Alberta's privacy law unconstitutionally violates freedom of expression -- again -- in a decision that has implications for All Canadian privacy laws

You may have seen some headlines that said that Alberta’s privacy law has been declared unconstitutional. Yup, it’s true that at least part of it was and here’s why …..

This case involves Clearview AI Inc. ("Clearview"), a U.S.-based facial recognition company, challenging an order issued by Alberta’s Information and Privacy Commissioner. The order, based on findings from a joint investigation by Canadian federal and provincial privacy regulators, required Clearview to cease offering services in Alberta, stop collecting, using, and disclosing images and biometric data of Albertans, and delete the relevant data already in its possession.

Clearview sought judicial review of the order on a number of grounds, including that it is not subject to the jurisdiction of Alberta and that the Personal Information Protection Act (aka “PIPA”) does not apply to it, the Commissioner adopted an unreasonable interpretation of the words “publicly available” in PIPA and the Personal Information Protection Act Regulation (the “PIPA Regulation”), and the Commissioner’s finding that Clearview did not have a reasonable purpose for collecting, using, and disclosing personal information is unreasonable. Clearview further asserted that the Commissioner’s interpretation of PIPA and the PIPA Regulation is unconstitutional contrary to Charter s 2(b) which guarantees freedom of expression. That last argument is the one we’re going to focus on.

One thing that is really interesting about the case is that the Court did not really have to address the Charter issues. The Commissioner found that Clearview’s purposes were not reasonable, which is necessary for a company to even collect, use or disclose personal information. The Court agreed, and could have just said “not reasonable!” – don’t have to decide the Charter question – just go follow the Commissioner’s order. But the Court delved into the Charter question as well.

It’s also notable that this is the second time that the Alberta statute has been declared to violate the Charter based on “publicly available information” in the Act and the Regulations as being too narrow. That was done by the Supreme Court of Canada in Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, when the Act was being applied to video recording by a union at a picket line.

The company at issue in this case, Clearview AI, has been the subject of many privacy investigations around the world. They collect facial images from publicly accessible websites, including social media, and use them to create a biometric facial recognition database, marketed primarily to law enforcement. In 2020, privacy commissioners from Alberta, B.C., Quebec, and Canada investigated Clearview’s operations and concluded in a joint report that its practices violated privacy laws.

In December 2021, Alberta’s Commissioner issued an order directing Clearview to cease operations in Alberta, based on violations of PIPA. The Commissioner essentially said that Clearview must do for Alberta what they agreed to do in setting a lawsuit in Illinois (which is notorious for its biometric laws).

Clearview AI then brought an application for judicial review in the Court of King’s bench, contesting:

• Jurisdiction of Alberta’s Commissioner,
• The reasonableness of the Commissioner's interpretation of "publicly available" under PIPA,
• The constitutionality of PIPA's consent-based restrictions on the collection, use, and disclosure of personal information.

It should be noted that the British Columbia Commissioner issued a similar order, which was upheld by the Supreme Court of British Columbia last year.

In Alberta, as far as the jurisdiction argument went, the Court upheld the Commissioner’s jurisdiction, finding a "real and substantial connection" between Clearview’s activities and Alberta. Clearview had marketed its services in Alberta and its database included images of Albertans. The bar for jurisdiction in Canada is pretty low.

On the statutory interpretation issue, the Court accepted as reasonable the Commissioner’s interpretation that images scraped from the internet, including social media, are not "publicly available" within the meaning of the PIPA Regulation. The Commissioner employed a purposive approach, interpreting the relevant provisions narrowly in light of the quasi-constitutional status of privacy rights.

PIPA, like other privacy regulatory regimes in Canada, provides that consent must be obtained to collect and use “personal information” unless certain exceptions apply. One of the exceptions provided for in PIPA is that the information is “publicly available.” PIPA uses the term “publicly available,” but the definition for those words is found in PIPA Regulation section 7(e). PIPA Regulation s 7(e) provides:

7 ... personal information does not come within the meaning of ... “the information is publicly available” except in the following circumstances: ... (e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if (i) the publication is available to the public, and (ii) it is reasonable to assume that the individual that the information is about provided that information.

The private sector privacy laws of Alberta, British Columbia and Federally have similar, but not identical definitions of what is “publicly available” information that does not require consent for its collection and use. There are other categories, but this decision turned on information in a publication. Here are the three different definitions:

In Alberta, it says

the personal information is contained in a publication, including … but not limited to … a magazine, book or newspaper, whether in printed or electronic form, but only if (i) the publication is available to the public, and (ii) it is reasonable to assume that the individual that the information is about provided that information;

In British Columbia, it does not use “including but not limited to”:

personal information that appears in a printed or electronic publication that is available to the public, including a magazine, book or newspaper in printed or electronic form.

Under PIPEDA’s regulation, the analogous provision reads:

personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.

Canadian privacy regulators have interpreted “publication” to exclude social media sites like Facebook and LinkedIn, where Clearview harvests much of its information.

Clearview argued that this narrow interpretation under the Alberta statute and regulation violated its freedom of expression rights under section 2(b) of the Charter of Rights and Freedoms, and could not be saved as a reasonable limitation under section 1 of the Charter.

The Court agreed that:

Clearview’s activities (compiling and using data to deliver a service) were expressive. The consent requirement effectively operated as a prohibition on expression where obtaining consent was impractical.

This amounted to a prima facie infringement of s. 2(b) of the Charter.

