Google and the Privacy Commissioner of Canada appear headed for a legal showdown about the “right to be forgotten”. In this post, Caravel lawyer David Dunbar shares his perspective on the recent clash and what it could mean for business leaders. 

The battle began back in 2017, when an unnamed individual filed a complaint with the Privacy Commissioner over Google’s search results. More specifically these search results shared that the complainant had been arrested and charged many years earlier for not disclosing their HIV status to a person with whom they engaged in sexual activity. Those charges were quickly dropped after the relevant Public Health Authority was satisfied the complainant did not pose a current risk to public health. 

While the charges disappeared, the articles about them didn’t.  

The complainant brought the matter to the Privacy Commissioner, arguing that Canada’s private sector privacy legislation — The Personal Information Protection and Electronic Documents Act, aka PIPEDA — required Google to de-list these media articles from search results displayed in response to searches for their name. 

Among other arguments, the complainant took the position that the display of these old, and now inaccurate, articles about the criminal charge violated the requirement at s. 5(3) of PIPEDA that a business collect, use or disclose personal information only for a purpose that a reasonable person would consider appropriate in the circumstances. 

While there is no explicit “right to be forgotten” in PIPEDA, the effect of this argument is to create one, at least in certain situations. 

 The Privacy Commissioner agreed, stating in his reasons that: 

With respect to subsection 5(3) of PIPEDA, we found that there are limited circumstances in which a reasonable person would consider it inappropriate for a search engine to return, in response to a search for an individual’s name, content containing personal information about that individual. These circumstances would include those where returning the results in question causes or is likely to cause significant harm to the individual – including, as we have found in this case, harms to their safety or dignity – that outweigh any public interest associated with returning those results in the search for that individual’s name. 

At its core, the Commissioner’s decision constitutes a clarification of what personal information it considers “reasonable” for a business to collect, use, or disclose. 

In situations where personal information is old, out of date, particularly sensitive and not of a public nature, and/or inaccurate or potentially misleading, businesses risk being found to have been unreasonable in collecting or using such information. 

At the moment, this interpretation of s. 5(3) is mainly focused on internet search results, and whether the concept of “reasonableness” includes a requirement for those results to be filtered for old, inaccurate, and overly sensitive information. 

But the impact of this approach could be felt much further than just old-school web search. More and more, generative AI is being used as a search tool, and services like ChatGPT, Perplexity or Claude will quickly put together a profile of anyone whose identity you search. Such profiles are built from integrated web searches, which in turn could be pulling in “unreasonable” information sources according to the Commissioner’s definition. 

Even old fashioned, do-it-yourself information gathering could be subject to a complaint under s. 5(3). An employer doing due diligence on a prospective employee could easily come across old, outdated, misleading, and/or sensitive information and add that to their file.  

The fact that a piece of personal information is public — such as the existence of prior criminal charges, or the content of news articles that were previously widely published — doesn’t necessarily mean that its collection will be viewed as reasonable by the Commissioner. Context is everything. And in many contexts, the collection of out-of-date and potentially harmful information runs a high risk of being viewed as unreasonable in the context of PIPEDA. 

Looking forward, judicial consideration of this issue seems likely. Google maintains that the Commissioner hasn’t properly balanced the “right to be forgotten” with the public’s right to know and the exercise of free speech. We haven’t heard the last word on this yet.  

Caravel Law has over 100 lawyers, including privacy experts like David Dunbar. To learn more about how evolving privacy laws could impact your business, connect with us!