Chris Donnelly: The Right to be Forgotten – Can this work in Canada?

 “The right to be forgotten, also known as the erasure law, has undoubtedly been met with some controversy. There are those who fully support the right of an individual to safeguard anything that is written and searchable about them. If the information no longer fits the person’s lifestyle, beliefs, or is not criminal in nature, does this removal of data and information impact anyone? On the other hand, there are those who believe that once something is written, or made available in the public domain, that this should exist forever, regardless of a person’s current situation.” The Right to be Forgotten – Can this work in Canada?

Chris Donnelly, MIM Class of 2018

 

In celebration of the 10^th anniversary of the Master of Information Management, Dr. Sandra Toze arranged a virtual interview with Chris Donnelly, Senior Functional Analyst, Business Intelligence at RCMP and the 2018 recipient of the prestigious SIM Director’s Award, given to the MIM grad with the highest overall GPA.  Chris focused his research on a question that has significant implications on how individuals, indeed our society, will manage privacy and the right to be forgotten.

Chris has been a student of Dalhousie University for nine of the past 18 years, first graduating from the Faculty of Management’s Bachelor of Commerce Co-op program in 2005, with a major in Finance, which led him to a brief stint in banking, followed by a fulfilling career with the Government of Canada. Since 2008, Chris has been working as a functional systems analyst, specifically with enterprise resource planning and data analytics-based applications.  Realizing a gap in his knowledge base, and wanting to enhance his current role, he re-applied to Dalhousie, and was accepted into the MIM program in 2014.   He offered this thought to students who feel that their journey may never end, “there really is light at the end of the tunnel. A robust academic program is rewarding and worth the effort.  In my experience, the MIM provided insight into strategic and knowledge-based thinking and the opportunity to connect with remarkable peers and mentors.”

CEGE Connection is thrilled that Chris has generously agreed to share his research that provides invaluable insight and a Canadian perspective on the issues surrounding the complex right to be forgotten.   We invite you to join the conversation.

Chris Donnelly:

In 2014, the European Union (EU) enacted the concept of the right to be forgotten into law when a ruling against Google was handed down, granting a Spanish citizen’s request to have any links to his financial hardship that occurred 15 years prior. This citizen was successful in de-linking any articles relating to him from a Google search. While the articles may still be available, any direct links via Google were removed. Fast-forward four years later. Since this landmark case, Google has since received requests to remove more than 2.43 million URLs for sites alone since this ruling and has since removed about 43 percent (or 1.05 million) of these URLs (Doubek, 2018).

Google has since received requests to remove more than 2.43 million URLs for sites alone since this ruling and has since removed about 43 percent (or 1.05 million) of these URLs (Doubek, 2018).

So, who is ensuring that companies such as Google are in compliance, and are responsible for processing these requests?

Enter the General Data Protection Regulation (GDPR). The GDPR covers requirements and guidelines regarding the gathering and processing of ‘people data,’ personally identifiable information of individuals and citizens within the EU (Wikipedia, 2018). This regulation is enforced, and applies to all organizations, regardless of location, that has dealings with the EU. Implemented on May 25th, 2018, this regulation aims to further protect citizens by ensuring that their data and information are stored securely, describe how the data is stored and protected, providing greater clarity and transparency on privacy, and how these citizens may be able to access their own data.

Should an individual be able to seek protection from themselves? Meaning, is it important that an individual have the right to have their data erased no matter the circumstances? This ongoing debate may take years to resolve in the EU. Which begs another question, how may Canadians be impacted?

Furthermore, in conjunction with the right to be forgotten legislation, citizens have the right to request their data be erased, based on lawfulness, relevance, or other factors. This legislation protects private citizens when dealing with businesses. Should an individual be able to seek protection from themselves? Meaning, is it important that an individual have the right to have their data erased no matter the circumstances? This ongoing debate may take years to resolve in the EU. Which begs another question, how may Canadians be impacted?

Close to home, no legislation exists within Canada that offers an individual the right to be forgotten, neither through business nor social media. Why is this?

Canadians spend hours a day online, using social media and blogging. Thoughts are shared, and opinions are formed. Debates and dialogues ensue. Many online public forums, including social media are open for everyone to see, despite privacy settings. Should the Canadian government protect us as citizens against ourselves? Or should we be personally accountable for our online content, no matter the age, mental state or background? This may be hard to tell. Indeed, adults should be aware of taking precautions and be mindful as to the perks and pitfalls of the Internet. A general rule of thumb is that if you post or share something online, it will be there forever. Nevertheless, not everyone knows these perks and pitfalls; nor do some even care of the detriment they may be causing themselves.

