Recent Developments in Online Privacy Protections for Canadians

Forget you ever read this

Written By Ruth E. Promislow and Katherine Rusk

The Office of the Privacy Commissioner of Canada (OPC) declared last Friday that existing privacy laws allow consumers to ask search engines to remove inaccurate search results and to request websites to delete misleading content.

The OPC primarily based their conclusion on an interpretation of two sections of the Personal Information Protection and Electronic Documents Act (PIPEDA). There is no explicit right in PIPEDA to be forgotten online. However, the OPC concluded that Canadians have the right to request search results be de-indexed and to request that source websites remove offending information by combining a provision that obliges corporations to use accurate information with a provision that grants Canadians the ability to challenge the accuracy of that information.

Beyond de-indexing and source takedown, the OPC’s draft policy also set out further proposals, such as the development of an industry-wide code of practice for takedown policies and the ability of youth to request and obtain the removal of online information posted about them by their parents or guardians.

This is not the first time that removing search engine results has been discussed in Canada. In July of last year, the Supreme Court of Canada ruled that Canadian courts can issue worldwide injunctions when they have jurisdiction. In particular, it upheld an order that required Google to stop displaying search results globally for a company selling products that violated a Canadian corporation’s intellectual property.

In October, the Federal Court held that a Romanian-based website violated PIPEDA by collecting, using, and disclosing on its website information contained in publically available but not indexed Canadian court and tribunal decisions without the consent of the individuals concerned. The Court issued two orders: one that the site must comply with PIPEDA, and one that they were in violation of it. The Court stated that these orders would allow the applicant to submit a request to Google to de-index the websites rather than ordering Google to do so.

Canadian legislation and jurisprudence appears to moving towards granting individuals more control over their personal information and online reputation in recent years. This control has been a priority of the OCP since at least 2015. And this trend matches the recognition by the courts of new torts such as inclusion upon seclusion and public disclosure of embarrassing private facts. It also tracks international trends, such as the implementation of the Right to be Forgotten in the European Union since a 2014 court decision and the upcoming General Data Protection Regulation.

The OPC’s draft policy points toward increased regulatory scrutiny of organizations in Canada and, in particular, increased scrutiny of steps taken to protect personal information. With the heightened engagement of privacy regulators around the world (particularly in the European Union), organizations operating in Canada should expect this trend to continue and should prepare accordingly. The final note of the OPC’s draft report was a call to the federal government to further investigate what rights Canadians can and should have to manage their online reputations. If the federal government responds to this call, there may be further legislative protections coming from Ottawa.

Download PDF