The Balance Inherent in the Right to be Forgotten

Trust me, I’d love to stop writing about the RTBF.  I’m not even sure how it came to take up so much real estate on this blog and in media generally. Especially since, as I’ve said before, it isn’t really anything new!  Nevertheless, the RTBF continues to rankle as the original decision reverberates through search engine companies and various countries around the globe.

A New York Times article on 5 Aug 2015 sets out the original decision and examines the changes wrought by the decision, positing that the RTBF will ultimately spread outside the EU boundaries and become normalized in multiple jurisdictions including the US. 

Emma Llansó, a free expression scholar at the Center for Democracy and Technology, is quoted criticizing the RTBF within the context of the US saying:

“When we’re talking about a broadly scoped right to be forgotten that’s about altering the historical record or making information that was lawfully public no longer accessible to people, I don’t see a way to square that with a fundamental right to access to information”

The article provides strong arguments on the other side as well. Marc Rotenberg of the Electronic Privacy Information Center  that says that “global implementation of the fundamental right to privacy on the Internet would be a spectacular achievement” and a positive development for users.  Asked about the allegation that freedom of speech is compromised by the removal of information, he notes that there are ways to limit access to private information that do not conflict with free speech and in fact that Google already has a process for global removal of some identifiable private information, like bank account numbers, social security numbers and sexually explicit images uploaded without the subject’s consent (“revenge porn”) that hasn’t attracted the same concerns. 

As for concerns about international implementation, Jonathon Zittrain of the Berkman Centre for Internet and Society at Harvard reminds us that this too is already in practice—when Google receives a takedown notice for linking to copyright infringing content, it removes those links from all of its sites across the world.

PERSPECTIVE

In any discussion of this issue it’s important to understand that RTBF was not intended to be an absolute right – rather it is inherently a process of balancing competing interests.  Indeed, after the original RTBF decision, Google instituted a process by which individuals could make RTBF requests.  Their own data shows that since the process was instituted in May 2014, roughly 41 percent of the one million requests it has received have been successful.  It is also worth noting that the original information “removed” in the successful requests doesn’t disappear – rather, the original source is no longer indexed by Google or shown in search engine results.

A recent decision in British Columbia shows that, although the RTBF hasn’t been formally implemented in Canada, the balancing of rights is active and seems to be working out just fine.

Niemela v. Malamas arises from a situation where former clients allegedly made defamatory comments about Mr. Niemela on a variety of sites.  Although the comments ceased, Mr. Niemela found that his law practice was affected by these comments.  Accordingly, he began an action against those who he believed had made the comments and the sites upon which the comments were published.  He was successful in this claim, and thus obtained injunctions requiring the removal of 146 posts from various sites. 

Where it becomes particularly interesting, however, is that he also filed suit against Google for publishing defamatory statements about him because individuals gained access to the information through being able to view snippets of the comments in the Google search results. Google asked that this action be dismissed, and ultimately it was—because the court determined that on all the facts the “snippets” were the product of an algorithm and that there was nothing to indicate that Google was actively involved in publishing the statements.

It doesn’t end there, however.  When the first suit concluded, Google voluntarily removed links to the 146 sites from its Canadian search engine results.  Mr. Niemela, however, was not satisfied with this – he wanted Google to remove the links from its search engine results worldwide. 

In considering this request, the court set out a three-part test that Mr. Niemela must meet:

1. that there is strong evidence that the words are defamatory;
2. that a failure to grant the injunction will result in irreparable harm; and
3. that the balance of convenience favours granting the injunction.

On the facts, it was the opinion of the court that while there was strong evidence of defamation, the case failed at the second step – (i) because the majority of searches on Mr. Niemela were made on the Google Canada; (ii) it was not obvious that the damage Mr. Niemela alleged was caused by the defamatory comments at all; and (iii) such an order would not be internationally enforceable since it was against US policy on defamation and freedom of speech.

