Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Oh, the never-ending saga of Google and the Office of the Privacy Commissioner of Canada. It's been eight years, and yet here we are, still talking about it. You'd think by now we would have moved on to more exciting things, like flying cars or new planets. But no, we're still dealing with what seems like an ancient privacy issue: the right to be forgotten.
So, what's the latest chapter in this drawn-out tale? Well, the OPC released its Report of Findings into the investigation that began in 2017 when an individual complained that Google refused to de-list certain websites that contained his personal information.
It seems Google is refusing to implement the OPC's recommendation. Shocking, I know. This means we'll likely have more chapters to write; I might just be in retirement by the time this issue is completely settled. But hey, at least I'll have something to keep me busy in my golden years.
There are a number of things about the findings that jumped out at me. The first is the emphasis on our unique reasonableness requirement, which is spelled out in Section 5(3) of the Personal Information Protection and Electronic Documents Act. Instead of analyzing this case on the basis of consent, or rather the withdrawal of consent, the OPC chose to use a section of the law that allows for more flexibility.
Had the case been examined on the basis of consent, I think it would have been more straightforward. The complainant told Google he didn't consent to the search engine listing his personal information, period. The law is clear that if you withdraw consent, the organization must abide by your wishes.
But the OPC didn't want ― or maybe they couldn't have ― a black and white decision. They needed to incorporate some of the nuances to the right to be forgotten developed in other countries. By examining the "reasonableness" of Google's use of this personal information, it allows them to better consider charter values and create a right to be forgotten that is not absolute. Because who doesn't love a legal requirement that requires teams of lawyers, philosophers and ethicists to operationalize?
I admit that the academic/teacher in me doesn't mind this. It's like a puzzle ― trying to piece together the different elements of privacy law from around the world. But the lawyer in me who represents technology companies is scratching his hairless head, wondering how we can operationalize this decision.
While we do have about a decade of experience from the EU and U.K., our approach, as articulated by the OPC, is not exactly the same. Global harmonization of data protection laws is a lofty goal, I know. But, for almost all of my clients, it's one worth striving for. And, I've heard the regulators talk about how they recognize this dilemma when they are speaking at conferences etc., but we still have a very long way to go. This case, for me, is a glaring example of the lack of harmonization we have globally.
The OPC also tasks Google with evaluating each request for delisting, forcing the company to take into account multiple criteria to make its own decision about whether the individual meets or doesn't meet the test to have their information delisted. I'm also unsure about making it the responsibility of the Googles of the world to be the gatekeepers of this right. I know they have reluctantly taken up that task in the EU, but the setup is far from perfect. I suspect this is why Google has yet to agree to abide by the OPC recommendations. After all, who wants to be the gatekeeper of a right that's as clear as mud? Not to mention the inherent conflict of interest.
All this to say, after eight long years, several levels of court opinions, and a pandemic, it's good we finally have some movement. But, like I said, there's still more to this story that I'll be happy to write and teach about in the years to come. Just don't expect a resolution anytime soon. And expect what we find reasonable to evolve over the long haul. I think that is pretty much a guarantee.
Kris Klein, CIPP/C, CIPM, FIP, is the country leader, Canada, for the IAPP.
This article originally appeared in the Canada Dashboard Digest, a free weekly IAPP newsletter. Subscriptions to this and other IAPP newsletters can be found here.
