On August 27, 2025, the Office of the Privacy Commissioner of Canada (OPC) released its report of findings relating to its investigation into whether Google LLC (Google) contravened the Personal Information Protection and Electronic Documents Act (PIPEDA) by returning links to outdated and misleading online articles about an individual when their name was searched using Google’s search engine, following a request from that individual to have the results delisted. In particular, the investigation considered whether Google, in doing so, collected, used or disclosed personal information only for purposes that a reasonable person would consider appropriate in the circumstances in accordance with subsection 5(3) of PIPEDA.
As background, the individual requested that Google delist online search results that returned outdated online articles about the individual. These articles related to a criminal charge that was stayed early on in the proceedings; however, many of these articles were not updated to indicate that the charge was stayed. The individual claimed that the fact that these articles are produced when their name is searched on Google caused them harm, including physical assault, lost employment opportunities and other social stigma.
The OPC found that there are limited circumstances in which a reasonable person would consider it inappropriate for a search engine to return, in response to a search for an individual’s name, content containing personal information of the individual, and that such circumstances include instances where the search results cause, or are likely to cause, significant harm to the individual that outweighs the public interest in accessing the materials. As a result of this finding, the OPC has identified a right to delist under PIPEDA.
In this bulletin, we discuss the appropriate purposes provision under PIPEDA (which establishes the basis for the right to delist under PIPEDA), the OPC’s report and what this new right may mean for businesses.
Appropriate Purposes Provision Under PIPEDA
Subsection 5(3) of PIPEDA provides that “an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” This is an overarching requirement that cannot be cured with the individual’s consent. As recently reaffirmed in the Federal Court of Appeal, this overall limitation aims to balance the privacy rights of individuals with a business’s need to process personal information.
Previous OPC guidance describes the Federal Court’s approach in evaluating whether an organization’s purpose for processing personal information complies with section 5(3) of PIPEDA as involving a flexible consideration of a variety of factors, including the sensitivity of the information involved, whether the purpose represents a legitimate need or a business interest, whether there are less privacy-invasive ways to achieve the objective and whether the loss of privacy is proportional to the benefits obtained. However, the Federal Court has consistently emphasized that the factors to be considered in any given case may vary.
OPC’s Report of Findings
In assessing whether Google complied with section 5(3) of PIPEDA, the OPC determined that in the context of a delisting request, the factors to be considered were whether the loss of privacy resulted or was likely to result in significant harm to the individual, and whether that harm outweighed the public interest in being able to access the articles through a search of the individual’s name.
The OPC determined that the accessibility of the search results in response to a search of the individual’s name caused significant harm to the individual’s safety and dignity.
The OPC then considered whether there was a public interest in continuing to display the search results when the individual’s name was searched through Google’s search engine.
The OPC expressly drew on interpretations of the right of erasure under the European Union’s General Data Protection Regulation (GDPR) and the right of delisting under section 28.1 of Quebec’s Act respecting the protection of personal information in the private sector to determine that the following non-exhaustive factors should be considered in assessing the public interest in making the information available via an online search of the individual’s name:
- Whether the individual is a public figure (e.g., public office holder, politician or prominent business person)
- Whether the information relates to an individual’s working or professional life versus their private life
- Whether the information relates to an adult or a minor
- Whether the information relates to a criminal charge that has resulted in a conviction or where the charges were stayed due to delays in the criminal proceedings
- Whether the information is accurate and up to date
- Whether the ability to link the information with the individual is relevant and necessary to the public consideration of the matter under current controversy or debate
- The length of time that has elapsed since the publication of the information and the request for delisting
The OPC considered these factors in the context of the complaint and found that there was limited public interest in being able to find the articles in question based on a search of the individual’s name (noting that the articles would still be accessible and returned through other search terms). As such, the OPC found that the significant harm caused to the individual’s safety and dignity was outweighed by any public interest in having the articles returned by a search of the individual’s name and that, therefore, returning links to these articles in response to a search for the individual’s name contravened subsection 5(3) of PIPEDA.
The OPC recommended that Google delist the articles at issue, which Google did not agree to do.
Implications
This decision does not create an absolute right for individuals to request their personal information be delisted from online search engines in all cases, but instead identifies that where there is a significant risk of harm to an individual that outweighs the public interest in the information being accessible, the OPC expects and recommends that an organization will delist the individual’s name from the search engine to comply with the appropriate purposes provision under PIPEDA.
The decision also reflects the OPC’s willingness to interpret existing provisions of PIPEDA to align with more modern comprehensive privacy statutes like the GDPR and Quebec’s privacy laws, despite the absence of legislative reform.
For more information, please contact the authors or any other member of our Privacy & Data Protection group.
