No, The Canadian Supreme Court Did Not Ruin the Internet

Last week, the Canadian Supreme Court upheld a ruling by the Court of Appeal for British Columbia that required Google to delist—remove from its search results—links to a website that appears to violate Canadian law (the result of an intellectual property dispute between Equustek and Datalink that otherwise does not involve Google; for more background on the case, see coverage here, here, and here.)

The parties do not dispute Canada’s authority to settle the underlying lawsuit between Equustek and Datalink, nor do they dispute Canada’s authority to enjoin Google from displaying content that violates Canadian law. Rather, the parties dispute the territorial reach of that authority. The question is: How should a Canadian court fashion a remedy for harmful online content?

Let’s consider three possible remedies:

1. By Country Domain: Remove the offending material from Google.ca (but allow someone in Toronto to find it via google.com). This is Google’s preferred remedy.
2. By User Location: Remove the offending material for users reasonably believed to be in Canada, regardless of which Google domain they visit (google.ca or google.com).
3. Worldwide: Remove the offending material “worldwide” – meaning across domains like google.ca and google.com, for all users, wherever they are located.

Google initially urged the Canadian court to accept the first remedy, but it is the least satisfactory of the three. It is simply too easy for Canadian users to circumvent the local version of Google by typing into their browser “www.google.com.” (In fact, Google.ca tells users that they are using a local version of the product based on their location, alerting naïve users to the existence of an alternative Google.com.)

The second remedy—based on user location—solves this problem, and theoretically offers a clean way to have country-wide Internet policies begin and end at the border. But this approach faces two standard critiques. The first is that Google (or another service provider) would have to identify its users’ locations, which might be hard or expensive for Google. While this is might be a compelling argument for a firm that has irregular contact with its customers and no way to track them, it is not a compelling argument against Google. The firm has built an entire advertising empire around its ability to identify users’ personal attributes, including their location. The second and more compelling critique of a location-based remedy is that users can take steps to spoof their location—by, for example, deploying a VPN. This is not as easy as simply toggling over to another website, but it is still not very hard.

Yet the number of people using VPNs to spoof their location, however large, is considerably smaller than the number of people who can type “www.google.com,” so user location is still a better vehicle for making the Internet behave in Canadian ways for all users located in Canada. Moreover, Google can take steps to combat location spoofing—indeed, this is an issue Google, Spotify, Netflix, and other media companies must deal with on a regular basis in order to comply with the licensing agreements struck with artists.

In fact, Google has already embraced a remedy based on user location in other countries. Google has been in a longstanding dispute with the French data protection authority, the CNIL, over how to implement content removal requests under the so-called right to be forgotten. After France rejected Google’s efforts at a domain-level fix, Google turned to the second remedy and now deploys geo-blocking to delist offending material across all versions of Google’s products for user’s who appear to be in France. But France’s data authority is not satisfied with this solution, and neither, apparently, is Canada’s Supreme Court. From the state’s perspective, the best remedy—the one that maximally protects the interests of the party legitimately seeking content removal—is one that removes the offending content everywhere.

This brings us to the third remedy, the global injunction deployed in Equustek. The injunction has caused a great deal of concern. Eugene Volokh called the decision “potentially quite dangerous,” and Daphne Keller called it “ominous.” Google naturally fought it, but so did a number of civil society groups who weighed in with amicus briefs. These groups included: the Electronic Frontier Foundation, Article 19, Wikimedia Foundation, and more. The briefs filed by these groups, like Google’s, argued that global takedown orders like Canada’s were problematic because one state should not be able to exert control over how the Internet behaves worldwide.

The only problem with this argument, of course, is that it happens all the time.

Compare, for example, the Equustek case with Microsoft’s dispute with the Department of Justice over ECPA’s territorial reach. In the Microsoft Ireland case, many civil society groups argued for a world in which American tech firms only comply to foreign law enforcement requests when those requests satisfy American due process standards. Reading the Microsoft Ireland briefs alongside the Equustek briefs gives one the sense that it would be very bad for Internet firms to follow Canadian laws in the U.S., but not bad for them to follow American laws in Ireland. Perhaps this is simple American exceptionalism at work, or perhaps it reflects a considered view that law enforcement access to data is different from takedown requests; I don’t know. What it is not, however, is a consistent theory of jurisdiction.

The real fear in Equustek, of course, is not Canada or the intellectual property dispute at the heart of the case, but rather Europe and free speech. If France attempted to change Google’s search results in New York—by asking Google to implement a delisting request worldwide—that would strike many as problematic. And with good reason: France should not have the ability to limit the speech rights of New Yorkers.

But I am not sure that that concern is really relevant to the Equustek case specifically—or the third remedy more generally. The concern cannot be over French regulations having some effect on people in the U.S. Rather, the concern is that France’s regulations would compel Google to violate American law. In such a scenario, we would expect Google to notify the court about the conflict of laws and ask for relief. Tellingly, that did not happen in Equustek, as the court emphasized:

Google’s argument that a global injunction violates international comity because it is possible that the order could not have been obtained in a foreign jurisdiction, or that to comply with it would result in Google violating the laws of that jurisdiction, is theoretical. If Google has evidence that complying with such an injunction would require it to violate the laws of another jurisdiction, including interfering with freedom of expression, it is always free to apply to the British Columbia courts to vary the interlocutory order accordingly. To date, Google has made no such application.

Global takedown orders with no limiting principle are indeed scary. But Canada’s order has a limiting principle. As long as there is room for Google to say to Canada (or France), “Your order will put us in direct and significant violation of U.S. law,” the order is not a limitless assertion of extraterritorial jurisdiction. In the instance that a service provider identifies a conflict of laws, the state should listen. Under longstanding conflicts of laws principles, a court would need to weigh the conflicting and legitimate governments’ interests at stake. The Canadian court was eager to undertake that comity analysis, but it couldn’t do so because the necessary ingredient was missing: there was no conflict of laws.

Google’s response to this sort of regime, as Daphne Keller points out, is that it would require them to identify potential conflicts of laws. I’ll leave it for another time to address whether such an extraordinarily wealthy company can manage the heavy burden of determining whether it can comply with a given legal order… but I suppose you can guess what I think. For as long as they have existed, global firms have had to figure out how to comply with the laws of the states where they operate. When those obligations conflict, the company has a number of tools at its disposal, including asking a court for a little help.