Personal information about yourself in Google search results can hurt your job prospects badly, sometimes before an interview even happens. An old address that still appears on a data broker site could bring unwanted contact with your family members. Outdated professional info about you can make you look far less qualified than you are when clients look up your name.
PIPEDA gives Canadians the right to request the removal of their personal information from any company doing business in the country, and Google is included in that list. The Personal Information Protection and Electronic Documents Act (I know, that’s a mouthful) says that private sector businesses have to allow you to access and correct your own data when it’s no longer accurate or relevant to why they collected it. The Federal Court of Appeal rulings have established that Google has to follow PIPEDA for its Canadian search engine operations, representing a big win for privacy advocates across the country.
Submit a vague request, and Google will probably deny it. Follow the right steps with solid evidence and reference the correct legal provisions, and you’ll have a much better chance of getting your information removed. We’re going to cover exactly what decides if your information qualifies for removal, how to put together a request that mentions the right PIPEDA sections that you need, what the submission process looks like and how to follow up on it, what you can do when PIPEDA alone won’t cut it and some recent changes to the law that have actually made these rights stronger.
Let’s go through how you can use PIPEDA to protect your online privacy!
What Gets Removed Under PIPEDA
Google has its own checklist that determines what information gets removed under PIPEDA. For content to qualify for removal, the information needs to be inadequate, irrelevant or excessive if you compare it to the original reason it was collected for. It sounds pretty vague and open to interpretation. Removal cases help to show how Google applies these standards in practice, and the whole process gets much easier to follow if you see a few examples.
Old street addresses that show up on data broker sites are a great example of what usually qualifies for removal. Outdated professional info that doesn’t line up with what you actually do anymore would be in this category as well. Personal information that was never newsworthy tends to qualify, too. Requests like these have a much better chance at approval because, at this point, the information doesn’t serve any purpose anymore.
News articles are much harder to get removed from the search results. Google will usually reject your removal request if the story was newsworthy at the time that it was published. Public interest stories work the same way. The courts have made it pretty obvious over the years that public access to information matters more than personal privacy in cases like this.
The Office of the Privacy Commissioner has dealt with plenty of these requests at this point, and the results usually follow a pretty predictable pattern. Commercial databases are far more willing to remove your personal information than news websites or public records. Your request stands a much better chance if a company collected your data without a business need or if they’ve been sitting on it for far longer than they should have been. Information that’s connected to court cases or official government business usually remains available online, though.
Go into this with realistic expectations about what you can get removed. Content that shows up in legitimate news coverage or ties back to official public records is usually going to stay up – there’s not much you can do about that. Outdated personal info that doesn’t matter anymore or isn’t relevant to anything gives you a much stronger case to work with if you request removal.
How to Prepare Your PIPEDA Request
Google won’t even look at your submission until you have the paperwork in order, so step one is to get everything pulled together. Google responds much faster when your request is complete and includes the information they need. But vague or incomplete requests will usually just sit there in their system until they eventually get rejected.
First, make a list of every URL where your personal information shows up online. Copy these directly from the address bar at the top of your browser. Take a screenshot of each page and use a highlighter tool to mark the exact text or images that display your information. Google needs this proof because it needs to have visual confirmation of exactly what you want removed from its results.
A formal letter is going to be a part of the process as well, and the letter has to cite the relevant sections of PIPEDA. Section 4.9.5 is the one to reference here – it’s the main provision that covers correction requests. The letter should explain in detail why the information needs to be removed or corrected.
After you’ve done that, your next step is to support everything with strong evidence. When the information is outdated or just too old to be relevant anymore, you’ll need to include proof that backs up what the correct facts actually are. When something is wrong or inaccurate, be specific about what the truth actually is. And if this misinformation is causing harm to you (maybe professionally or personally), don’t gloss over it or stay too general about it. Describe the particular ways that it’s impacting your life and what consequences you’re facing because of it. Multiple pages that are scattered across different websites can get messy to track. But a basic spreadsheet is one of the easiest ways to stay on top of everything. Set up columns for each URL that you find, the date you found it, what personal information is showing up on that page and which section of PIPEDA it violates.
Success with removal requests depends heavily on how much detail you can provide about what needs to come down. Their team deals with thousands of these requests every day, so simple and precise instructions make the difference in whether they’ll act on yours. The more detail you can give about where your personal information shows up and why the law supports its removal, the better your odds are of actually seeing results.
What Should You Expect After Your Request
Once the prep work is done, the next step is to submit your request to Google’s privacy team. Google gives you a couple of ways you can do this – there’s an online form you can fill out, and you can also contact them directly through email. The option you choose depends on what type of content you’re trying to get removed. All that documentation you pulled together and organized in the earlier steps comes into play at this point.
After you submit your request, you can expect to wait between 30 and 45 days for a response. Google processes thousands of these requests every day, so it takes them a while to review each one individually. Your first response will probably be an automated email that doesn’t address your situation at all. When this happens, just reply and ask to have an actual person review your case.
Save every email and response from Google – all of them, no exceptions. This paper trail will be very helpful if you end up needing to escalate your case later on. Google tends to need a few exchanges before it actually approves most requests. If it takes multiple rounds of emails to get your approval, that’s normal.
If 2 weeks go by without you hearing anything back, then go ahead and send them a friendly follow-up message. Sometimes requests just slip through the cracks on their end, and a reminder can help push yours near the top of their pile. Many of these actually take a couple of messages before you finally get what you need.
