Law Library Stacks

Back to Erasure of Online Information Index

Canada has yet to recognize “a right to be forgotten” or to enact erasure laws.  However, injured parties can use the complaint procedure under the Personal Information Protection and Electronic Documents Act. Persons who find personal information on websites without their consent that has an impact on their reputation have turned to the Office of the Privacy Commissioner for assistance to remove the material. In addition, online defamatory material is typically dealt with through a common-law action for libel (defamation). Defamatory content can be removed through interlocutory or permanent injunctions issued by courts, but such remedies appear to be difficult to obtain. Legislation at the federal and provincial levels has been passed to deal with online reputational harms such as revenge porn and cyberbullying.

I.     Background

In Canada, the right to privacy is based on number of rights under the Canadian Charter of Rights and Freedoms.[1] The Privacy Commissioner of Canada notes that “[t]he Charter does not specifically mention privacy or the protection of personal information. However, it does afford protection under Section 7 (the right to life, liberty and the security of the person), and Section 8 (the right to be secure against unreasonable search or seizure).”[2]

The removal of personal information that impacts a person’s reputation is done largely through the application of Canada’s privacy laws. There are a number of laws on the federal and provincial levels in Canada that relate to the protection of personal information. The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal privacy law that is applicable to the private sector.[3] In addition, injunctive relief can be provided for online defamatory material, as discussed below.

Canada does not yet recognize “a right to be forgotten.” However, there has been some debate over whether various decisions, including a recent decision of the Federal Court of Canada, A.T. v. Globe24h.com,[4] could open the door to such a right.[5]

Back to Top

II.  The Right to be Forgotten Debate

In 2015, the Privacy Commissioner of Canada established four strategic privacy priorities “in support of his vision to give Canadians more control over their personal information.”[6] One of the priorities was “Reputation and Privacy,”[7] where a stated aim of the Office of the Privacy Commissioner (OPC) is to “help create an online environment where individuals may use the Internet to explore their interests and develop as persons without fear that their digital trace will lead to unfair treatment.”[8] As part of this strategy the Policy and Research Group of the OPC drafted a policy position on “recourse mechanisms, such as the right to be forgotten in the Canadian legal context.”[9] According to the policy paper, in Canada “no right to be forgotten or erasure laws exist per se.”[10] The OPC goes on to discuss what would need to be considered before such a right were to be introduced in the Canadian context:

As for the “right to be forgotten” debate, if such a mechanism were to be considered in Canada, there would need to be a careful balancing with other societal values, such as the right to freedom of expression, which is guaranteed under the Canadian Charter of Rights and Freedoms. While freedom of expression is already restricted in Canada by hate speech, obscenity, libel and defamation laws, freedom of expression remains a corner stone of Canada’s democratic system, allowing individuals to express their opinions and ideas without interference or constraint by the government. In the digital realm, many of the measures used to control threats to privacy and reputation can also constrain freedom of expression. Threats to restrict free speech online have a chilling effect on people’s willingness and ability to express themselves fully. At the same time, however, there is also a strong public interest in curbing the posting of personal information that is harmful and damaging to people’s reputations particularly on a “net that never forgets.”[11]

In January 2016, the Office of the Privacy Commissioner of Canada launched a consultation on the issue of online reputation. According to the OPC’s website,

[t]hrough this consultation, the OPC is soliciting input about new and innovative ways to protect reputational privacy. The goal is to enrich the public debate and ensure that OPC is in a better position to inform Parliament of a variety of solutions for addressing issues related to online reputation and to develop a policy position on this issue.[12]

Some twenty-eight submissions were made by the stakeholders, including individuals, organizations, universities, defense groups, and others,[13] who participated in the consultation.[14] According to one article, “seventeen briefs expressed a position on the ‘right to be forgotten’ in Canada. The end result: 10 against, 4 neutral, 3 in favour (including one concerning the specific case of children).”[15]

Back to Top

III.  Privacy Complaints Filed with the Office of the Privacy Commissioner

Persons who find personal information on websites without their consent that has an impact on their reputation have turned to the OPC for assistance to remove the material. If a person feels that his or her personal information has been wrongfully collected, used, or disclosed he or she may file a complaint with the OPC.[16]

PIPEDA “sets out the rules private sector organizations must follow when they handle personal information in the course of their commercial activities.”[17] The Act applies to all private-sector organizations in Canada except in provinces that have enacted “substantially similar” legislation. OPC oversees compliance with the Act. According to the OPC,

[g]enerally, organizations cannot collect, use or disclose personal information without consent unless an exception to the requirement for consent applies. The law also gives individuals the right to access and to ask for corrections to personal information an organization may have collected about them.[18]