I should note that the Alberta Commissioner – ridiculously in my view – argued that the Charter wasn’t even engaged. Here’s what the Court said.

[107] The Commissioner submits that if Clearview’s activity is expressive, it should be excluded from constitutional protection because “the method – mass surveillance – conflicts with the underlying s 2(b) values.” Clearview’s activity, according to the Commissioner, conflicts with the purposes of Charter s 2(b) including the pursuit of truth, participation in the community, self-fulfillment, and human flourishing. The Commissioner offered no authority to support the position that expressive activity could be excluded from protection based on a conflict with underlying constitutional values. Short of violence, all expressive activity is protected by Charter s 2(b).

It’s just a dumb argument to make, in my view.

So once a prima facie infringement is made out, the burden shifts to the government to justify it as a reasonable limitation, prescribed by law that can be justified in a free and democratic society. This follows something called the Oakes test:

The test involves a two-stage analysis: first, the objective of the law must be pressing and substantial; second, the means used to achieve that objective must be proportionate, which requires

1. a rational connection between the law and its objective,
2. minimal impairment of the right or freedom, and
3. a proportionality between the law’s benefits and its negative effects on rights.

In this case, the Court found that there was a Pressing and Substantial Objective: Protecting personal privacy is valid and important. The Court also found that the requirement of consent is logically connected to privacy protection, and thus rationally connected.

The law failed on the “minimal impairment” part of the analysis. The dual requirement of consent and a reasonable purpose, without an exception for publicly available internet data, was overly broad.

In a nutshell, the court has to consider what expressive activities are captured – how broadly the net is cast – and whether everything that is caught in that net is necessary or rationally connected to the pressing and substantial objective.

The Court summarized Clearview’s argument at paragraph 129:

“Clearview asserts that people who put their personal information on the internet without protection do not have a reasonable expectation of privacy. Where there is no reasonable expectation of privacy, the protection of privacy is not a pressing and substantial state objective.”

The Court noted that the way the net is being cast by the Act and the regulations not only captures Clearview’s web-scraping, but it also captures legitimate indexing by beneficial search engines. The Commissioner’s interpretation would exclude search engines, meaning that they would have to get consent for all collection, use and disclosure of personal information obtained from websites.

Here’s what the Court said at paragraph 132 of the decision:

[132] A difficulty with the PIPA consent requirement for personal information publicly available on the internet is that it applies equally to Clearview’s search technology used to create a facial recognition database and regular search engines that individuals use to access information on the internet. … For the most part, people consider Google’s indexing of images and information to be beneficial. And certainly, Albertans use Google and similar search engines for expressive purposes. But according to my interpretation of PIPA and the PIPA Regulation and the Commissioner’s interpretation of those same instruments, Google and similar search engines cannot scrape the internet in Alberta for the purpose of building and maintaining an index of images of people without consent from every individual whose personal information is collected.

The Court then went on to say at paragraphs 136 and 137:

[136] PIPA and the PIPA Regulation are overbroad because they limit valuable expressive activity like the operation of regular search engines. There is no justification for limiting use of publicly available personal information by regular search engines just as there was no justification to limit use of publicly available personal information for reasonable purposes by the union in UFCW Local 401.

[137] Alberta has a pressing and substantial interest in protecting personal information where individuals post images and information to websites and social media platforms subject to terms of service that preserve a reasonable expectation of limited use. This pressing and substantial interest, however, does not extend to the operation of regular search engines. A reasonable person posting images and information to a website or social media platform subject to terms of service but without using privacy settings expects that such images and information will be indexed and retrieved by internet search engines; indeed, that is sometimes the point of posting images and information to the internet without using privacy settings.

Then, at paragraph 138, the court concluded that the “publicly available” exception was too narrow because it specifically would capture general search engines, which do not engage the “pressing and substantial limitation”

[138] The public availability exception to the consent requirement in PIPA and the PIPA Regulation is source-based, not purpose-based. Because it is source-based, it applies to regular internet search engines that scrape images and information from the internet like Clearview even if they use images and information for a different purpose. I find that PIPA and the PIPA Regulation are overbroad because the definition of “publication” in PIPA Regulation s 7(e) is confined to magazines, books, newspapers, and like media. Without a reasonable exception to the consent requirement for personal information made publicly available on the internet without use of privacy settings, internet search service providers are subject to a mandatory consent requirement when they collect, use, and disclose such personal information by indexing and delivering search results. There is no pressing and substantial justification for imposing a consent requirement on regular search engines from collecting, using, and disclosing unprotected personal information on the internet as part of their normal function of providing the valuable service of indexing the internet and providing search results.

The court essentially concluded that it was OK to limit what Clearview is doing, but it is NOT OK to limit what search engines are doing. The law, as written, does not distinguish between the “bad” and the “good”, and as a result, the law did not “minimally impair” this important Charter right.

On the final balancing, the Court concluded that the harm to freedom of expression was not outweighed by the benefit to privacy.

The Court declared that PIPA ss. 12, 17, and 20 and PIPA Regulation s. 7 unjustifiably infringed s. 2(b) of the Charter and could not be saved under s. 1 of the Charter, to the extent that they prohibited the use of publicly available internet data for reasonable purposes.

The Court upheld the Commissioner’s jurisdiction and found her statutory interpretation reasonable. However, the impugned provisions of PIPA and the Regulation were declared unconstitutional insofar as they infringed freedom of expression by unduly restricting the use of publicly available information online.

