Reputation management Canada: which law, which route

Reputation management in Canada runs on four layers of law, not one: the federal privacy statute (PIPEDA) for personal information held by organizations in commercial activity, Quebec's own private-sector privacy act, the Criminal Code for intimate images and threats, and provincial civil law for false statements. Canada has no statute titled "right to be forgotten", but the federal Privacy Commissioner has found that PIPEDA supports de-listing from name searches in limited cases, and the search engine concerned has refused to accept that finding.

That makes Canada an unusual file. The strongest federal argument is a regulator's finding now before the Federal Court, not a settled rule, and Quebec has its own private-sector act that we could not verify for this guide.

This guide is the route map for a reader whose problem touches Canada. It is information, not legal advice: provinces differ, facts decide cases, and your own lawyer in the right province decides what applies to you. We read PIPEDA, the Privacy Commissioner's findings, news release and draft position, the Criminal Code sections on intimate images, and British Columbia's anti-SLAPP act. What we could not read, including Quebec's private-sector act, is said in the text.

The short version

Sort the problem first: a false statement, an accurate but old page, personal information held by a business, an intimate image, and a threat each go down a different Canadian route.
Federal law (PIPEDA) applies to personal information in the course of commercial activities. In 2025 the Commissioner found that a search engine breached PIPEDA by listing old articles for a name search, but the search engine declined to act and the Commissioner has since gone to the Federal Court.
Quebec has its own private-sector privacy act, reported to include a de-indexing provision. We could not read it for this guide, so check it with a Quebec lawyer.
The Criminal Code makes sharing an intimate image without consent an offence and lets a judge order material deleted. Report to police and to the platform together.
British Columbia has a dismissal route for lawsuits over public-interest expression, and Ontario and Quebec have comparable protections, so a threatening letter can backfire.

Reputation management in Canada starts with whose law applies

The first question is not "what is the Canadian rule" but "which Canadian rule". Parliament passed PIPEDA and the Criminal Code. Each province controls most civil claims, including defamation, and private law in Quebec rests on civil law while the other provinces use common law. That split is why a single sentence about "Canadian defamation law" is almost always wrong.

For reputation work this gives four layers. The privacy layer asks whether an organization may keep, show or link to personal information. The criminal layer asks whether conduct such as sharing an intimate image is an offence. The civil layer asks whether a statement is a wrong against you, province by province. The procedural layer asks whether the person who spoke can have your claim thrown out early. This article covers the first, second and fourth. The civil defamation test and clock differ by province, so we state none here.

Canada also has no statutory erasure article with listed grounds. The privacy route is built from a general rule about appropriate purposes, a regulator's reading of it, and, in Quebec, a separate provincial act that we could not verify.

Which Canadian route fits which reputation problem

Choose from the problem, not from the loudest tool. The table below is the order in which we would test each situation. It states what each route can change and, as important, where it stops.

Problem	First route	What it can change	Where it stops
False statement of fact on a site	Correction request to the publisher, then provincial civil law	The page, by correction or removal	Civil test and clock vary by province; not covered here
Accurate but old news page	Publisher update request, then search engine request	An added note, or the listing for your name	Outside Quebec, de-listing is argued, not settled
Personal data held by a business or directory	Written request to the organization under PIPEDA (or the Quebec act, to be checked)	Access, correction, or ending the use	Journalistic purposes are outside Part 1 of PIPEDA
Link to a page in name searches, in Quebec	Quebec private-sector act, checked with a Quebec lawyer	Possibly de-indexing of the link for your name	We could not read the text; conditions not stated here
Intimate image shared without consent	Platform report and police report together	Takedown, and a judge's deletion order	Needs an identifiable system within a court's reach
Threat to publish, or repeated targeting	Police report, preserved evidence	Criminal process	Police and prosecutors decide, not you

A legal letter is not the first move for any row, and the rows that depend on a regulator or a court take months to years, so the fast work in a Canadian file is almost always the publisher and the platform.

PIPEDA: what the federal privacy statute covers and what it does not

The Personal Information Protection and Electronic Documents Act applies, under section 4(1), to personal information that an organization collects, uses or discloses in the course of commercial activities. Section 2 defines a commercial activity as any transaction, act or conduct, or any regular course of conduct, of a commercial character. So PIPEDA is a statute about how businesses handle information. It is not a general law about what people may say about you.

