In short: The Office of the Privacy Commissioner of Canada is turning to the Canadian judicial system for help in determining how it can regulate Google in regards to user privacy, i.e. whether it’s able to do so within the scope of the Personal Information Protection and Electronic Documents Act. In an announcement made earlier this month, the OPC revealed it contacted the Federal Court in order to request a ruling on how PIPEDA applies to Internet search engines, though given the dominance of Google Search in the country, that primarily concerns Alphabet’s subsidiary.
While Canada doesn’t have a conventional right-to-be-forgotten law, the OPC’s official stance on the matter is that PIPEDA allows for that basic principle to be enforced, providing individuals with the ability to request their information be purged from public records of private organizations. One notable exception to that rule is the fact that the regulation specifically waives privacy concerns in the context of journalistic reporting, as well as general artistic purposes. The OPC is unsure how that would apply to Google seeing how compiling media reports and news articles is a significant component of the Search service. To that end, the federal agency is seeking the Federal Court’s input so that it can develop a long-term PIPEDA enforcement strategy as it relates to the issue of information de-indexing requests made by Canadians in the country and even abroad.
The crux of the issue is whether Google can be asked to remove people’s real names and select websites given in response to name queries from Search results and fined if it refuses to do so. The OPC did not ask for the judicial system’s aid preemptively as it’s citing a recent case that saw a Canadian individual allege the company is violating his PIPEDA-given right to be forgotten. The plaintiff argues Google Search disclosed a “serious medical condition” and his sexual orientation, directly causing harm to his person.
The Mountain View, California-based tech giant said applying PIPEDA in this particular case would be unconstitutional, and the OPC believes the law is in need of an additional interpretation for the purposes of clarity, claiming both sides provide valid arguments given the vague nature of some PIPEDA provisions. The court is now being asked to determine whether Google reveals personal information as part of its commercial activities in a way that doesn’t allow it to be exempt from PIPEDA in spite of its journalistic or literary activities prompting such actions.
Background: Google had issues with right-to-be-forgotten laws in the past, most notably in the European Union where the company lost a major, precedent-setting case this April. A number of recent surveys suggest an overwhelming majority of Americans support the idea of such legislation being enacted in the United States, neither the GOP nor the DNC included that effort into their latest political platforms. Regardless, digital privacy is now part of the public discourse in the U.S., in part due to Facebook’s Cambridge Analytica scandal from earlier this year, but also because of other issues such as the newly revealed Google+ vulnerability that not only exposed data of hundreds of thousands of users but was also the subject of a corporate cover-up.
Due to that state of affairs, calls for additional privacy regulation in the U.S. are now gaining traction and Canada already signaled it’s paying attention to how the situation is developing. Google itself repeatedly said it’s taking the privacy of its users in a maximally serious manner but critics argue the company never would have grown to its current size if it always had to prioritize consumer privacy. While Canada is currently flirting with the idea of a codified right to be forgotten, the European Union, Japan, South Korea, and even China already embraced that concept over the last several years.
Impact: Regardless of the Federal Court’s ruling and whether it even honors the OPC’s request, there are no guarantees that Google will actually find itself under significant additional scrutiny from Canada’s privacy watchdog. While the regulator said it’s in need of a court ruling before it examines similar cases alleging PIPEDA violations on Google’s part, examples from other countries show that only a small portion of individuals ever seek to exercise their right to be forgotten, even in scenarios wherein their ability to do so is much more clearly codified, making their road to litigation more straightforward.
Nonetheless, the move is yet another indication that Google’s privacy practices are gaining more public attention all over the world and will likely affect its business strategy much more significantly moving forward. Between the General Data Protection Regulation in the European Union and the California Consumer Privacy Act, both of which were enacted just several months back, Google is facing an increasing amount of regulatory scrutiny and questions about the ethics of its practices continue to emerge. Coupled with the recent Google+ privacy debacle that exposed data of approximately half a million users to hundreds of app developers over a period of around three years, calls for stricter privacy regulations in the United States are likely to intensify as well, particularly those prompted by Google’s gaffes.