I fully expect that this decision will be appealed, and I don’t know if the British Columbia decision has been appealed.

In the big picture, though this decision is not binding on the Federal Commissioner, it pretty strongly stands for the proposition that PIPEDA’s publicly available information exception is also unconstitutional. This has implications for “the right to be forgotten” and for collecting data for training AI models, both of which are currently before the federal commissioner.

Did the Canadian Federal Court take the first step to a "right to be forgotten" with a global take-down order?

This past week, the Federal Court of Canada released a very interesting decision in A.T. v. Globe24h.com, 2017 FC 114, which seems to be the first step towards a Canadian "right to be forgotten". (You may recall that I generally don't think such a right exists in Canada (You'd better forget the right to be forgotten in Canada). The decision includes an order that purports to tell a non-Canadian what information can be published on the internet globally.

The decision is generally unsatisfying in a number of ways. But first here's the background: The Applicant, identified only as A.T., registered a complaint with the Privacy Commissioner of Canada that a Romanian website was hosting and making available an Alberta Labour Board decision that he did not want to be associated with. An internet search of his name would turn up this decision, hosted by Globe24h. He wanted it taken down. The Office of the Privacy Commissioner of Canada (OPC) had previously investigated a number of complaints against the outfit and issued a finding. Essentially, the OPC had found that the site scraped decisions from Canadian legal, courts and tribunal websites and made them searchable on the internet. Most of these tribunals and courts made these records available online, but restricted them from being indexed and fully searchable. The business model of the site seems to be that they will promptly take down decisions -- presumably those not favourable to individuals -- if the individual paid a processing fee. The OPC had found this was a violation of Canada's Personal Information Protection and Electronic Documents Act.

In the case before the Federal Court, only the complainant and the OPC appeared. As a result, the record is one-sided and there was not a complete, adversarial analysis of all the issues to be considered. Our legal system is premised upon having opposing sides present their best arguments and best evidence before a Court. This decision only includes one side and no interveners who may have helped the court get a more balanced view. It does appear that the Court generally accepted the arguments put forward by the OPC, including hearsay related to the dialogue that OPC had with Globe24h (but which it declined to have with the Court).

The Court relied on, among other authorities, the Equustek v. Google decision from the British Columbia Court of Appeal, which was appealed to the Supreme Court of Canada and for which a decision is pending, to support its ability to issue a mandatory order against an entity with no presence in Canada. This decision may be reversed.

Secondly, because there was nobody to present the other side, there was no discussion about the impact of freedom of expression or the right to information on the case. The Court concluded that because the original case was available online, but not indexed, removing it from Globe24h would not have any real impact. And because the site's purpose was concluded to be mostly mercenary, it could not take advantage of the exclusion given to exclusively journalistic reports. In fact, the Court determined that the website's approach was not "appropriate" for the purposes of s. 5(3) of PIPEDA, which reads:

Appropriate purposes

(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

Here's the judge's reasoning on that point:

[75] I agree with the OPCC that a reasonable person would not consider the respondent to have a bona fide business interest. In making this argument, the Commissioner relies on the Canadian Judicial Council’s (CJC) Model Policy for Access to Court Records in Canada (Model Policy) and the OPCC’s own guidance document to federal administrative tribunals. The CJC Model Policy discourages decisions that are published online to be indexed by search engines as this would prevent information from being available when the purpose of the search is not to find court records. The policy recognizes that a balance must be struck between the open courts principle and increasing online access to court records where the privacy and security of participants in judicial proceedings will be at issue.

[76] The CJC has struck a balance by advising courts to prevent judgments from being discovered unintentionally through search engines. To this end, the CJC has recommended that judgments published online should not be indexed by search engines. The OPCC notes that CanLII and other court and tribunal websites generally follow the CJC’s Model Policy and prevent their decisions from being indexed by search engines through web robot exclusion protocols and other means. Indeed, the Federal Court has taken such measures to prevent our decisions from being indexed. That does not bar anyone from visiting the Federal Court website and conducting a name search. But it does prevent the cases from being listed in a casual web search. The respondent’s actions result in needless exposure of sensitive personal information of participants in the justice system via search engines.

The Court agreed with the OPC's submissions that the "journalism" exception doesn't apply in the case either. In doing so, the Court followed the reasoning of the Alberta Court of Appeal in United Food and Commercial Workers, Local 401 v Alberta (Attorney General), 2012 ABCA 130, which was affirmed on other grounds by the Supreme Court of Canada in 2013 SCC 62.

[67] The respondent has claimed in communications with the OPCC that his purposes in operating Globe24h.com should be considered exclusively journalistic. Should the Court accept that claim, Part 1 of PIPEDA does not apply to his activities because the personal information collected, used or disclosed falls under the exception provided by paragraph 4(2)(c) of PIPEDA.

[68] The “journalistic” purpose exception is not defined in PIPEDA and it has not received substantive treatment in the jurisprudence. The OPCC submits that the Canadian Association of Journalists has suggested that an activity should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a “self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation ”. Those criteria appear to be a reasonable framework for defining the exception. None of them would apply to what the respondent has done.