The exceptions to the consent requirement are stipulated under section 4(2) of the Act and include an organization that “collects, uses or discloses [information] for journalistic, artistic or literary purposes.”[19] Section 5(3) of the Act also stipulates that “[a]n organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”[20]

If the complaint is “substantiated or well-founded”, the OPC issues a Report of Findings that contains the following elements:

  • A summary of both sides’ positions and what the investigation uncovered;
  • The findings and recommendations;
  • Any agreement reached by the parties;
  • If appropriate, a request that the organization provide, within a specified time, notice of any action taken or proposed to be taken with respect to the recommendations; or reasons why no such action has been or is proposed to be taken; and
  • The recourse, if any, that is available to the Federal Court under the Act.[21]

The websites that are typically involved in complaints about reputational issues “include dating sites, sites that re-post court and tribunal decisions, and, overwhelmingly, the so-called revenge and shaming sites.”[22] According to the OPC,

[o]ne of the biggest challenges for the OPC in dealing with issues of online reputation has been asserting jurisdiction over the sites that come to our attention, particularly when they are based outside of Canada. In those circumstances, there may not always be a real and substantial connection to Canada, which is required in order for a foreign-based organization to be subject to PIPEDA. Moreover, in order for PIPEDA to apply, the website needs to be engaged in commercial activity. It is not unusual to find personal information posted without consent on websites set up for strictly personal use with no commercial purpose.[23]

According to section 14 of PIPEDA, after receiving the Commissioner’s report or being notified that the investigation of the complaint has been discontinued, a complainant can apply to the Federal Court. Either party may appeal a decision of the Federal Court to the Federal Court of Appeal “if they are unsatisfied with the Court’s ruling.”[24]

A recent Federal Court case, A.T. v. Globe24h.com, disputed the republishing by the Romanian-based website Globe24h of a significant number of public documents, including Canadian court and tribunal decisions that are available on Canadian legal websites such as CanLII.org.[25] The content on these websites is “generally not indexed and a person seeking such information must go directly to each site and conduct a search with the names of the parties.”[26]  Globe24h.com republished the content and “permitted these to be indexed and located by search engines such as Google. Such indexing meant that highly sensitive personal information ranging from divorce and immigration issues to personal bankruptcies and health particulars could be easily searched by anyone using a basic search engine.”[27] The Federal Court ordered removal of all Canadian decisions containing “personal information from Globe24h.com and any further copying and republishing of such Canadian decisions, along with damages of [Can]$5000.”[28]  The significance of the case is that it confirmed that PIPEDA “applies to foreign based organizations where there is a ‘real and substantial connection’ and that Canadian privacy rights will be enforced by the courts across borders.”[29]  Though the Court does not directly recognize a “right to be forgotten,” some commentators believe that it might be a step in that direction and is consonant with “right to be forgotten” rulings by “other [European] courts that have ordered online service providers to remove or disable access to personal information made available over the Internet.”[30]

Another recent Supreme Court case that often comes up in the context of the discussion over the “right to be forgotten” in Canada is Google Inc. v. Equustek.[31] Though not directly related to privacy or the “right to be forgotten,” it does deal with the power of the Court to issue a worldwide injunction ordering the search engine Google to delist certain websites. The Supreme Court of Canada upheld the grant of a “preliminary injunction by the Court of Appeals of British Columbia ordering Google to de-index on a global basis websites of a party accused of passing off the plaintiff’s goods and misusing its trade secrets.”[32]

Back to Top

IV.  Defamation Actions and Similar Remedies

Online defamatory material is typically dealt with through a common-law action for libel (defamation). Defamatory content can be removed through interlocutory or permanent injunctions issued by courts, but such remedies are difficult to obtain.[33] Elements that typically apply to defamation also apply to online defamation. However, in respect to online material, the Canadian courts have been dealing with a number of challenges, including “whether words posted on the internet were capable of defamatory meaning,”[34] establishing who is a publisher (including whether or not a hyperlink is considered a publication), whether Google can be considered a publisher, and jurisdictional issues such as forum shopping.[35]

Note that in Canada defamation can in some circumstances constitute a criminal offense under section 298 of the Criminal Code. For example, in the Ontario court case R. v Simoes, a “restaurant customer posted negative reviews about an Ottawa restaurant. In retaliation, the restaurant’s owner began a harassment campaign that included setting up a false profile of the diner on a dating site and sent lewd e-mails to the customer’s employer.”[36] The restaurant owner was convicted of defamatory libel by the Ontario Court, and was sentenced to jail time.[37]

