As Canada’s privacy watchdog asks the Federal Court for clarity on whether Canadian citizens can ask search engines to remove or update posts that are inaccurate, incomplete or outdated, Google has begun to counter that such a move is against freedom of expression. As the crux of both arguments fall on their legal integrity, Éloise Gratton, partner at Borden Ladner Gervais LLP and National Co-Leader of the Privacy and Data Protection Practice Group, provides expert advice to Digital Journal readers.
Digital Journal: With data privacy, how important is data for the modern business?
Éloise Gratton: Businesses nowadays and over recent years collect information is digital format. Over time, the amount of information that they manage is increasing, especially since it can be easier and cheaper to keep this data instead of destroying it. Moreover, since there is enormous value in data, many businesses wish to benefit from new technological tools to collect and gather as much personal information as possible in order to improve their knowledge about their customers and even their employees. This knowledge can allow them to improve their operations and efficiency in some situations, but this data can also allow them to better target certain products to their customers with relevant advertising or personalized products. More data means knowledge, and knowledge is power!
DJ: Do consumers know how much of their data is stored?
Gratton: Consumers may not always realize how much of their data is maintained by businesses at all times, although Canadian data protection laws are there to protect them to some extent. One of the fundamental principles of these laws is that organizations must be transparent and inform individuals on the type of information collected, they must limit the collection of personal information to what is “necessary” or “reasonable” to fulfil the purposes for which the information was collected and they can retain personal information only for as long as it is reasonably required for legal or business purposes, after which the organization must either destroy or de-identify personal information. Technically, businesses should therefore not keep too much data.
DJ: Should consumers be concerned with the level of data that is held?
Gratton:: I don’t know if they should be concerned but at least they have some protections under Canadian data protection laws. They can always file an access request to an organization, asking that this organization discloses the personal information that they maintain about them. If they are concerned, they can also file a complaint with the relevant privacy regulator which will investigate the business practice of the organization.
It should be noted that new Consent Guidelines have been issued by the Office of the Privacy Commissioner of Canada (“OPC”) and will enter into force in January 2019. The Guidelines require private sector organizations to be more transparent about their privacy practices, including detailing which personal information they are collecting and sharing with third parties and who these third parties are. The Guidelines also require that organizations clearly indicate practices involving personal information that are optional (i.e. not required for the provision of the service), and that they provide individuals with clear options to opt-out from such optional collection, use and sharing of their personal information.
DJ: Does this level of data storage create identity theft risks?
Gratton:: Potentially, if the personal information stored is sensitive and inadequate security measures are used to protect this data.
DJ: As Canadian law currently stands, do consumers have ‘the right to be forgotten’?
Gratton:: Not quite, although the Privacy Commissioner of Canada has also recently published its position on this issue, taking the view that individuals have some rights which may be considered as a form of right to be forgotten. Consumers do have some rights and control over their personal information. Canadian data protection laws provide that businesses must either destroy or de-identify personal information that they no longer need for the purposes for which the data was collected. Also, under some laws, for example the Quebec Civil Code, individuals can object to the publication of their personal information if this information is not of public interest.
DJ: If a citizen is concerned with what appears on a search engine, what right do they have?
Gratton:: The individual could request from the website or individual that published his or her information or picture that it be removed. In some jurisdictions such as Quebec, individuals can object to the publishing of their personal information online if this information is not of public interest (under the Civil Code of Quebec). If there is a disagreement, the parties could go before the courts who would have to determine if the information published is of public interest. This is a complex exercise since the courts would have to properly balance the right to privacy and reputation of the complainant against the right to freedom of information and freedom of expression of the person that published the information.
DJ: Why are companies like Google opposed to changes in the law?
Gratton:: I can’t speak on behalf of Google or any other search engine, but one thing that we have to keep in mind is that properly balancing the right of a complainant who wants their information removed against the right of the person that published the information is a challenging and difficult task, one that has a huge impact on the fundamental rights (privacy and freedom of expression) of individuals, as well as on the value of freedom of information. This complexity makes for an even stronger argument against allowing or empowering a third, private sector entity (such as Google or any search engine), to decide on these complex issues. If search engines are opposed to changes in the law, it could be that they realize that this is an important task which is best left in the hands of the courts.
DJ: Is a legal change likely, in terms of greater rights for individuals?
Gratton:: It is likely that over time, legal changes will be made to the law to allow individuals to better protect their reputation online (for instance in jurisdictions that don’t already offer such protection) but hopefully, these changes will take into account not only the right to privacy and reputation, but also the right to freedom of information and freedom of expression, favoring an approach which is more balanced than a right to be forgotten.