[69] The Alberta Court of Appeal interpreted similar statutory language in Alberta’s Personal Information Protection Act, SA 2003, c P-6.5: United Food and Commercial Workers, Local 401 v Alberta (Attorney General), 2012 ABCA 130 (CanLII), [2012] AJ No 427, aff’d 2013 SCC 62 (CanLII), [2013] 3 SCR 733 [United Food]. Specifically, in considering the adjective “journalistic”, the Court of Appeal noted that “it is unreasonable to think that the Legislature intended it to be so wide as to encompass everything within the phrase “freedom of opinion and expression””: United Food, above, at para 56. Further, the Court noted that “[n]ot every piece of information posted on the Internet qualifies [as journalism]”: United Food, above, at para 59.

[70] In my view, the respondent’s claimed purpose “to make law accessible for free on the Internet” on Globe24h.com cannot be considered “journalistic”. In this instance, there is no need to republish the decisions to make them accessible as they are already available on Canadian websites for free. The respondent adds no value to the publication by way of commentary, additional information or analysis. He exploits the content by demanding payment for its removal.

[71] The evidence indicates that the respondent’s primary purpose is to incentivize individuals to pay to have their personal information removed from the website. A secondary purpose, until very recently, was to generate advertising revenue by driving traffic to his website through the increased exposure of personal information in search engines. There is no evidence that the respondent’s intention is to inform the public on matters of public interest.

[72] Even if the respondent’s activities could be considered journalistic in part, the exemption under paragraph 4(2)(c) only applies where the information is collected, used or disclosed exclusively for journalistic purposes. It is clear from the record that Globe24h.com’s purposes extend beyond journalism.

While this case is very interesting and the first in Canada to approach a "right to be forgotten", I would caution against assuming that it is a strong precedent for Canadian law. Unfortunately, it appears all the argument and evidence was one-sided. The case raises some very interesting, very important and nuanced issues. We really would have benefited from a full presentation of all arguable positions, particularly those related to freedom of expression and the appropriateness of global takedown orders.

Here's the final order from the Court:

THIS COURT’S JUDGMENT is that:

1. It is declared that the Respondent, Sebastian Radulescu, contravened the Personal Information Protection and Electronics Documents Act, SC 2000, c 5 by collecting, using and disclosing on his website, www.Globe24h.com (“Globe24h.com”), personal information contained in Canadian court and tribunal decisions for inappropriate purposes and without the consent of the individuals concerned;

2. The Respondent, Sebastian Radulescu, shall remove all Canadian court and tribunal decisions containing personal information from Globe24h.com and take the necessary steps to remove these decisions from search engines caches;

3. The Respondent, Sebastian Radulescu, shall refrain from further copying and republishing Canadian court and tribunal decisions containing personal information in a manner that contravenes the Personal Information and Electronic Documents Act, SC 2000, c 5;

a) The Respondent, Sebastian Radulescu, shall pay the Applicant damages in the amount of $5000;

b) The Applicant is awarded costs in the amount of $300; and

c) The style of cause is amended to substitute the initials “A.T.” for the name of the applicant.

You'd better forget the right to be forgotten in Canada

Summary: This discussion paper is intended to address the following question put forward in the OPC’s consultation paper on online reputation: “Can the right to be forgotten find application in the Canadian context and, if so, how?” The author is of the view that the right to be forgotten cannot be shoehorned into existing privacy law because search engines do not come within the scope of PIPEDA and the activity of indexing newsworthy content online is subject to the journalism exception in PIPEDA. Furthermore, any attempt to compel a search engine to not include particular results -- particularly pointing to lawful content -- would fall afoul of the freedom of expression right under the Canadian Charter of Rights and Freedoms. The paper concludes with some additional thoughts that will need to be factored into the discussion of the right to be forgotten in Canada.

The next battle over privacy and freedom of expression in Canada will -- not surprisingly -- be carried out over the internet. Or at least it will be about the internet. Following the important decision by the European Court of Justice in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (2014), which found a “right to be forgotten” in the European Data Protection Directive, it is natural to ask if there is an equivalent or similar right to be forgotten in Canada.

In my submission, there is not. It cannot be shoehorned into our existing federal privacy law, the Personal Information Protection and Electronic Documents Act, and any attempt to do so would ultimately be unconstitutional on at least two grounds.

But there is also the more general, philosophical discussion worth having about whether one can import “RTBF” into Canada, a country that values freedom of expression and purports to embrace the internet. How can it make any sense at all to have a law that says a person or a news outlet can lawfully post material on the internet, but it is illegal for a search engine to tell you that it even exists?    

While I am sympathetic to many who may want to leave unpleasant or embarrassing facts behind them as they progress through their lives, it is wrong in principle to allow information to remain on the internet but to only prohibit a completely uninvolved party from indexing and including it in search results.

If the problem is with the embarrassing or out-of-date information, then any efforts should be directed at the person responsible for the information. However, the legal reality is that it would be constitutionally untenable to pass a law that would prohibit a news outlet or other content producer from expressing him or herself

Are search engines and the results they produce subject to PIPEDA?

The first question to be asked is whether one can locate a right to be forgotten within the existing framework of PIPEDA. I suggest you cannot, for a range of reasons.

Are search engines engaged in “commercial activities”?