In addition, the privacy tort “may provide recourse either by statute or at common law, such as the emerging tort of intrusion upon seclusion in Ontario.”[38] The tort of “intrusion upon seclusion” was established by the Ontario Court of Appeal in the 2012 decision of Jones v. Tsige.[39]  In 2016, the Ontario Superior Court in Jane Doe 464533 v. ND also recognized for the first time in Canada the privacy tort of “publication of embarrassing private facts.”[40]

Back to Top

V.  Protecting Canadians from Online Crime Act and Provincial Legislation

The OPC notes that, “[a]s online reputational harms become more widespread, legislators have been passing laws aimed at supplementing defamation laws and addressing specific online problems.”[41] Media attention towards online bullying and the resulting suicides of two young Canadians helped push the passage of the Protecting Canadians from Online Crime Act,[42] which received Royal Assent on December 2014. The Act introduced a hybrid offense aimed at criminalizing the publication of intimate images without consent. The Law also introduced amendments to

authorize the removal of such images from the Internet and the recovery of expenses incurred to obtain the removal of such images, the forfeiture of property used in the commission of the offence, a recognizance order to be issued to prevent the distribution of such images and the restriction of the use of a computer or the Internet by a convicted offender.

Some provinces, including Manitoba, Alberta,[43] and Nova Scotia,[44] have introduced legislation against cyberbullying and revenge porn.  In Manitoba, the Intimate Image Protection Act (IIPA) establishes a civil tort action against the nonconsensual distribution of intimate images. A person who distributes an intimate image of another person that gave rise to a reasonable expectation of privacy, “knowing that the person depicted in the image did not consent to the distribution, or being reckless as to whether or not that person consented to the distribution, commits a tort against that other person.” [45] This allows residents to sue perpetrators in civil court for damages or other remedies, such as injunctions.

Back to Top

Prepared by Tariq Ahmad
Foreign Law Specialist
November 2017


[1] Canadian Charter of Rights and Freedoms, Constitution Acts, 1867 to 1982, http://laws-lois.justice.gc.ca/eng/ Const/page-15.html, archived at https://perma.cc/7NPJ-S9P3.

[2] Your Privacy Rights, Office of The Privacy Commissioner of Canada (OPC), https://www.priv.gc. ca/en/privacy-topics/your-privacy-rights/ (last modified Sept. 28, 2015), archived at https://perma.cc/6P9J-YX4W.  

[3] Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, http://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html, archived at https://perma.cc/474H-3BTQ.

[5] Mark Hayes & Adam Jacobs, Forget ‘Right to Be Forgotten’ Until the Right Case Comes, The Lawyers Daily (Mar. 23, 2017), https://www.thelawyersdaily.ca/articles/3208/forget-right-to-be-forgotten-until-the-right-case-comes, archived at https://perma.cc/9QQQ-5XP6; Fasken Martineau DuMoulin LLP, The “Right to Be Forgotten” Has a Three-piece Suit Tailor-made in Canada? From Quebec to British Columbia, Lexology (Mar. 10, 2017), https://www.lexology.com/library/detail.aspx?g=d428aca4-761f-4990-b4bc-0d9895c09e8d, archived at https://perma.cc/MNU8-C85H.

[6] OPC Strategic Privacy Priorities, OPC, https://www.priv.gc.ca/en/about-the-opc/opc-strategic-privacy-priorities/(last modified Sept. 9, 2016), archived at https://perma.cc/RD22-M8Q8.

[8] Id.

[9] Id.

[10] Policy and Research Group of the Office of the Privacy Commissioner of Canada, Online Reputation: What Are They Saying About Me? (Jan. 2016), https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/or_201601/#heading-0-0-7, archived at https://perma.cc/98HH-FBLD

[11] Id.

[12] Consultation on Online Reputation, OPC, https://www.priv.gc.ca/en/about-the-opc/what-we-do/consultations/ consultation-on-online-reputation/ (last modified Jan. 1, 2017), archived at https://perma.cc/7CR9-75YF.   

[13] Fasken Martineau DuMoulin LLP, supra note 5.

[15] Fasken Martineau DuMoulin LLP, supra note 5.

[16] File a Formal Privacy Complaint, OPC, https://www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/ (last modified Sept. 13, 2016), archived at https://perma.cc/9TG5-5CVF.

[18] Policy and Research Group of the OPC, supra note 10.

[19] PIPEDA § 4(2)(c).

[20] Id. § 5(3).   

[21] What Happens When You File a Complaint under PIPEDA, OPC, https://www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/file-a-complaint-about-a-business/guide/ (last modified Dec. 12, 2012), archived at https://perma.cc/4C2E-L8NW.

[22] Policy and Research Group of the OPC, supra note 10.

[23] Id.

[25] A.T. v. Globe24h.com, 2017 FC 114 (CanLII), para. 10, https://www.canlii.org/en/ca/fct/doc/2017/2017 fc114/2017fc114.pdf, archived at https://perma.cc/C8XY-KHVU.

[26] Id. para. 11.

[27] Practical Law Canada Commercial Transactions, The Extra-Territorial Reach of PIPEDA: T. (A.) v. Globe24h.com, Thomson Reuters Practical Law (Feb. 22, 2017), https://ca.practicallaw.thomsonreuters.com/w-005-9407?transitionType=Default&contextData=(sc.Default)&firstPage=true&bhcp=1, archived at https://perma.cc/7VLN-QA37.

[28] Id.

[29] Id

[30] McCarthy Tétrault LLP, PIPEDA’s Global Extra-territorial Jurisdiction: A.T. v. Globe24h.com, Lexology (Feb. 3 2017), https://www.lexology.com/library/detail.aspx?g=d74585f3-8961-4387-a2ac-9c5fc2a02b48, archived at https://perma.cc/R875-MKUM

[31] Google Inc. v. Equustek Solutions Inc., 2017 SCC 34, https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/16701/ index.do, archived at https://perma.cc/2K45-AGYU.

[32] John Richards, Google Inc. v. Equustek & the Supreme Court of Canada, Lexology (Sept. 12 2017), https://www.lexology.com/library/detail.aspx?g=430b17b9-e4cd-4313-accd-0484e56edbec, archived at https://perma.cc/6C2N-586U.

[33] Karen R. Zimmer, Canada: Privacy Vs. Free Speech on the Internet: An Update on the Right to Be Forgotten and What Is Happening at Home, Mondaq (Aug. 29, 2017), http://www.mondaq.com/canada/x/623970/IT+internet/ Privacy+Vs+Free+Speech+On+The+Internet+An+Update+On+The+Right+To+Be+Forgotten+And+What+Is+Happening+At+Home, archived at https://perma.cc/U4T9-BP6T.

[34] Elizabeth Segal, Internet Defamation Law: Update 9.1.2 (CLE BC Paper 9.1, Torts–2013), https://www.cle. bc.ca/PracticePoints/TECH/14-InternetDefamationLaw.pdf, archived at https://perma.cc/3C7H-FEBS; see also Bryan G. Baynham, Daniel J. Reid, The Modern-Day Soapbox: Defamation in the Age of the Internet, DEFAMATION LAW PAPER 3.1(2010), http://www.cle.bc.ca/practicepoints/lit/11-modernsoapbox.pdf, archived at https://perma.cc/7L4T-X5GH.

[35] Segal, supra note 34, at 9.1.6.

[36] Policy and Research Group of the OPC, supra note 10.

[37] Id.

[38] Id.

[41] Policy and Research Group of the OPC, supra note 10.

[42] Protecting Canadians from Online Crime Act, S.C. 2014, c. 31, http://laws-lois.justice.gc.ca/eng/annualstatutes/ 2014_31/FullText.html, archived at https://perma.cc/R9V8-J7SL

[43] Protecting Victims of Non-consensual Distribution of Intimate Images Act, Statutes of Alberta, 2017 ch. P-26.9, http://www.qp.alberta.ca/documents/Acts/P26p9.pdf, archived at https://perma.cc/VZ8N-LQFS.

[44] Intimate Images and Cyber-protection Act, Bill No. 27, 1st Session, 63rd General Assembly Nova Scotia, 66 Elizabeth II, 2017, http://nslegislature.ca/legc/bills/63rd_1st/1st_read/b027.htm, archived at https://perma.cc/65AX-7LMG.  Nova Scotia previously had cyberbullying legislation known as the Cyber-safety Act, but it was struck down in 2015 by the Nova Scotia Supreme Court as unconstitutional.  Crouch v. Snell, 2015 NSSC 340, https://www.canlii.org/en/ns/nssc/doc/2015/2015nssc340/2015nssc340.pdf, archived at https://perma.cc/JBH7-26DG.

[45] Intimate Image Protection Act, Bill 38, 4th Session, 40th Legislature, Manitoba, 64 Elizabeth II, 2015, https://web2.gov.mb.ca/bills/40-4/b038e.php, archived at https://perma.cc/H6K3-ZB7Z.

Back to Top

Last Updated: 04/16/2018