Canada's Emerging "Right To Be Forgotten": Federal Privacy Commissioner Rules On De‑Listing

On August 27, 2025, the Office of the Privacy Commissioner of Canada (theOPC), Canada's federal privacy regulator, determined that in certain circumstances, search results for an individual's name can be de‑listed where the risk of serious harm outweighs the public interest (the Findings).¹ This "right to de-listing" arises pursuant to section 5(3) of the Personal Information Protection and Electronic Documents Act (PIPEDA),²a nd reflects a careful balance between personal privacy and freedom of expression, guaranteed by section 2(b) of theCanadian Charter of Rights and Freedoms.

Regulatory context

The "right to de-listing" has been recognized both internationally and in Québec.

In the European Union (the EU), the right to de-listing—otherwise known as the "right to be forgotten"—is included in Article 17 of the General Data Protection Regulation(GDPR) on the right to erasure.³ Pursuant to Article 17.2 of the GDPR, individuals can request the de-listing of their personal data in certain circumstances, including where the individual withdraws consent, or if the individual objects to the processing of their data. Under Article 17.3, the de-listing does not violate the right to freedom of expression or the public's right to information.

In Québec, the right to deletion exists under Article 40 of the Civil Code of Québec and the right to de-list under section 28.1 of the Québec Act respecting the protection of personal information in the private sector (theQuébec Act).⁴

Background

In 2017, the complainant complained to the OPC about internet search results linking the complainant's name to old media articles about a criminal charge related to the complainant's non-disclosure of HIV status—charges which were quickly stayed. The complainant reported severe social stigma, lost employment opportunities and even physical assault.

OPC findings

The OPC determined that in certain circumstances, individuals have a right to de-listing through the application of PIPEDA's overarching privacy principles:

• Accuracy (PIPEDA, Principle 4.6): The OPC found that the personal information met PIPEDA's accuracy requirement because the snippets correctly reflected the linked articles; search engines aren't responsible for correcting the underlying third‑party content.
• Appropriate purposes (PIPEDA, section 5(3)): Returning the articles for searches of the complainant's name is inappropriate where it discloses highly sensitive personal information and causes significant harm (including to safety and dignity) that outweighs the limited public interest in accessing those articles through a name search.

In addition, the OPC outlined several non‑exhaustive factors to be used when assessing de-listing requests:

• Whether the individual is a public figure;
• Whether the information concerns private life vs. professional life;
• Whether the information relates to an adult vs. minor;
• Status and context of any criminal matter (e.g., stayed vs. convicted);
• Accuracy and currency of the information;
• Relevance of linking the information to the person's name for current public debate; and
• Time elapsed since publication.

As a remedy, the OPC recommended de-listing the results for searches of the individual's name only. The articles themselves would remain online, accessible through other types of queries on the publishers' sites. This targeted solution aimed to preserve access to information and protect freedom of expression, while also mitigating the harms that flow from name-based discoverability.

Key takeaways of the OPC findings

The Findings establish a Canadian right to de‑listing search results in limited, harm‑based scenarios. The Findings confirm search engines are subject to PIPEDA, but original media publications remain exempt under PIPEDA's journalistic purpose carve-out.⁵

The Findings signal a close alignment with Québec's private sector approach to de-listing in the Québec Act. Under section 28.1 of the Québec Act, individuals can request organizations to de-list their personal information in similar circumstances, such as when there is serious harm to an individual's reputation or privacy. The Findings mirror the enumerated assessment factors in section 28.1 of the Québec Act, such as considering whether the individual is a public figure or a minor at the time the information was created.

Compliance with Canadian de-listing right

Moving forward from the Findings, organizations should be aware of the scope of the right to de-list beyond the Québec Act and ensure relevant policies exist and/or comply across Canada:

• Search platforms with existing de-listing policies: Consider reviewing removal/de‑listing policies for Canadian users to address harm‑based requests under PIPEDA section 5(3), as under section 28.1 of the Québec Act.
• Search platforms without existing de-listing policies: consider creating removal/de-listing policies for Canadian users to address harm-based requests under PIPEDA section 5(3), as under section 28.1 of the Québec Act.
• Media publishers: Note that this decision targets search results, not source content.

Dentons Canada's Privacy & Data Protection team, recently ranked Band 2 in Chambers' 2026 Leading Firm rankings, is pleased to advise on compliance with this new right and with Canadian privacy law generally.

The authors,Olivia GrahamandChantal Bernier, would like to thank Anna Olchowec, an articling student in the Ottawa office, for her substantial contribution to this insight.

Footnotes

1. Office of the Privacy Commissioner,< a href="https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-002/" target="_blank">Investigation and recommendations concerning Google search engine service's compliance with its obligations under PIPEDA, PIPEDA Findings #2025-002, published August 27, 2025.

2. Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA), s. 5(3).

3. General Data Protection Regulation, (EU) 2016/679, art 17.

4. An act respecting the protection of personal information in the private sector, CQLR c P-39.1.

5. PIPEDA, s. 4(2).

About Dentons

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.