To begin with, search engines are likely not engaged in commercial activities, at least for the purposes of section 4(1)(a) of PIPEDA. In order for PIPEDA to apply to any activity, the collection, use and disclosure of personal information must be in the course of “commercial activities.” One cannot simply say that a search engine is a private commercial undertaking because the definition is not as broad as it seems. As found by the Federal Court in  State Farm Mutual Automobile Insurance Company v. Privacy Commissioner of Canada, 2010 FC 736, the actual activity at issue is what needs to be characterised for the purposes of s. 4(1)(a):

[106]      I conclude that, on a proper construction of PIPEDA, if the primary activity or conduct at hand, in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action, is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf. The primary characterization of the activity or conduct in issue is thus the dominant factor in assessing the commercial character of that activity or conduct under PIPEDA, not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties... [emphasis added]

While most search engines are commercial enterprises and supported by advertising revenue, it does not charge users for search results and it does not charge content providers to be indexed in the search engine for inclusion in search results. The indexing, retrieval and serving of search results are not part of any commercial transaction. Ultimately, the search engine is about facilitating timely and easy access to information on the world wide web, which is not an inherently commercial activity. It can most readily be likened to compiling a card-catalogue for a library, but it is electronic and the library is the global internet.

Are search engines handling personal information for “journalistic, artistic or literary purposes”?

Instead of being included in PIPEDA by s. 4(1)(a), I would suggest that most search engines are excluded due to the operation of s. 4(2)(c) of PIPEDA:

Limit

(2)         This Part does not apply to ...

(c)         any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

Search engines are fundamentally journalistic or literary operations, particularly when providing a user with access to news media content. At the same time, they are also providing news media producers with access to readers.

The Torstar case was abundantly  clear that writing on matters of public interest is not reserved to the mass media. On this particular question, the Chief Justice’s judgement in Grant v. Torstar Corp., 2009 SCC 61 (“Torstar”), at paragraphs 96 and 97, is interesting:

However, the traditional media are rapidly being complemented by new ways of communicating on matters of public interest, many of them online, which do not involve journalists.  These new disseminators of news and information should, absent good reasons for exclusion, be subject to the same laws as established media outlets.  I agree with Lord Hoffmann that the new defence is “available to anyone who publishes material of public interest in any medium”: Jameel, at para. 54. …

[97]        A review of recent defamation case law suggests that many actions now concern blog postings and other online media which are potentially both more ephemeral and more ubiquitous than traditional print media. While established journalistic standards provide a useful guide by which to evaluate the conduct of journalists and non-journalists alike, the applicable standards will necessarily evolve to keep pace with the norms of new communications media. [emphasis added]

While Torstar was a defamation case, it is instructive of how traditional categories of “journalism” are being expanded in the modern age, particularly by our courts. This expansion was specifically in reference to the operation of the Canadian Charter of Rights and Freedoms, which is discussed in greater detail below.

The journalism exception to privacy laws has been applied by the Office of the Information and Privacy Commissioner of Alberta in Order P2005-004, which focused on the actions of the Calgary Herald Newspaper. In that case, the Adjudicator appointed under the Personal Information Protection Act (Alberta) (“PIPA”) determined that any interpretation of that Act must follow the Charter and the Alberta Bill of Rights. The complainant alleged that the Calgary Herald had violated PIPA in its publication of a news story. The Calgary Herald argued that sections 4(3)(c) and 4(3)(k) of PIPA meant that PIPA would not apply to these activities. The adjudicator stated:

[para 19] Webster’s New College Dictionary defines “journalistic” as “Of, relating to, or typical of journalists.” “Journalism” is defined as:

1.Collection, writing, editing and dissemination of news through the  media 2. Material written for publication in the media 3. A style of  writing used in newspapers and magazines, characterized by the direct  presentation of facts or occurrences with little attempt at analysis or  interpretation.

[para 20] The personal information disclosed was in the form of a newspaper article which was published by the Organization. This in itself meets the definition of “material written for publication in the media”. Having reviewed the newspaper article itself, the personal information within it is a direct presentation of the facts and is clearly collected and disclosed for journalistic purposes. There is no evidence before me or any evidence from the newspaper article itself that would lead me to conclude that the collection, use and disclosure of the personal information was for any other purpose other than for journalistic purposes.

Having found that s. 4(3)(c) of PIPA applied, the adjudicator determined that that the OIPC had no jurisdiction to consider the matter further:

[para 22] However, my authority under the Act is to determine whether the collection, use or disclosure of personal information was for journalistic purposes only. Once I have established that the use of personal information was for journalistic purposes only, the Act does not apply and my authority to decide any other issue ceases. Any inquiry into what is a reasonable collection, use and disclosure of personal information, can only come into play if I have jurisdiction to proceed under the Act. In this case, I have determined that the Act does not apply to the matter in question and I can go no further.

At their core, search engines perform a journalistic function: it primarily relates to the dissemination of news and information, and is comprised of material written for publication in the media. On that basis, s. 4(2)(c) of excludes the operation of PIPEDA. The fact that this particular paragraph in PIPEDA refers to “journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose” remains vulnerable to Charter challenge, as was the case in the UFCW case discussed below.

We should remember that Costeja arose in the context of a newspaper article appearing in a search result. If a similar case were to arise in Canada, it would be clear that the search engine, in pointing to a newspaper article, is performing a journalistic function.

However, even if one were to conclude that PIPEDA may facially apply to a search engine’s indexing and serving of content to users, any interpretation of the statute along those lines is unconstitutional both on a separation of powers analysis and under s. 2(b) of the Charter.

Freedom of Expression under the Charter

Any reading of PIPEDA that has the effect of regulating the indexing of public content -- particularly newsworthy content -- and providing links to users via a search engine effectively regulates the expressive activity of the search engine operator and would be very problematic under the Charter. As I intend to argue, doing so would offend s. 2(b) of the Charter and cannot be justified under s. 1.

