The “right to be forgotten” arrives in Canada
The interests at stake in a recent investigation[1] by the Office of the Privacy Commissioner of Canada (the “OPC”) can be evoked in two imaginative exercises. First, how would you feel if you had been accused of a crime, the charge had been stayed many years ago, but news articles about the incident were still easily accessible to anyone who typed your name into a search engine? Alternatively, how would you feel if, as a user of Google, you knew that accurate information had been “de-listed” so that, while it still existed somewhere among the billions of webpages on the internet, any search you performed might not return complete results?
The OPC investigation considered whether Google could be required under the Personal Information Protection and Electronic Documents Act[2] (“PIPEDA”) to remove information relating to an individual from its search results. The complaint was brought by an individual who had been charged long ago with non-disclosure of their HIV status, but the charge was stayed and the matter never went to trial. (The Department of Justice and the Attorney General of Canada have since issued directives not to prosecute HIV non-disclosure cases where there is no realistic possibility of transmission.) The ongoing availability of information (such as media articles) about the charges in response to a search for the individual’s name had caused them significant and concrete harm, including stigmatization and loss of employment opportunities. But whereas in the European Union there is a statutory right to have such information removed from search results under certain circumstances, no similarly explicit right exists in Canada—and if it did, it might run afoul of the right to freedom of expression guaranteed by s. 2(b) of the Canadian Charter of Rights and Freedoms.
This article first reviews the development of a “right to be forgotten” under EU privacy law, and then discusses how the OPC located a similar right under PIPEDA following its recent investigation. We conclude by considering the likelihood of a court challenge by Google to the OPC’s recommendations on the basis that forcing it to remove journalistic content from its listed search results is an unjustified violation of its expressive rights under the Charter.
The EU’s “right to be forgotten”
The notion of a “right to be forgotten” took root in 2014 when the Court of Justice of the European Union (the “CJEU”) held that an individual may request that “inaccurate, inadequate, irrelevant or excessive” content about them be “de-listed” in searches for their name, unless doing so is outweighed by public interest considerations.[3] In this Google Spain decision the complainant had requested that Google be required to remove or conceal personal information relating to outdated debts that had been fully resolved for many years.
The right to be forgotten outlined in Google Spain was codified in 2016 in the EU’s General Data Protection Regulation (the “GDPR”).[4] Article 17 of the GDPR sets out a “right to erasure,” which imposes an obligation on search engine controllers to erase personal data where, among other things, the data “are no longer necessary in relation to the purposes for which they were collected or otherwise processed.” This obligation does not apply where the ability to process the data is necessary to, for example, exercise the right of freedom of expression, conduct research, establish legal claims, or carry out an official public duty. To determine whether a request to have data removed should be granted, courts will balance harm to the individual against any public interest in ensuring that the information remains accessible through a search of the person’s name. Similar statutory protections have been enacted in countries including the United Kingdom, Russia, and Serbia.[5]
The Canadian approach: the “appropriateness” analysis
Canada does not have an explicit statutory “right to be forgotten” similar to Article 17 of the GDPR. However, in a seminal 2021 decision,[6] the Federal Court found that PIPEDA — Canada’s federal commercial privacy legislation — applies to the activities of search engines such as Google. This ruling confirmed that the OPC has jurisdiction to investigate complaints with respect to the results returned in a Google search. In its recent investigation, the OPC determined that PIPEDA can support de-listing as a remedy in certain cases.
Section 5(3) of PIPEDA requires an organization to collect, use, or disclose information for purposes that a reasonable person would consider “appropriate” in the circumstances. The OPC held that in the context of a de-listing request, “appropriateness” would turn on a balancing test: whether continuing to allow the information to surface would result in significant harm to the complainant that would outweigh the public interest in being able to find the information through a search of the complainant’s name.
The “significant harm” branch of the test evaluates whether, for example, the information “strikes at the core identity of the individual concerned” and whether its dissemination would therefore be “an affront to an individual’s dignity.”[7] The values of dignity, autonomy, and privacy are all engaged.
