BC Freedom of Information and Privacy Association
Your Data Your Rights
The Right to Erasure
This is the third in our series on the privacy promises we can expect from a Liberal minority government.
Information about the Right to Erasure is from Innovation, Science and Economic Development Canada’s ‘Digital Charter: Trust in a digital world’, and the Liberal Party of Canada’s election 2019 platform document, ‘Forward: A real plan for the middle class’ (40).
The Promise
In the Liberal Party’s election platform, they committed to
a new online right to “withdraw, remove, and erase basic personal data from a
platform” (40). This seems to build and expand upon the third principle
contained within Canada’s Digital Charter:
“Control and Consent: Canadians will have control over what data they are sharing, who is using their personal data and for what purposes, and know that their privacy is protected.”
– Canada’s Digital Charter
Unclear within this promise are two major things: what is defined as a platform; and how this new right will be different from what is currently contained within Canada’s private sector privacy legislation, the Personal Information and Protection of Electronic Documents Act.
And, on the surface, it would appear that this new right does not go as far as the European Union’s ‘Right to be Forgotten’, which is found within the General Data Protection Regulations, and allows citizens to request that personal data be erased for a host of reasons and from entities not limited to “platforms”. Notably, this includes making requests to delist website pages in search results.
The Office of the Privacy Commissioner of Canada is currently seeking a determination from the Federal Court in order to clarify whether Google’s search engine is subject to PIPEDA. Thus, it may turn out that Canadians already have the ability to request that search engine’s de-index web pages that are responsive to a person’s name should they present unwarranted reputational harm.
The Reality
So far it’s unclear how this new right to erasure goes further than the access and correction rights that currently exist within Canada’s federal privacy legislation, the Privacy Act and PIPEDA, and B.C.’s provincial privacy legislation, FIPPA and PIPA.
Currently, PIPEDA does provide Canadians with some measure of control over their personal information. It does this by allowing individuals to correct the accuracy of their personal information in the control of a private organization, to withdraw their consent for the use of personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada in order to create a record of dispute.
While these are not equivalent measures to the European Union’s ‘Right to be Forgotten’, they do allow Canadians some measure of control over their personal information and at the very least present a mechanism for addressing issues related to online reputational harm. In addition, PIPEDA also contains provisions that limit the amount of time that personal information can be retained, which in turn helps to ensure that personal information is disposed of when it is no longer required.
The Future
Important questions remain though about how effective these measures are in a digital environment. PIPEDA was created in 2000, as the internet and digital technologies were only emerging. Today, the internet is being used in ways, and on devices, that could not have been predicted 20 years ago.
With private organizations becoming increasingly reliant on personal information as a fundamental component of their business model, and the storage of personal information no longer experiencing the same physical and financial constraints, more needs to be done to protect consumers and to rebuild trust.
If Canada’s federal privacy legislation is amended to contain this new right to erasure, it may create the need to amend provincial privacy legislation to also include this new right in order to retain its equivalency. As well, new powers will need to be ascribed to provincial and federal information and privacy commissioners in order for them to be able to enforce new digital rights, like the Right to Erasure.
This is the third in our series on the privacy promises we can expect from a Liberal minority government.
Information about the Right to Erasure is from Innovation, Science and Economic Development Canada’s ‘Digital Charter: Trust in a digital world’, and the Liberal Party of Canada’s election 2019 platform document, ‘Forward: A real plan for the middle class’ (40).
The Promise
In the Liberal Party’s election platform, they committed to a new online right to “withdraw, remove, and erase basic personal data from a platform” (40). This seems to build and expand upon the third principle contained within Canada’s Digital Charter:
“Control and Consent: Canadians will have control over what data they are sharing, who is using their personal data and for what purposes, and know that their privacy is protected.”
– Canada’s Digital Charter
Unclear within this promise are two major things: what is defined as a platform; and how this new right will be different from what is currently contained within Canada’s private sector privacy legislation, the Personal Information and Protection of Electronic Documents Act.
And, on the surface, it would appear that this new right does not go as far as the European Union’s ‘Right to be Forgotten’, which is found within the General Data Protection Regulations, and allows citizens to request that personal data be erased for a host of reasons and from entities not limited to “platforms”. Notably, this includes making requests to delist website pages in search results.
The Office of the Privacy Commissioner of Canada is currently seeking a determination from the Federal Court in order to clarify whether Google’s search engine is subject to PIPEDA. Thus, it may turn out that Canadians already have the ability to request that search engine’s de-index web pages that are responsive to a person’s name should they present unwarranted reputational harm.
The Reality
So far it’s unclear how this new right to erasure goes further than the access and correction rights that currently exist within Canada’s federal privacy legislation, the Privacy Act and PIPEDA, and B.C.’s provincial privacy legislation, FIPPA and PIPA.
Currently, PIPEDA does provide Canadians with some measure of control over their personal information. It does this by allowing individuals to correct the accuracy of their personal information in the control of a private organization, to withdraw their consent for the use of personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada in order to create a record of dispute.
While these are not equivalent measures to the European Union’s ‘Right to be Forgotten’, they do allow Canadians some measure of control over their personal information and at the very least present a mechanism for addressing issues related to online reputational harm. In addition, PIPEDA also contains provisions that limit the amount of time that personal information can be retained, which in turn helps to ensure that personal information is disposed of when it is no longer required.
The Future
Important questions remain though about how effective these measures are in a digital environment. PIPEDA was created in 2000, as the internet and digital technologies were only emerging. Today, the internet is being used in ways, and on devices, that could not have been predicted 20 years ago.
With private organizations becoming increasingly reliant on personal information as a fundamental component of their business model, and the storage of personal information no longer experiencing the same physical and financial constraints, more needs to be done to protect consumers and to rebuild trust.
If Canada’s federal privacy legislation is amended to contain this new right to erasure, it may create the need to amend provincial privacy legislation to also include this new right in order to retain its equivalency. As well, new powers will need to be ascribed to provincial and federal information and privacy commissioners in order for them to be able to enforce new digital rights, like the Right to Erasure.