The right to erasure
As noted, Google Spain was decided under the EU’s older data protection regime. But four years after the judgment, the phrase “the right to be forgotten” made it into the GDPR—tacked on in parentheses after Article 17’s title: “The right to erasure”.
The “right to be forgotten” is arguably a misleading subtitle for this GDPR provision. Erasing personal data begins with a request to the controller—and there is no guarantee that the controller will comply.
The right to erasure is available under six grounds, including where the personal data has been used unlawfully, where the data is no longer needed, or, sometimes, when the individual just wants it deleted.
That last ground is most relevant to Google’s search activities and can be found at Article 17 (1) (c) of the GDPR.
Search engines normally rely on the legal basis of “legitimate interests” to process personal data included in search results.
As such, data subjects have the right to request the erasure of their personal data merely because they object to the search engine continuing to process it.
But this right is not absolute. The search engine may refuse the data subject’s request if it can demonstrate that it has “compelling legitimate grounds” that outweigh the data subject’s rights.
In Google Spain, the CJEU noted that a search engine might have good reasons to refuse a request to de-index web pages.
For example, if a request comes from a well-known public figure, the individual’s rights might be outweighed by the general public’s interests in accessing information about that person.
But in general, a data subject’s rights will outweigh both the economic interests of the search engine and the general interests of the public.
In such cases, the search engine must comply with the data subject’s request by erasing or de-indexing the personal data.
The right to be forgotten under Canada’s PIPEDA
Canada’s data protection law, the Personal Information and Protection of Electronic Documents Act (PIPEDA), does not contain an explicit right to erase personal data.
However, deletion of personal information is mentioned under Section 4.9.5 of the law, in connection with the principle of “individual access”.
PIPEDA requires organizations to inform individuals of “the existence, use, and disclosure” of their personal information, and to “give access” to the information on request.
If an individual can demonstrate that personal information about them is inaccurate, then the organization must “amend the information as required”. This might be correcting the information, adding further information, or – crucially – deleting the information.
Google vs OPC
Do the above PIPEDA obligations constitute a Canadian “right to be forgotten” applicable to search engines, as in Google Spain?
The recent development in Google vs OPC answers a slightly different, preliminary question: Does PIPEDA apply to Google’s search indexing activities at all?
The OPC argued that PIPEDA does apply to Google’s search operations. But Google said these activities fall under an exemption, which excludes the processing of personal information for “journalistic, artistic, or literary purposes”.
The OPC referred the case to Canada’s Federal Court. In 2021, the Federal Court ruled in the regulator’s favor. Google appealed, leading to the recent decision from Canada’s Court of Appeal.
The Court of Appeal upheld the Federal Court’s ruling. Google’s search activities are subject to PIPEDA, and Google cannot, by default, rely on the journalistic exemption.
Note that in its 29 September judgment, the Court of Appeal did not decide on the issue of whether PIPEDA provides a “right to be forgotten”.
However, by establishing Google’s liability under PIPEDA, the court has cleared the way for this question to be answered at a later stage in the proceedings.
The OPC made its position on this topic clear in 2016, when consulting on a draft position paper concerning “online reputation”.
The Court of Appeal has vindicated the OPC’s view that “…by indexing webpages containing personal information, and returning links to those pages in search results, search engines are collecting, using and disclosing personal information within the meaning of PIPEDA.”
Next, the court will consider another of the OPC’s views, namely that individuals have “the right to ask search engines to de-index web pages that contain inaccurate, incomplete or outdated information.
Canada’s ‘right to be forgotten’?
Even if such a right were established under PIPEDA, it would be somewhat narrower than the “right to be forgotten” conceived by the CJEU in Google Spain and codified in the GDPR.
As noted – under the GDPR, subject to certain conditions, data subjects can request the erasure of personal data even where it is perfectly accurate, complete, and up-to-date.
PIPEDA’s right to erasure, insofar as it exists, relates only to “inaccurate, incomplete, or outdated information”. Under this standard, Mario Costeja Gonzalez might not managed to remove Google’s search results about the auctioning of his house.
Following the CJEU’s Google Spain judgment, Google set up a portal to enable people in the EU to request the de-indexing of their personal data in the form of search results.
The portal received 12,000 requests on its first day, suggesting that individuals will exercise their data protection rights when given the opportunity.
Perhaps this experience explains Google’s reluctance to accept a “right to be forgotten” in non-EU markets.