Google wants to keep HIV status of underage Canadian in search results
Canada’s data protection authority wants to enforce a version of the “right to be forgotten” that is reduced to a specific risk. Google is not playing along.
Google refuses to accept the Canadian version of the“right to be forgotten“, even though it is significantly reduced and better protected against abuse than the European version. Google’s refusal poses a problem for the monarchy’s weak data protection authority. The starting point of the dispute is media reports found via Google’s search engine about the arrest and prosecution of an HIV-positive, underage person, probably over a decade ago.
The person was once accused of not disclosing their HIV status prior to sexual contact. Canadian media reported on this, citing the person’s full name and sexual orientation. The data protection authority does not consider the reports to be a violation of the law.
However, the charges against the minor were quickly dropped because the results of the investigation showed that the person had never posed a risk to the health of others. Canada’s federal prosecutor generally does not prosecute cases where there was no realistic risk of infection. But if you enter the person’s name into Google’s search engine, you will still find the media reports about the arrest and charges for the alleged sexual offense at the top.
The consequences for the person are dire: physical attacks, difficulties finding work, social ostracism. She would like hyperlinks to outdated media reports to no longer appear in Google’s search results when her name is entered. When Google refused, the complainant turned to the Office of the Privacy Commissioner of Canada in 2017.
The Office opened proceedings, but Google claimed that the authority was not allowed to investigate the search engine. It was used for journalistic purposes, for which the Canadian federal data protection law PEPIDA provides an exception. The authority went to court and won a declaration at both first (2021) and second instance (2023) that “every part” of the search engine is covered by the Canadian federal privacy law PEPIDA, especially as the search does not exclusively serve journalistic purposes.
Nevertheless, Google still refuses to suppress the hyperlinks to the media reports when a person’s name is entered. The authority is by no means demanding that the media reports be deleted from the index altogether. They may continue to be linked when other search terms are entered, but this should no longer happen when the name of the person concerned is entered. To this end, the data protection authority refers to a central rubber paragraph of the law (PEPIDA paragraph 5 section 3): “An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” (E.g.: Organizations may collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances).
Under certain limited conditions, it follows that search results may be unlawful: If the search results are likely to cause significant harm to an individual, and this outweighs the public interest in the search results when the individual’s name is entered.
In this particular case, this public interest, if any, was low because the person in question was not a person of public interest and the media reports revolved around highly sensitive information about private life, not public activities or working life. Furthermore, the charges were quickly suspended; according to current guidelines, they would hardly ever have been brought.
Although there is public discourse about criminal sanctions for undisclosed HIV status, the public can find the specific media reports via thematic search terms; the ability to find them via a person’s name does not contribute significantly to the discourse.
Most of the linked articles would report incompletely and misleadingly, as they do not mention the subsequent resting of the charges. They also fail to mention the federal and provincial guidelines for not pressing charges without risk of infection. Without this context, readers could gain a false impression, which could seriously harm the person named. In general, the articles were published many years ago, which also reduces the public interest in linking to them.
By continuing to disseminate the links after entering the person’s name, Google permanently violated the cited legal provision. However, the Canadian Federal Data Protection Agency can neither impose fines nor impose conditions; it is limited to recommendations. Google does not want to implement these.
“Individuals have the right under Canadian privacy law to have information about themselves removed from online search results after entering their name in certain circumstances where there is a significant risk of harm that outweighs the public interest in that information being made available through such a search,” says Canada’s Privacy Commissioner Philippe Dufresne. His authority will “consider all available options to ensure Google’s compliance with the law.” What this will look like remains to be seen.
The Canadian data protection authority’s access to a “right to be forgotten” has the advantage over the European model of less potential for abuse. Legal web content is not to be deleted from the search index as a matter of principle; rather, the focus is on protecting those affected. Anyone searching specifically for such content should not be able to easily find content that is dangerous for those affected, while other search terms will continue to lead to the target. The fact that a person’s name is also listed there has little effect on people who are largely unknown.
In the European model, the webpage as a whole is regularly filtered out of the search results, regardless of the search term. This leads to abuse if user comments are published on the same webpage. Anyone who doesn’t like a media report, for example, writes a “drunk” post underneath it. The poster is soon “embarrassed”, which is why he requests the search engines to suppress the webpage. The search engines have to obey. The operators of the affected website never find out about the delisting, which the European “affected party” has enforced without a court ruling.
