A landmark case from the European Union’s top court could spur Canada to create its own “right to be forgotten” laws, says cybersecurity lawyer Peter Dillon in a recent interview with AdvocateDaily.com.
See the full article below.
Google’s landmark win could set precedent for Canada
By Mia Clarke, AdvocateDaily.com Associate Editor
A landmark case from the European Union’s top court could spur Canada to create its own “right to be forgotten” laws, says London, Ont. cybersecurity lawyer Peter Dillon.
“This could set a precedent for the rest of the world,” says Dillon, a partner with Siskinds LLP, where he heads the firm’s Technology, Franchise and Privacy Law Groups.
“Canada could follow suit,” he tells AdvocateDaily.com.
According to a BBC report, the European Union’s top court said Google does not have to apply the right to be forgotten outside of Europe.
The decision means that the global search engine giant, after receiving an appropriate request to remove damaging or inaccurate information, only has to remove links from search results in Europe, the BBC reports.
“Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject… to carry out such a de-referencing on all the versions of its search engine,” states the European Court of Justice ruling.
Under the EU’s General Data Protection Regulations (GDPR), citizens can demand that data about them be deleted, explains Dillon. In the case of search engines, this means removing links. With other businesses, when a person makes the request, as soon as the organization “is done using the data for its original purpose, it must delete it,” he says.
In Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA), this right to be forgotten doesn’t exist, says Dillon.
“But individuals can still withdraw consent to the use of their information at any time — subject to legal or contractual restrictions — provided reasonable notice is given,” he says.
“Organizations must also delete it as soon as they are finished doing what they originally said it was for.”
As for de-indexing in Canada, Dillon says the law isn’t entirely clear on the subject.
The Office of the Privacy Commissioner (OPC) presented a legal interpretation on whether Google’s search engine is subject to Canada’s PIPEDA.
The OPC then asked the Federal Court for clarity on the issue, according to an article in the Financial Post. But a Federal Court adjudicator ruled that it won’t delve into the constitutional questions wrapped up in the matter.
Google is appealing the decision, the BBC reports.
In the meantime, says Dillon, nothing changes for Canadian citizens and companies based in this country.
“For Canadian companies doing business in or from Europe, still not a whole lot has changed. If they were dealing with data or with people, they were already subject to the GDPR.”