This is a great example of how to approach RTBF – all the facts are considered in context to assess the role of the search engine results in perpetrating the injury and to ascertain whether ON BALANCE an order to remove the information (and the extent of such removal) is warranted. 

In the end, what the RTBF requires is a balancing of the benefits of online information availability against the privacy of individuals. 

Really – does this strike you as compromising an important public record?  As undercutting freedom of expression?  Even of facilitating user vanity at the expense of public information?  Or is it the kind of approach that should be built into the process of digitizing and making public information about individuals in order to ensure that in our excitement about technological capacity we don’t compromise individual autonomy?

R v Spencer: a new era of privacy jurisprudence for Canada

The newspapers are trumpeting the Supreme Court of Canada decision in R v Spencer, as well they should.  It was a good, thoughtful decision, one that conveys a strong understanding of privacy. 

The case, on appeal from Saskatchewan, dealt with a situation where police requested (and received) subscriber information from an ISP based on an IP address.  The information was revealed by the ISP in response to a request with no warrant.  The SCC was asked to determine whether this was an unreasonable search and seizure in contravention of s.8 of the Charter and they determined that it was.  

Until this decision, (some) Canadian ISP’s were of the opinion that exceptions for information revealed to certain bodies for law enforcement, security or related purposes as set out in s. 7 of PIPEDA authorized the provision of personal information without the necessity of a warrant.  Today’s decision puts an end to that practice. 

In examining the subject matter of the search, the court rejected a limited approach that saw the information as merely the name and address of an ISP subscriber, holding that to do so was to miss the fact that the information at issue was the subscriber information as linked to particular Internet activity as well as the inferences that might be drawn from that profile (para 32, emphasis mine). 

The court also employed a new and nuanced tripartite understanding of information privacy, looking at privacy variously as secrecy; as control over information; and as anonymity.  (para 38)

It is this final category of privacy as anonymity where the decision perhaps makes its greatest contribution.  In relation to user online activity, the Court focused extensively on the idea of privacy as anonymity, writing at para 46 that:

Moreover, the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided...[t]he user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous — by guarding the link between the information and the identity of the person to whom it relates — the user can in large measure be assured that the activity remains private…

Ultimately, the Court concluded that there was (or could be) a reasonable expectation of privacy as to the anonymity of their online activities.  Given this reasonable expectation of privacy, the police obtaining the subscriber information from the ISP without a warrant was a violation of s.8 of the Charter and thus an unconstitutional search.

This finding is an important one and not just for the privacy of individual internet users.  Indeed, in light of current concerns about security and cyberbullying, as currently expressed in C-13 in S-4.  C-13, the newest iteration of the government’s lawful access legislation combined with cyberbullying provisions, contains provisions for voluntary warrantless disclosure.  The Court’s strong recognition of a constitutional reasonable expectation of privacy in such information is in direct opposition to the presumptions underlying such provisions.  S-4, which would update PIPEDA, has been criticized as expanding the expanding scope of voluntary disclosure, an approach which must also be reconsidered in light of today’s decision.

Government has long sought to justify lawful access-type legislation as creating the new powers necessary in order to address new technologies.  In its decision, the Court addresses concerns expressed by law enforcement that requiring a warrant could impede or even facilitate the investigation of online crime, countering at para 49 that:

In light of the grave nature of the criminal wrongs that can be committed online, this concern cannot be taken lightly. However, in my view, recognizing that there may be a privacy interest in anonymity depending on the circumstances falls short of recognizing any “right” to anonymity and does not threaten the effectiveness of law enforcement in relation to offences committed on the Internet. In this case, for example, it seems clear that the police had ample information to obtain a production order requiring Shaw to release the subscriber information corresponding to the IP address they had obtained.

This case dealt with child pornography – that the SCC are clear that a warrant was necessary in this case indicates that the privacy interest is an important one, not to be overridden easily.  This too should be read as a warning to the Government that expansion of intrusive powers into personal privacy must be grounded in demonstrable issues rather than mere unsupported assertions of necessity.