Given that legislation should be read in a manner that is consistent with the Charter, regulators should interpret PIPEDA in a manner that excludes search engines. As the Chief Justice wrote in R. v. Sharpe, 2001 SCC 2, at paragraph 33:

Supplementing this approach is the presumption that Parliament intended to enact legislation in conformity with the Charter. If a legislative provision can be read both in a way that is constitutional and in a way that is not, the former reading should be adopted. [citations omitted]

It is important to consider whose rights are actually engaged in the RTBF discussion. Clearly we are looking at the rights of a search engine operator to communicate meaning from its indexing of websites. But we also have to be mindful that RTBF affects the rights of the organization that created the linked-to content. They have the right to communicate their content to the public and to use search engines to reach their audiences. Finally, the rights of internet users are also engaged as section 2(b) also includes the right to receive expressive content.^[1] It is clear that the freedom of expression under the Charter limits the government’s ability to regulate the content of communications, but also the mode and timing of such communication.

Here we are not only concerned with a search engine operator’s constitutionally protected right to freedom of expression, but the right of every Canadian to get access to relevant content on the internet via the use of Google’s search engine. This also limits Canadian media outlets’ constitutionally protected right to disseminate its expressive content on the internet.

Any law or the operation of any law that restricts the mode or content of expression violates s. 2(b) of the Charter and must be justified under s. 1 of the Charter. Once a search engine has shown that any legislative provision limits its rights to expression, the onus will be on the government to justify it.

In R. v. Sharpe, the Supreme Court laid out the framework of analysis that a tribunal must follow at paragraph 78:

The question we must answer is whether that limitation is reasonable and demonstrably justified in a free and democratic society.  To justify the intrusion on free expression, the government must demonstrate, through evidence supplemented by common sense and inferential reasoning, that the law meets the test set out in R. v. Oakes, [1986] 1 S.C.R. 103, and refined in Dagenais v. Canadian Broadcasting Corp., [1994] 3 S.C.R. 835, and Thomson Newspapers Co. v. Canada (Attorney General), [1998] 1 S.C.R. 877.  The goal must be pressing and substantial, and the law enacted to achieve that goal must be proportionate in the sense of furthering the goal, being carefully tailored to avoid excessive impairment of the right, and productive of benefits that outweigh the detriment to freedom of expression.

Thus, in order to be justifiable under the Charter, all of the following questions must be answered in the affirmative for this particular application of PIPEDA to be upheld under Section 1 of the Charter:

(a)        Is the limitation prescribed by law?

(b)        Is the legislative objective pressing and substantial?

(c)        Is there proportionality between the limitation on the right and the benefits of the law? This requires answering the following questions:

(i)        Is there a rational connection between the legislative objective and the means in the law meant to achieve that objective?

(ii)        Is the right in issue “minimally impaired”?

(iii)        Is there proportionality between the deleterious and salutary effects of the law? 

There is certainly an argument to be made that RTFB fails on all counts, but the Charter question will likely hinge on the proportionality analysis.

Assuming the limitation would be “prescribed by law”, we have to determine the objective of the legislators and then consider whether it is “pressing and substantial”.

The purpose of the statute is set out in s. 3:

3.         The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

As noted by the Federal Court in State Farm:

[104]        These purposes are reflected in the long title of PIPEDA [emphasis added]:An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act.

[105]        The collection of information in order to properly defend a civil tort action has little or nothing to do with these purposes.

In the State Farm case, the Court determined that “[t]he collection of information in order to properly defend a civil tort action has little or nothing to do with these purposes.”

The Supreme Court’s characterization of the Personal Information Protection Act (Alberta) in Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, 2013 SCC 62, [2013] 3 S.C.R. 733 (“UFCW”) is also helpful, as that law is substantially similar to PIPEDA:

[19]         There is no dispute that PIPA has a pressing and substantial objective. The purpose of PIPA is explicitly set out in s. 3, as previously noted, which states:

3          The purpose of this Act is to govern the collection, use and disclosure of personal information by organizations in a manner that recognizes both the right of an individual to have his or her personal information protected and the need of organizations to collect, use or disclose personal information for purposes that are reasonable.

The focus is on providing an individual with some measure of control over his or her personal information: Gratton, at pp. 6 ff.   The ability of individuals to control their personal information is intimately connected to their individual autonomy, dignity and privacy.  

The purpose of PIPEDA is to protect the privacy of individuals, in a manner that is tempered against the needs of organizations to collect, use or disclose personal information for legitimate purposes, particularly focused on supporting and promoting electronic commerce.

One might even connect PIPEDA’s purposes to the protection of reputation, which has been repeatedly held by the Supreme Court of Canada to be an important value. However, one should note that civil and criminal defamation law has repeatedly been held to be consistent with the Charter because the falsity of the information is a key component. (See Hill v. Church of Scientology of Toronto, [1995] 2 SCR 1130, 1995 CanLII 59 and R. v. Lucas, [1998] 1 SCR 439, 1998 CanLII 815.) Falsity of the information is not integral to the right to be forgotten. Information that is true can still be caught within the European model of RTBF.

There likely is a rational connection between protecting the privacy of individuals and regulating the collection, use and disclosure of their personal information in the course of commercial activity, per (c)(i) above. However, this is not minimally impairing and thus fails the proportionality analysis.