The public interest branch of the test involves consideration of a non-exhaustive list of factors that the OPC developed based on other frameworks in the EU, the UK, and Quebec. The public interest in maintaining the accessibility of the information will be greater where
- the individual is a public figure (e.g., a politician or prominent businessperson);
- the information relates to their professional life;
- the individual is an adult as opposed to a minor;
- the information relates to a criminal charge that resulted in a conviction as opposed to a stay;
- the information is accurate and up to date;
- the ability to link the information with the individual is relevant and necessary to public consideration of a matter under current controversy or debate; and
- a long time has passed between the publication of the information and the request for de-listing.[8]
In the complaint under investigation regarding the individual who had many years ago been charged with nondisclosure of HIV status, the OPC found that a limited public interest in the information was outweighed by significant harm to the individual. A reasonable person would not find Google’s use of the information appropriate in the circumstances. The OPC therefore recommended that Google de-list the articles at issue from searches for the complainant’s name.[9]
Next steps: is “forgetting” compliant with the Charter?
Google has declined to follow the OPC’s recommendation, stating that guidance from the courts is required before it de-lists news articles and other lawful content from its search results.[10] That guidance is most likely to come by way of an application under sections 14 or 15 of PIPEDA, which allow the complainant or the Commissioner, respectively, to seek remedies in the Federal Court—including an order requiring Google to comply with de-listing. Given Google’s prior arguments on this issue, in the course of such an application, a court will likely be required to determine (1) whether it is appropriate to consider de-listing requests under s. 5(3) of PIPEDA, and (2) if so, whether this interpretation of PIPEDA is consistent with the right to freedom of expression protected under s. 2(b) of the Charter. Indeed, the Federal Court of Appeal observed that while the issue of PIPEDA’s application to Google had been determined, the “question … of constitutionality … remains open..”[11]
The Charter arguments here raise difficult and valid questions. Google will presumably submit that requiring it to de-list articles would affect not only its own expressive rights, but those of the article publishers and the general public that relies on its search engine. There is force to the argument that the media’s protected right to disseminate expressive content over the internet would be curtailed if that content could be de-listed from a search engine’s displayed results upon request. And as the Supreme Court of Canada often says, s. 2(b) protects “listeners as well as speakers,”[12] suggesting that Google users may have their interests implicated by de-listing as well, particularly insofar as their activities are said to advance of one of s. 2(b)’s core values: the search for and attainment of truth.[13]
Proving an infringement of s. 2(b) is a relatively low bar. As such, most of the action in the Charter analysis will likely occur under s. 1’s Oakes test, where it falls to be determined whether any infringement was a reasonable limit prescribed by law. The Court will need to decide issues including whether any infringement of s. 2(b) is appropriately tailored to the privacy interests at stake (minimal impairment) and whether the deleterious effects of such an infringement are outweighed by the beneficial effects of allowing individuals some measure of control over their personal data (proportionality). The answers to these difficult questions will doubtless be of interest to a host of other individuals and groups beyond the parties themselves — from media companies to civil liberties organizations to privacy commissioners from other Canadian jurisdictions.
For now, the recent OPC report reflects the first major step towards establishing a right to be forgotten (i.e., de-listing) framework under PIPEDA. Whether and to what extent that right takes hold will depend on whether the OPC’s approach survives judicial scrutiny, including Charter review. The courts will ultimately decide whether the OPC has struck the right balance to protect personal privacy, or whether the cost of forgetting is simply too high in terms of infringing free expression.
This article was first produced for the Toronto Law Journal, October 2025
[1] Office of the Privacy Commissioner of Canada (August 27. 2025), “Investigation and recommendations concerning Google search engine service’s compliance with its obligations under PIPEDA,” PIPEDA Findings # 2025-002 [“OPC Recommendations”].
[3] Google Spain Inc. and Google Inc. v. Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez, C-131/12.
[5] The UK GDPR and Serbia’s Law on the Protection of Personal Data are harmonized with the GDPR. See also the Russian Federal Law on Personal Data, No. 264-FZ, 2016.
[6] Google LLC v. Canada (Privacy Commissioner), 2021 FC 723, aff’d 2023 FCA 200 [“Google FC” and “Google FCA”].
[7] See OPC Recommendations, at para. 96, quoting Sherman Estate v. Donovan, 2021 SCC 25. “Significant harm” is also defined in s. 10.1(7) of PIPEDA.
[8] OPC Recommendations, at paras. 109-10.
[9] Ibid., at paras. 127-29.
[10] Ibid., at paras. 146-47.
[11] Google FCA, at para. 65. Section 14(1) of PIPEDA provides that once a complainant has received the Commissioner’s report, they may apply to the Court for a hearing in respect of any aspect of the complaint or the report.
[12] Ford v. Quebec (Attorney General), [1988] 2 S.C.R. 712, at 767.
[13] Irwin Toy Ltd. v. Quebec (Attorney General), [1989] 1 S.C.R. 927, at 976.
