Canadians can de-list some information from search engine results: federal privacy commissioner

Following an investigation of Google, the Office of the Privacy Commissioner of Canada (OPC) has noted that individuals have a right, in limited circumstances, to the de-listing of certain information about them from online search engine results 

In the OPC’s press release, Philippe Dufresne, federal privacy commissioner, said de-listing was possible when a significant risk of serious harm to a person outweighed the public interest in keeping the information accessible via search. De-listing would prevent the display of the information upon an online search of the individual’s name. 

The OPC said certain factors would favour de-listing information in online searches for a person’s name when such information would likely seriously risk harm to the individual. These factors 
included the following: 

• The person was not a public figure 
• The matter did not concern a matter of public debate 
• The information was inaccurate or outdated 
• The information pertained to the individual when they were a minor 
• A significant amount of time had gone by since the information’s publication 

In the press release, Dufresne noted that the right to de-listing under the Personal Information Protection and Electronic Documents Act, 2000 (PIPEDA) generally aligned with rights under the European General Data Protection Regulation (GDPR) and Quebec’s private sector privacy law. 

Dufresne added that the right to de-listing required a cautious balancing of a person’s fundamental privacy rights and the right to free expression under the Canadian Charter of Rights and Freedoms. 

Complaint against Google

The OPC’s press release provided the context for the matter leading to its investigation. In this case, an individual faced a criminal charge, which the authorities dropped shortly after laying it. 

Years later, online searches for the individual’s name continued to yield results with news articles regarding the charge and included highly sensitive personal information. 

In 2017, the individual filed a complaint against Google to allege direct harm, such as physical assault, lost employment opportunities, and severe social stigma.

At the investigation’s early stages, Google challenged the privacy commissioner’s jurisdiction and asserted that PIPEDA obligations did not bind its search engine. 

In 2021, the Federal Court ruled that each component of the Google search engine’s business model was a commercial activity under PIPEDA and that the search engine did not collect, use, or disclose personal information exclusively for journalistic reasons. 

In October 2023, the Federal Court of Appeal affirmed this ruling. 

After the investigation, Dufresne decided that continuing to display the individual’s personal information upon an online search for their name risked harm to their safety or dignity, which outweighed the public interest in keeping the information accessible through a search. 

Dufresne determined that Google breached PIPEDA. Dufresne said the company should de-list the articles and prevent them from appearing in a search of the individual’s name to meet its PIPEDA obligations. 

The OPC noted that the articles would still exist online, accessible via the websites that originally published them and searchable on the search engine via searches for terms except the individual’s name. 

The OPC shared that it was weighing its options to ensure Google’s PIPEDA compliance because the company refused to implement the commissioner’s recommendation to de-list the articles. 

CBC reported that a Google spokesperson said the company was reviewing the OPC report and maintaining its “view that consideration of a so-called ‘right to be forgotten’ must be appropriately balanced with the freedom of expression and access to information rights of Canadians, the news media and other publishers, and therefore should be determined and defined by the courts.”