash on the issue of the importance of privacy versus other rights, such as freedom of information and freedom of expression.
In Canada, the Office of the Privacy Commissioner of Canada (OPC) has recently chosen reputation and privacy as one of its priorities for the next five years. The OPC is focusing its attention on the reputational risks stemming from the vast amount of personal information posted online and on existing and potential mechanisms for managing those risks. In January 2016, the OPC published a discussion paper, entitled "Online Reputation, What are they saying about me?"3 in which it asks if a right to be forgotten can find application in the Canadian context and if so, how, as part of its consultation and call for essays on online reputation ending April 28, 2016.4
Éloïse Gratton, Partner and National Co-Leader, Privacy and Data Security Practice Group of Borden Ladner Gervais LLP and Jules Polonetsky, CEO of Washington based Future of Privacy Forum think tank, have recently submitted a joint-position paper to the OPC as part of this consultation and call for essays on online reputation. Their paper entitled "Privacy above all other Fundamental Rights? Challenges with the Implementation of a Right to be Forgotten in Canada" explores whether importing a right to be forgotten that would allow individuals to stop data controllers, such as Google, from providing links to information deemed irrelevant, no longer relevant, inadequate or excessive would be advisable in Canada. They argue that not only such a right would be unconstitutional in Canada but also that such right to be forgotten may, in any event, be unnecessary and undesirable both from a legal and a public policy perspective.
The authors first argue that a right to be forgotten would most likely infringe upon freedom of expression in a way that cannot be demonstrably justified under the Canadian Constitution. Second, they argue that the current legal framework in place in Canada, at least in some provinces, efficiently addresses the privacy and reputational concerns that a right to be forgotten is meant to address. Finally, the authors raise concerns about the risks pertaining to the right to be forgotten, most notably with respect to censorship, the restrictions on the flow of information, the availability of historical information, and potential infringements on freedom of expression.
In their conclusion, Gratton and Polonetsky warn against entrusting private entities with the tasks of arbitrating fundamental rights and values and determining what is in the public interest, with little or no government or judicial oversight. They raise that a right to be forgotten would be enforced by private corporations that have an incentive to err on the side of removal in order to reduce costs and/or to avoid legal liability and potential fines to which they are exposed. The authors articulate the view that courts have the expertise and independence to properly balance fundamental rights and values and that they, as public bodies, are in a much better position than private entities to act independently and justly to determine whether, and to what extent, the disclosure of any given personal information is legal.
Moreover, in light of the European experience over recent months, the right to be forgotten has an extraterritorial reach that has important and negative ramifications, including in the Canadian and broader North American context. They suggest that efforts be put into improving the current legal framework, notably by increasing access to justice, rather than by importing a right to be forgotten that would prove to be inefficient and, to some extent, counterproductive.
1 See European Commission, "Factsheet on the ‘Right to be Forgotten' Ruling", at para. 94.
2 See Mark Scott, "Europe Tried to Rein In Google. It Backfired.", The New York Times (18 April 2016). See also Daphne Keller and Bruce D. Brown, "Europe's Web Privacy Rules: Bad for Google, Bad for Everyone" The New York Times (25 April 2016).
3 Policy and Research Group of the Office of the Privacy Commissioner of Canada, "Online Reputation, What are they saying about me?"(Discussion Paper, Office of the Privacy Commissioner of Canada, 2016), at 13.
4 Notice of Consultation and Call for Essays: Online Reputation