Category Archives: Privacy

Canada a Little Closer to Recognising Right to be Forgotten

Posted on by

The Federal Court recently issued a decision further to a reference triggered by the Privacy Commissioner and involving Google, and in particular the extent to which search engine may be considered businesses that are governed by rules pertaining to the protection of personal information. In short: yes, Google should be considered a normal business and, yes, search engines may be considered as holding and using personal information.

In practice, one consequence of the recent ruling at issue is that individuals the personal data of whom is held and displayed by the likes of Google, when third parties make searches on the Web, would seem to be covered by normal rules requiring that the information be up-to-date, exact and still relevant. In short, in certain cases, it could be that individuals may require search engines to stop their algorithms from referencing inaccurate or obsolete information.

Though the Federal Court decision at issue was technically NOT about the right to be forgotten, this judgment does open the way for Canadians to claim a right to deindexation of erroneous or obsolete Web search results, akin to the right to be forgotten that European law now grants citizens. This could happen with or without legislative changes to provide for it expressly.

Though people are already invoking the right to have stuff about them deindexed (by search engines), for now, providers like Google aren’t too keen to start recognizing that such a right does indeed exist in the U.S. or Canada. Now, as the Privacy Commissioner starts investigating and processing complaints about search engine results, to be seen whether a right to deindexation will indeed materialize in Canada, and how fast.

Québec Court Rejects Privacy-related Class Action Filed After Loss of Laptop

Posted on by

The Québec Superior Court recently rendered judgment in the matter of Lamoureux c. Organisme canadien de réglementation du commerce des valeurs mobilières (2021 QCCS 1093), further to a class action resulting from the loss of a portable computer containing personal information.

Contrary to what often happens with such class actions, this one did make it through the whole process, up to and including an actual judgment on the merits of the case. In the end, the Québec Superior Court rejects the claims, including those for ordinary damages as well as the claim for punitive damages. In doing so, however, the court does provide us with some principles that seem worth remembering.

This case stems from the loss of a portable computer by an employee of the defendant, a non-encrypted device which contained sensitive information about certain individuals. Even though these individuals may have worried and have been somewhat anxious at the thought of having their identities stolen, the court held that this was, in and of itself, insufficient to qualify as a real prejudice at law. As often happens is such cases, the judge found that more was required before the legal system would be required to intervene, including by awarding monetary compensation.

The class representative in this case was also alleging that certain attempts had been made to steal his identity, something more likely to deserve redress by the court. However, the plaintiff was unable to demonstrate causation between the fault of the defendant (in handling his data and the incident at issue) and such attempted identity theft. Given this absence of a causal link between the fault and the alleged damages, the court also rejected this portion of the claim.

Interestingly enough, this case provides us with a good example of the steps taken by an organization faced with a loss of data and which the court validates as appropriate under the circumstances. The defendant organization here performed an adequate inquiry, hired a specialized consultant, notified the privacy authorities, and notified potential victims. The organization also paid for credit-report surveillance services for these individuals, all of which lead the Superior Court judge to also reject this final claim (for punitive damages), given that the steps taken were adequate under the circumstances.