Should the Canadian government protect us as citizens against ourselves? Or should we be personally accountable for our online content, no matter the age, mental state or background? This may be hard to tell. Indeed, adults should be aware of taking precautions and be mindful as to the perks and pitfalls of the Internet. A general rule of thumb is that if you post or share something online, it will be there forever.

Adults may have to atone for their actions, but what about children and adolescents?

Children and adolescents are undoubtedly impressionable. In many cases, does being naïve or poorly informed the right to request to have links to something that may have been published on social media erased? Or deleted altogether? California has enacted legislation protecting adolescents and children by allowing the ability to wipe the online content that they have posted. A website must disclose what data is being collected and used by the site on behalf of the minor. Based on the information provided, parents then have the right to prohibit the website’s operator from collecting data and information and can request to have this deleted.

All this to say, there may be a disconnect between the right to be forgotten, the right to the freedom of expression, and privacy. In Canada, we are taught at a very young age to express ourselves, and that we are fortunate enough to live in a country where we have the freedom to do so. On the other hand, we also have the right to privacy and protection. Expression vs. privacy, who wins? There may be more at play here, such as what is the limit of expression, but more importantly, the redefinition of what privacy truly means. If someone expresses an opinion that is not directly harmful to the reputation of an individual, nor criminal in nature, is there indeed any undue harm?

All this to say, there may be a disconnect between the right to be forgotten, the right to the freedom of expression, and privacy. In Canada, we are taught at a very young age to express ourselves, and that we are fortunate enough to live in a country where we have the freedom to do so. On the other hand, we also have the right to privacy and protection. Expression vs. privacy, who wins? 

Which leads to the redefinition of privacy in the digital age. Almost all millennials grew up as digital natives, and many have had an online presence since they were in grade school. As a result, their social media presence has been years in the making. Therefore, their data and information have not been private in the traditional sense for most of their lives. How does this impact Canadians in the future? A redefinition as to what is considered private versus what may be made available publicly is essential. Granted, specific personal information such as name, gender, beliefs, should be safeguarded and only released by the individual who owns this information. Other information posted in a public setting may be readily available if the information is not detrimental to the individual. Ultimately, we as a society, have to determine how we proceed in handling this.

Almost all millennials grew up as digital natives, and many have had an online presence since they were in grade school. As a result, their social media presence has been years in the making. Therefore, their data and information have not been private in the traditional sense for most of their lives. How does this impact Canadians in the future? 

Where the right to be forgotten could become a problem in Canada is if there is a difference in opinion between the private citizen and the online source of information. If the information is factual, and provides protection for other Canadians, specifically in criminal matters, the right to be forgotten is not a vehicle that may be available to those who wish to re-write history. A recent poll suggests that Canadians are not ready for an erasure law within Canada as 58% of respondents feel that links and information about an individual should not be erased (Watson, 2018). Greater sample size may change these results; however, this may indicate that while Canadians are aware of the right to be forgotten, they may not be fully ready to embrace this concept within their borders. Despite these statistics, in nations where democracy is prevalent, more and more citizens are stepping up and voicing their concern over the type of data and information that is being captured. Citizens are becoming increasingly aware of their rights and the type of data retention policies that companies are enacting. It may be only a matter of time before similar legislation is enacted within our borders.

If the information is factual, and provides protection for other Canadians, specifically in criminal matters, the right to be forgotten is not a vehicle that may be available to those who wish to re-write history. A recent poll suggests that Canadians are not ready for an erasure law within Canada as 58% of respondents feel that links and information about an individual should not be erased (Watson, 2018). 

The concept of the right to be forgotten and erasure laws are undoubtedly controversial. As Canadians become increasingly more educated as to how our data is used, captured, and what is written about us, we will inevitably become more concerned as to the intended use of our information. As privacy definitions change, and as Canadians become prudent as to what is shared, a demand will surface that will leave Canadian law makers with little choice but to consider similar legislation to the right to be forgotten and the GDPR within our borders.

Whether Canadians fully embrace this remains to be seen. Stay tuned.

Chris Donnelly, 2018

References

Doubek, J. (2018, February 28). Google Has Received 650,000 ‘Right To Be Forgotten’ Requests Since 2014. Retrieved April 28, 2018, from The Two Way: NPR: https://www.npr.org/sections/thetwo-way/2018/02/28/589411543/google-received-650-000-right-to-be-forgotten-requests-since-2014

Watson, H. (2018, April 12). Do Canadians Want the Right to be Forgotten? Retrieved June 23, 2018, from J Source – The Canadian Journalism Project: http://j-source.ca/article/do-canadians-want-the-right-to-be-forgotten/

Wikipedia. (2018, July 21). General Data Protection Regulation. Retrieved July 21, 2018, from Wikipedia, the Free Encyclopedia: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation