Privacy & Data Management Blog

The Federal Court was asked to decide this question on a reference^[1] in the course of an investigation by the Federal Privacy Commissioner. The big issue in the investigation is whether the Commissioner has the authority to order Google to de-index, or remove links, from searches for an individual’s name. This has become known as the “right to be forgotten.” In this case, the complainant said the search results contain outdated, sensitive and inaccurate information about him which continues to cause him direct harm.

In the course of the investigation, Google took the position that its search engine does not collect, use or disclose personal information in the course of commercial activities when it indexes webpages and presents search results. The question of whether the activity is commercial is important because the Personal Information Protection and Electronic Documents Act (PIPEDA) only applies to commercial activities.

Google urged the Court to focus on its free service. Google connects content providers and individual users of the search engine without charge. In this particular case, no promoted advertisements were produced in a search using the individual’s name.

Even though Google provides its search services without charging a fee, the Federal Court said:

“[Google] has a flagrant commercial interest in connecting these two players. There is a real trade between Google and the users of its search engine. In exchange for the information displayed in the search results, the users provide a variety of personal information (their location, preferences, interests, consumption patterns etc.). That personal information is used for profit.”

In this case, the Federal Court also rejected Google’s argument that “collection, use or disclosure” of personal information captured by PIPEDA did not apply to intermediaries, like Google. The Court found that Google collects, uses and discloses personal information in various ways. Google crawls and indexes webpages, which contain personal information. It uses and discloses the information in search results. Google’s success is built, in large part, on the success of its search engine. Google collects information about its users and promotes to advertisers its ability to target ads to users of its search engine based on their personal information.

The Federal Court’s decision means the Federal Privacy Commissioner has jurisdiction to continue its investigation and PIPEDA applies to Google search results. We expect the Commissioner to proceed, with further legal issues arising, including a Charter challenge to a final decision by the Commissioner. So the question of whether Canadians have a “right to be forgotten” under PIPEDA is yet to be decided (although we expect the answer to be “yes”).

In the meantime, this case has given us guidance regarding the application of privacy laws to “free” web-based activities. It is clearer that PIPEDA will apply to many other services which are provided without charge to the users. Even if there is a “free” aspect of a service, where it is intertwined with other activities which are commercial, including those collecting or using personal information as a business model, it may be governed by PIPEDA.^[2]

_{[1] 2021 FC 723}

_{[2] Note that other privacy laws may apply, depending on the nature of the information and where it is collected, used or disclosed.}