Does the “right to be forgotten” exist in Canada? Can Canadians ask Google to take down search results containing their personal information?
The latter question was answered in a 29 September court case between Canada’s Office of the Privacy Commissioner (OPC) against Google. The ruling clears the way for the courts to address the other issue: Whether Canada has a “right to be forgotten”.
This article consists of two parts. The first explores the European origins of the much-misunderstood “right to be forgotten”. The second considers whether the courts could find that such a right exists in Canada.
The origins of the right to be forgotten
The phrase “the right to be forgotten” derives from a 2014 EU court case known as Google Spain, which found that search engines are “controllers” under EU data protection law when they store and index personal data published by third-party websites.
The case was brought by Spanish national Mario Costeja González, who, after typing his name into Google one day in 2009, noticed two links to an article about himself in the Spanish newspaper La Vanguardia.
La Vanguardia’s article dated from 1998, and concerned some legal issues Costeja Gonzalez was having at the time. The paper had published an announcement about the sale of Costeja Gonzalez’s house, which was auctioned off to recover his social security debts.
Costeja Gonzalez contacted La Vanguaria to request deletion of the article, and he asked Google to delete the links.
Both companies refused his requests, so Costeja Gonzalez submitted complaints about them to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD).
AEPD complaints
The AEPD rejected Costeja Gonzalez’s complaint against La Vanguaria. The regulator declined to order the newspaper to delete the article in question, as it was published under a law designed to publicize state auctions of properties.
But the AEPD upheld Costeja Gonzelez’s complaint against Google, deciding that the search engine was responsible for processing personal data when indexing links to content created by third parties.
Google took the AEPD to court, arguing that it was not liable under the EU’s Data Protection Directive (which was replaced by the General Data Protection Regulation or “GDPR” in 2016).
The Court of Justice of the European Union (CJEU) ruled in favor of the AEPD, finding that Google and other search engines are “controllers” and must consider requests from data subjects to delete or deindex search results containing their personal data.
Download: A comprehensive guide to privacy law in Canada
This free ebook guide empowers you with expertise and guidance to champion a privacy-centric approach in your business (and avoid fines!). We cover the foundations of privacy legislation in Canada, introducing PIPEDA and other relevant laws.
- An understanding of the Canadian privacy law landscape
- Canadian compliance challenges specific to certain industries
- The role of technology in ensuring PIPEDA compliance
The right to erasure
As noted, Google Spain was decided under the EU’s older data protection regime. But four years after the judgment, the phrase “the right to be forgotten” made it into the GDPR—tacked on in parentheses after Article 17’s title: “The right to erasure”.
The “right to be forgotten” is arguably a misleading subtitle for this GDPR provision. Erasing personal data begins with a request to the controller—and there is no guarantee that the controller will comply.
The right to erasure is available under six grounds, including where the personal data has been used unlawfully, where the data is no longer needed, or, sometimes, when the individual just wants it deleted.
That last ground is most relevant to Google’s search activities and can be found at Article 17 (1) (c) of the GDPR.
Balancing rights
Search engines normally rely on the legal basis of “legitimate interests” to process personal data included in search results.
As such, data subjects have the right to request the erasure of their personal data merely because they object to the search engine continuing to process it.
But this right is not absolute. The search engine may refuse the data subject’s request if it can demonstrate that it has “compelling legitimate grounds” that outweigh the data subject’s rights.
In Google Spain, the CJEU noted that a search engine might have good reasons to refuse a request to de-index web pages.
For example, if a request comes from a well-known public figure, the individual’s rights might be outweighed by the general public’s interests in accessing information about that person.
But in general, a data subject’s rights will outweigh both the economic interests of the search engine and the general interests of the public.
In such cases, the search engine must comply with the data subject’s request by erasing or de-indexing the personal data.
The right to be forgotten under Canada’s PIPEDA
Canada’s data protection law, the Personal Information and Protection of Electronic Documents Act (PIPEDA), does not contain an explicit right to erase personal data.
However, deletion of personal information is mentioned under Section 4.9.5 of the law, in connection with the principle of “individual access”.
PIPEDA requires organizations to inform individuals of “the existence, use, and disclosure” of their personal information, and to “give access” to the information on request.
If an individual can demonstrate that personal information about them is inaccurate, then the organization must “amend the information as required”. This might be correcting the information, adding further information, or – crucially – deleting the information.
Google vs OPC
Do the above PIPEDA obligations constitute a Canadian “right to be forgotten” applicable to search engines, as in Google Spain?
The recent development in Google vs OPC answers a slightly different, preliminary question: Does PIPEDA apply to Google’s search indexing activities at all?
The OPC argued that PIPEDA does apply to Google’s search operations. But Google said these activities fall under an exemption, which excludes the processing of personal information for “journalistic, artistic, or literary purposes”.
The OPC referred the case to Canada’s Federal Court. In 2021, the Federal Court ruled in the regulator’s favor. Google appealed, leading to the recent decision from Canada’s Court of Appeal.
The Court of Appeal upheld the Federal Court’s ruling. Google’s search activities are subject to PIPEDA, and Google cannot, by default, rely on the journalistic exemption.
Unanswered questions
Note that in its 29 September judgment, the Court of Appeal did not decide on the issue of whether PIPEDA provides a “right to be forgotten”.
However, by establishing Google’s liability under PIPEDA, the court has cleared the way for this question to be answered at a later stage in the proceedings.
The OPC made its position on this topic clear in 2016, when consulting on a draft position paper concerning “online reputation”.
The Court of Appeal has vindicated the OPC’s view that “…by indexing webpages containing personal information, and returning links to those pages in search results, search engines are collecting, using and disclosing personal information within the meaning of PIPEDA.”
Next, the court will consider another of the OPC’s views, namely that individuals have “the right to ask search engines to de-index web pages that contain inaccurate, incomplete or outdated information.
Canada’s ‘right to be forgotten’?
Even if such a right were established under PIPEDA, it would be somewhat narrower than the “right to be forgotten” conceived by the CJEU in Google Spain and codified in the GDPR.
As noted – under the GDPR, subject to certain conditions, data subjects can request the erasure of personal data even where it is perfectly accurate, complete, and up-to-date.
PIPEDA’s right to erasure, insofar as it exists, relates only to “inaccurate, incomplete, or outdated information”. Under this standard, Mario Costeja Gonzalez might not managed to remove Google’s search results about the auctioning of his house.
Following the CJEU’s Google Spain judgment, Google set up a portal to enable people in the EU to request the de-indexing of their personal data in the form of search results.
The portal received 12,000 requests on its first day, suggesting that individuals will exercise their data protection rights when given the opportunity.
Perhaps this experience explains Google’s reluctance to accept a “right to be forgotten” in non-EU markets.