From RJR-MacDonald Inc. v. Canada (Attorney General), [1995] 3 SCR 199 at para. 160), it is clear that only very focused and restricted impairments of the right to free expression can survive Charter challenge:

As the second step in the proportionality analysis, the government must show that the measures at issue impair the right of free expression as little as reasonably possible in order to achieve the legislative objective.  The impairment must be “minimal”, that is, the law must be carefully tailored so that rights are impaired no more than necessary.  The tailoring process seldom admits of perfection and the courts must accord some leeway to the legislator.  If the law falls within a range of reasonable alternatives, the courts will not find it overbroad merely because they can conceive of an alternative which might better tailor objective to infringement . . . On the other hand, if the government fails to explain why a significantly less intrusive and equally effective measure was not chosen, the law may fail.

PIPEDA, if interpreted in a way that would regulate the inclusion of any particular search result, would simply not be minimally impairing. Prohibiting someone from connecting Canadians to information lawfully existing on the internet goes dramatically beyond the legitimate purposes of PIPEDA, particularly where the information is news reporting.

If PIPEDA is applied to search results, the law does not include any mechanisms by which the constitutional right to freedom of expression may be balanced with the interests protected by the legislation. One cannot save legislation by the belief that it will be applied constitutionally. And I cannot imagine a situation where a private corporation can be expected to carry out the difficult task of balancing rights that would be required for any such scheme to survive constitutional muster. This aspect is completely without precedent in Canadian law.

The Supreme Court has long recognized the fundamental importance of freedom of expression, including expression by corporations. PIPEDA, interpreted in this manner, would outlaw the collection, use, or disclosure of personal information for many legitimate, expressive purposes related to seeking information and knowledge. This infringement of the right to freedom of expression is disproportionate to the government’s objective of providing individuals with control over the personal information, particularly information that has been deemed to be newsworthy.

A proposed interpretation of PIPEDA that would include the search engine would also fail on the final proportionality branch. In this branch of the s. 1 analysis, the tribunal has to determine whether there is proportionality between the infringement of the rights of Canadians and the salutary effect of such limitation. As set out by the Supreme Court of Canada in R. v. Sharpe:

102        This brings us to the third and final branch of the proportionality inquiry: whether the benefits the law may achieve in preventing harm to children outweigh the detrimental effects of the law on the right of free expression. The final proportionality assessment takes all the elements identified and measured under the heads of Parliament’s objective, rational connection and minimal impairment, and balances them to determine whether the state has proven on a balance of probabilities that its restriction on a fundamental Charter right is demonstrably justifiable in a free and democratic society.  

One must consider whether the benefit actually achieved in the form of protecting privacy in the context of e-commerce outweighs the affront to the right to provide access to relevant information and to get access to relevant, lawful information. Preventing a search engine from providing access to this search result does little, if anything, to advance this interest.

At this portion of the analysis, one must also consider what expression is being squelched and how close it is to the “core of Charter values”. It is clear that certain kinds of expression are distant from the core of Charter values and can more readily be limited. Providing access to relevant, lawful information is at the core of Charter values:  “individual self-fulfilment, finding the truth through the open exchange of ideas, and the political discourse fundamental to democracy” (R. v. Sharpe, quoting Irwin Toy). Regulating search results would limit expression that cuts to the core of Charter values (and does little to advance the objectives of the legislation).

A court or tribunal is not only focused on the actual speech in question, but also considers what other speech can be “caught in the net” of the impugned legislation. One can readily imagine that a politician seeking election could attempt to have unflattering material removed, even if entirely truthful. If PIPEDA applies and one has to rely on knowledge and consent, the operator of the search engine may have no choice but to remove it as any consent to include it in the index has been revoked.

I also note that such a finding would legally compel a search engine operator to provide incorrect information to its users, which is a disproportionate effect on freedom of expression. When a user enters a query into a search engine, they expect to receive the most relevant results using the search engine’s usual algorithms. Omitting a highly relevant, responsive search result would mislead that user into believing that certain content does not exist, though it continues to exist and remains accessible on the media outlet’s site. This is akin to a student asking a research librarian for everything the library has about a specific individual, but legally requiring the librarian to lie to the patron. The book would remain on the shelf, but the librarian is prohibited from mentioning it.

Similar to the finding of the Supreme Court of Canada in UFCW striking down Alberta’s privacy law, limiting legitimate expression that relates to the core of Charter values of seeking lawful information is “too high a price to pay”:

[20]        PIPA’s objective is increasingly significant in the modern context, where new technologies give organizations an almost unlimited capacity to collect personal information, analyze it, use it and communicate it to others for their own purposes. There is also no serious question that PIPA is rationally connected to this important objective. As the Union acknowledges, PIPA directly addresses the objective by imposing broad restrictions on the collection, use and disclosure of personal information. However, in our view, these broad restrictions are not justified because they are disproportionate to the benefits the legislation seeks to promote.  In other words, “the Charter infringement is too high a price to pay for the benefit of the law”: Peter W. Hogg, Constitutional Law of Canada (5th ed. Supp.), vol. 2, at p. 38-43.

A failure to satisfy any of the questions in the Oakes analysis results in the legislation being found to be unconstitutional. I fully expect that the Federal Court would find applying PIPEDA to create a “right to be forgotten” in this manner to be unconstitutional. I expect this analysis would yield the same result for a standalone right to be forgotten law.