Google might say no to your request – that happens. When they do, you still have other options that you can try. The Office of the Privacy Commissioner of Canada accepts complaints from people, and they’ll mediate between you and Google to help resolve the dispute. The records you kept of your communication with Google actually matter at this point.
What PIPEDA Requests Cannot Do
PIPEDA requests can be a useful tool for removing some of your personal information from the internet, and in plenty of cases, they work quite well. They won’t erase everything you want gone, though. News articles and court records fall outside what privacy laws like PIPEDA can control because they’re meant to serve the public interest. Articles that covered events when they happened are protected under press freedom laws, and this protection applies even if we’re talking about events from years back.
Google actually has its own set of removal tools available, and they usually work way faster than if you submit a request through PIPEDA. You can visit removals.google.com and fill out a removal request if the search results are displaying your sensitive personal information (like your ID number or bank account info). Google usually processes these requests within just a few days and beats waiting around for weeks on end.
For content that you actually created yourself, copyright law is probably a much better option. The DMCA lets you file what’s called a takedown request whenever anyone posts your photos or writing online without asking you first. With it, you just need to prove your ownership rights, and you won’t have to prove any privacy violation.
Defamatory content is a different situation. PIPEDA won’t help with false statements that damage your reputation – you’ll need a court order if you want that content removed. The Globe24h.com case from 2018 is a solid example. The Federal Court ordered the website to take down a few articles because they had crossed some legal lines.
PIPEDA requests work in specific scenarios. Your situation can shift (maybe new information comes up or circumstances develop), and you’ll need a different strategy. This happens all of the time. What helps most is matching your strategy to what’s actually visible in the search results, and even more so, why those results are creating a problem.
New Laws Will Make Removals Easier
PIPEDA has quite a few limitations, and they’re fairly big ones at that. We could see some big changes over the next few years, though. Parliament has been working through Bill C-27 since 2022, and if it passes, it would create something called the Consumer Privacy Protection Act. This new act would replace the main sections of PIPEDA.
The revised law would give Canadians much stronger removal rights, and these rights would work like the ones already in place across Europe. Under GDPR, anyone can ask search engines to delist some information about them when it’s outdated or just not relevant to their lives anymore. Bill C-27 would bring these same kinds of protections to Canada. For you, asking Google to remove links that are about yourself could actually have some legal muscle backing up your request later.
Canada’s Privacy Commissioner has been asking for better enforcement tools since 2020. As it stands, the office can investigate complaints and make recommendations to businesses when problems come up. The Commissioner can’t do anything about it if a company wants to ignore those recommendations, though. The updated framework would change that and give the Commissioner the authority to issue binding orders that businesses would have to follow. They’d also gain the ability to impose financial penalties on organizations that violate privacy laws. This would be a big move away from the system that we have now, where businesses can ignore the Commissioner’s recommendations without any consequences.
Canadian law actually has some strong precedent for this already. In the A.T. v. Globe24h.com case, a Canadian court ordered a search engine to delist the content about a person. What made the ruling important was that it showed judges have the power to force search engines to take action when the situation warrants it. Not every request will be approved. But the case did show that removal orders like this are possible to get under Canadian law.
Bill C-27 is still working its way through the legislative process, so we don’t have an exact date for when it might become official law. It needs to go through a few more stages of review and debate before anything gets finalized. If it does eventually pass, the whole process for submitting removal requests should become much easier to work through. Your requests would also have a much better shot at success. One of the biggest changes would be around enforcement – businesses that refuse valid removal requests would face financial penalties instead of just receiving a warning and going about their business as usual.
Monitor and Manage Your Reputation
Breaking this process down into smaller steps can make it feel a lot easier. Your first step is to make sure PIPEDA actually covers your situation. Once you’ve established that part, the next step is to pull together the necessary information and documents for your request. When you’re ready to submit, make sure that you’re going through the correct channels for your situation and write down the records of everything you send out, along with the dates. When your first request doesn’t pan out the way you hoped, that’s okay – you still have a few paths forward. One option is to contact the Privacy Commissioner’s office directly and let them handle it. Another way would be to look into some of the other removal methods that could have been a better fit for your case.
PIPEDA gives you some strong rights to your personal information, and that’s worth remembering. Google doesn’t always remove the content just because you ask them to, though – there’s no guarantee that it’ll happen. These requests usually take a while to process, and you’ll probably need to send a few follow-up messages until you finally see any movement. Privacy laws in Canada have become much stronger over the last few years, and the courts usually side with people more. Judges and privacy regulators take these matters seriously, so your odds of success are better than they were even a few years back.
This whole process might take longer than you’d like. But it’s worth the time and effort. Your privacy matters quite a bit. Putting in the work on it shows you care about what information stays visible online. Try the easiest removal methods first. If those don’t pan out, a formal PIPEDA request is always available as your next option.
If you want to manage what shows up about you online, experts who know this field inside out can be the smartest move you make. If you’re ready to focus on your online reputation, we have a team of specialists at Reputation.ca in Canada who take care of everything from review management and social media to public relations and crisis situations when they come up. Maybe you need help responding to cancel culture, or maybe you just want to build a stronger online reputation – in either case, we have the experience and tools to work with you. Contact us at Reputation.ca for some advice that’s matched to what you need.
