Pictured: Some myosotis flowers; colloquially known as “forget-me-nots”. I thought these would be appropriate for this blog post.

In the estate planning world, we often see clients who want to be remembered for generations to come. For example, this could be through establishing a charitable gift, trust or foundation in their will; some people even find value in having some sort of organization, space or physical object named after them. This may also take the form of specific wish with respect to funeral and/or burial arrangements. And fittingly, with Remembrance Day happening tomorrow, I think we as humans generally see a lot value in commemorating and passing on history, knowledge, legacy and tradition to future generations.

But…what if someone doesn’t want to be remembered? What if they feel more comfortable having their name erased from every possible public record? Should such an individual have a “right to be forgotten”?

The Google LLC v. Canada (Privacy Commissioner) decision

I’ve recently become interested in the “right to be forgotten” after reading the Federal Court of Appeal’s decision in Google LLC v. Canada (Privacy Commissioner), 2023 FCA 200 (CanLII). The context is a bit complex—in summary this decision was about whether the federal Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) applies to the internet search engine Google, and accordingly whether the Office of the Privacy Commissioner of Canada (“OPCC”) has the power to make PIPEDA-based recommendations to the Federal Court for orders that would apply to Google.

By way of background, a complainant, whose identity is protected by a confidentiality order, lodged a complaint against Google with the OPCC. The complainant alleged that Google searches of his name were yielding links to news articles about him containing outdated, inaccurate, and sensitive information, and that Google’s dissemination of this information was directly exposing him to harm. Such harm included physical assault, employment discrimination, and severe social stigma, as well as persistent fear. The complainant essentially wanted the OPCC to assist in having links to his sensitive personal information delisted or deindexed from Google’s search results.

The complainant, based on a suggestion from the OPCC, approached Google and asked that it remove the links. Google refused and advised the complainant to resolve any disputes directly with the relevant website owners. The OPCC subsequently advised Google of the complaint and asked for a written response. In its response, Google argued that the OPCC had no jurisdiction because PIPEDA did not apply to it. Google’s arguments included that it is not engaged in commercial activity when it presents search results (so that paragraph 4(1)(a) does not bring it within PIPEDA), and that it serves a journalistic purpose when it provides search results leading to journalistic content (and thus is excluded from PIPEDA by operation of paragraph 4(2)(c)).[1]

The Federal Court of Appeal agreed with the lower courts in finding that PIPEDA did apply to Google, and that Google was not protected by an exemption. However, this does not automatically mean that the “right to be forgotten” now exists in Canada, only that we are one step closer to it. This decision did not actually require Google to make the requested deindexing, as the OPCC itself has no authority to compel a resolution of a complaint or to grant a remedy to the complainant. Rather, PIPEDA vests remedial authority in the Federal Court. As set out in section 13 of PIPEDA, the most the OPCC may do in response to a complaint is to issue a report containing findings and recommendations. By section 14, it is then open to the complainant—or to the OPCC where the OPCC initiated the complaint and certain other pre-conditions are met—to apply to the Federal Court for a hearing and a resolution. Thus, this decision essentially “opens the door” to a hearing about the deindexing itself (including from the aforementioned complainant).

Implementation of the “right to be forgotten”

I have written about PIPEDA before, specifically in relation to digital assets and estate planning. In my research on this topic, I have learned that while PIPEDA does not provide much guidance to fiduciaries or beneficiaries of a deceased person’s estate to access their digital assets from the relevant custodians (e.g. social media and other online accounts), many of these custodians are willing to delete a deceased person’s account provided that it can be proved that the accountholder did in fact pass away (i.e. by being presented with a valid death certificate).

However, there is a difference between a custodian with which one may have an online account and a search engine like Google, Bing or Yahoo which can essentially make one’s personal information publicly available. With the former, the individual has made the active choice to provide their personal information to the custodian. With the latter, the individual’s personal information is made searchable whether or not the individual consents to it.

This is where the “right to be forgotten” comes into play, and the Google LLC decision represents a trend in Canada towards enshrining that right. First, I note that the proposed replacement to Part I of PIPEDA, being the Consumer Privacy Protection Act, will allow individuals to request the disposal of their personal information by written request, unless an exception applies. The exceptions include, but are not limited to, information that is not severable from personal information of another individual, other requirements of the CPPA or other laws, or if the organization has a data retention policy and the personal information is already scheduled to be disposed. The CPPA is a part of Bill C-27[2] which most recently received its second reading in the House of Commons on April 24, 2023.

If the CPPA receives royal assent, then this would bring Canada in line with other jurisdictions that do have the “right to be forgotten”. For example, Article 17 of the General Data Protection Regulation implemented by and applicable to the European Union (as well as organizations that operate within the European Union) allows “data subjects” (i.e. individuals) the “right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” in certain circumstances. Google itself admits that it is a “controller” under the GDPR.[3] There is also European case law that has compelled Google to engage in such de-indexing; notably, Google claims that it received 12,000 de-indexing requests on the first day it began allowing European users to make such requests.[4]

Impact on estate planning

In my experience, many estate planning clients who have online accounts want these accounts to be deleted on death. If the “right to be forgotten” becomes law in Canada, should we be asking clients if this is also something they want to explore in their estate planning? As I explained in my previous blog post about the CPPA, the CPPA will allow the rights and recourses under the CPPA to be exercised on behalf of a deceased individual by a person authorized by or under law to administer the estate or succession of that individual (e.g. an estate trustee in Ontario), “but only for the purpose of that administration”. One might take this to mean that if an individual wants their personal information to be deindexed from search engines like Google upon death, then they should specifically include a direction to this effect in their will. It would seem that the fiduciary would then be obligated to give effect to this direction, and the CPPA would accordingly provide the authority for them to do so.

As I’ve stated in the past, privacy and personal information are becoming more and more relevant in the estate planning context. While the client’s views on these topics will inform the relevant planning strategies, the onus is also on the Government of Canada to pass legislation like the CPPA that gives greater power to individuals to direct the manner in which organizations that collect their personal information should use, maintain and dispose of such personal information.

[1] There were additional arguments relating to the Canadian Charter of Rights and Freedoms, but a description of these arguments is beyond the scope of this blog post.

[2] The CPPA is part of the Digital Charter Implementation Act, which was previously a part of Bill C-11. It is now part of Bill C-27.

[3] https://support.google.com/admanager/answer/9035987?hl=en

[4] https://www.slashgear.com/googles-right-to-be-forgotten-gets-12000-requests-in-one-day-30331217