Separation of powers - Constitution Act, 1867 

Under the Canadian constitution, the provincial governments are given exclusive jurisdiction over matters of property and civil rights in each province. Privacy is a matter of civil rights, as is non-criminal law that would mandate the removal of content such as that referred to by the complainant. The federal government bases PIPEDA on the “General Trade and Commerce Power” that is located within s. 91(2) of the Constitution Act, 1867. In order to be valid federal legislation rooted in the general branch of the trade and commerce clause, the law would have to follow the indicia set out in General Motors of Canada Ltd. v. City National Leasing, [1989] 1 SCR 641, 1989 CanLII 133 (S.C.C.) (“General Motors”).  In upholding the Combines Investigation Act as valid federal law under the general branch of s. 91(2), the Chief Justice Dickson at paras. 32 and 34, enumerated five indicia or factors of the valid exercise of the general Trade and Commerce power:

1. The impugned legislation must be part of a general regulatory scheme.
2. The scheme must be monitored by the continuing oversight of a regulatory agency.
3. The legislation must be concerned with trade as a whole rather than a particular industry or commodity
4. The legislation must be of such a nature that the provinces, together or independently, would be constitutionally incapable of enacting it.
5. The failure to include one or more provinces or localities in a legislative scheme would jeopardize the successful operation of the scheme in other parts of the country.

PIPEDA itself rests on a tenuous foundation, as it does not regulate the economy or trade as a whole, but one singular commodity: personal information. Nevertheless, the application of a “right to be forgotten” would rest on an even more shaky foundation as it would be regulating only one activity: the operation of internet search engines.

Final issues

Who is the decision maker?

Even if one were to create a right to be forgotten in Canadian federal law, transplanting the European model of operation into Canada would be grossly problematic. In Europe, the burden is entirely on the search engines to receive applications for removal, to evaluate them and to act upon them. This places the search engine in the position of having to decide, using its own frame of reference, whether the information is out of date, inaccurate or obsolete. The search engine does not know the complainant, does not know the context, does not know if the individual is a public figure and does not know whether the individual has genuinely “moved on with his life”. There may be some scenarios that are relatively easy to deal with, such as revenge porn, but for most cases the search engine will only have the complainant’s submissions to rely upon.

Content providers’ rights

Any process needs to also appreciate that the content provider’s interests are also at stake. Content providers choose to make their materials available online and also choose whether to allow it to be indexed by search engines. Meddling with how such content appears in search engine listings interferes with the ability of content providers to reach their intended audiences. Doing so without their input is very problematic: At the very least, content providers will need to be consulted to provide input on whether the content is “newsworthy”. However, placing the search engines as the arbiters of the content provider’s rights is not fair to the content provider.

Reviving forgotten information

A final consideration would have to be how can one revive forgotten information that becomes relevant again. The last election saw a number of political candidates whose social media activity and other online content came back to haunt them. Most notably, an old video surfaced online of an individual who was working as a plumber who was recorded urinating into a customer’s coffee cup. When it surfaced, the plumber was running as a candidate for Parliament. One can readily imagine scenarios in which someone with political ambitions will seek to have content suppressed before seeking a nomination. If successful, relevant information about the candidate’s history and character many be indelibly lost.  

Conclusion

While aspects of the right to be forgotten can be compelling, particularly for privacy advocates like myself, it is a concept that cannot find a Charter-resistant foothold either within PIPEDA or some other means in Canadian law.

 

David TS Fraser is lawyer with McInnes Cooper, where his practice is exclusively devoted to internet and privacy law. David is also a part-time faculty member at Dalhousie Law School and an associate of the Institute of Law and Technology. The views expressed in this paper are solely those of the author and should not be attributed to the firm or any of its clients.

[1] See Edmonton Journal v. Alberta (Attorney General), [1989] 2 SCR 1326, 1989 CanLII 20. Harper v. Canada (Attorney General), [2004] 1 SCR 827, 2004 SCC 33:

17        Freedom of expression protects not only the individual who speaks the message, but also the recipient. Members of the public —  as viewers, listeners and readers —  have a right to information on public governance, absent which they cannot cast an informed vote; see Edmonton Journal, supra, at pp. 1339-40.  Thus the Charter protects listeners as well as speakers; see Ford v. Quebec (Attorney General), 1988 CanLII 19 (SCC), [1988] 2 S.C.R. 712, at pp. 766-67.
18        This is not a Canadian idiosyncrasy.  The right to receive information is enshrined in both the Universal Declaration of Human Rights, G.A. Res. 217 A (III), U.N. Doc. A/810, at 71 (1948), and the International Covenant on Civil and Political Rights, Can. T.S. 1976 No. 47.  Canada is a signatory to both.  American listeners enjoy the same right; see Red Lion Broadcasting Co. v. Federal Communications Commission, 395 U.S. 367 (1969), at p. 390; Martin v. City of Struthers, 319 U.S. 141 (1943), at p. 143. The words of Marshall J., dissenting, in Kleindienst v. Mandel, 408 U.S. 753 (1972), at p. 775, ring as true in this country as they do in our neighbour to the south: [T]he right to speak and hear —  including the right to inform others and to be informed about public issues —  are inextricably part of [the First Amendment]. The freedom to speak and the freedom to hear are inseparable; they are two sides of the same coin. But the coin itself is the process of thought and discussion. The activity of speakers becoming listeners and listeners becoming speakers in the vital interchange of thought is the means indispensable to the discovery and spread of political truth. [Citations omitted.]