That scope has three consequences. First, a private individual's blog post is generally not the target; the target is an organization acting commercially, such as a directory, a company that sells personal information or, as the Commissioner found, a search engine operator. Second, section 4(2)(c) carves out journalism: personal information handled for journalistic, artistic or literary purposes is excluded from Part 1, so a request to a news publisher to "delete my data" under PIPEDA is likely to fail, while a request to correct a factual error belongs to the editorial process. Third, section 26(2)(b) lets the Governor in Council exempt organizations from Part 1 where a substantially similar provincial law applies within that province. We did not read the orders or the other provincial statutes, so whether PIPEDA or a provincial law governs a given organization is a question for your lawyer.

The standard that matters: appropriate purposes

The operative test is in section 5(3): an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Almost every Canadian de-listing argument runs through that sentence. It lets a regulator weigh harm against public interest, and it gives no listed grounds and no automatic outcome.

The procedure and its clocks

Section 8(3) requires an answer to a request in any case not later than thirty days after receipt, and section 8(5) deems silence a refusal. A person can then file a written complaint with the Commissioner under section 11(1). Section 13(1) requires the Commissioner's report within one year of the complaint being filed or initiated, and section 14(2) gives a complainant one year after the report to apply to the Federal Court.

Clocks read in the federal text, in daysOne year taken as 365 days; width is days divided by 365, rounded. Different kinds of clock, shown on one scale for proportion only. The 365 bars are the maximum.

Organization must answer an access request (PIPEDA s. 8(3))30 days

Commissioner's report after a complaint (PIPEDA s. 13(1))365 days

Complainant's Federal Court application after the report (s. 14(2))365 days

Source: PIPEDA sections 8, 13 and 14 on Justice Laws. The Commissioner's one-year figure is the statutory duty to report, not a prediction of how long a file takes.

Do not read the one-year report duty as a speed promise. The complaint behind the search-engine findings was received in June 2017 and the findings issued on 27 August 2025, after a jurisdiction fight through two courts. The regulator route is a long game.

The Commissioner's finding on search results: a recommendation, not yet a right

The key primary source on de-listing is the Privacy Commissioner's report of findings, PIPEDA Findings 2025-002, issued on 27 August 2025.

What happened and what the Commissioner weighed

The complainant said that media articles linked to their name, many years old, described a criminal charge that was stayed shortly after it was laid, and that the articles had led to physical assault, lost employment opportunities and stigma. Most articles did not mention the stay. The Commissioner found the results involved sensitive information and significant harm to the complainant's safety and dignity, which outweighed the limited public interest in the articles appearing in searches for the complainant's name.

On that balance the Commissioner found a contravention of section 5(3). There was no breach of the accuracy principle, because it does not extend to the content of linked pages. So the argument that works is not "the article is wrong" but "listing this page for my name is no longer an appropriate purpose".

What the Commissioner recommended and what happened next

The recommendation was to de-list the articles from searches on the complainant's name, in full or in part. The articles themselves would stay online and appear in other searches. The search engine declined, saying that the courts should first decide whether PIPEDA provides a de-listing right, when it applies and whether it infringes the Charter's freedom of expression guarantee. The complaint was therefore recorded as well-founded and unresolved.

The Commissioner cannot make binding orders to enforce compliance. In a news release dated 28 August 2026, the Commissioner's office announced a Federal Court application seeking an order to implement its recommendations. The outcome was not known when this guide was written.

On jurisdiction, the findings record that the Federal Court held in July 2021 that the search service is subject to PIPEDA and not exempt as journalistic activity, and that the Federal Court of Appeal upheld that in September 2023.

How the Commissioner's earlier position fits

In January 2018 the Commissioner published a draft position on online reputation. Its view was that PIPEDA applies to search engines' indexing and display of results, and that de-indexing "does not remove the content itself from the Internet". It separated content you posted yourself, where removal should be near-absolute, from content posted by others, where there is no unqualified right to remove it but inaccurate, incomplete or outdated information can be challenged. It is a draft, not a court holding.

Quebec: a separate private-sector act, and what we could not confirm

Quebec differs, and this is the part of the guide we could not verify. Quebec has its own Act respecting the protection of personal information in the private sector, and it is reported to contain an express provision on de-indexing a hyperlink attached to a person's name. The official statute page on LegisQuebec could not be read for this guide after repeated attempts, and the other copy we found disallows automated reading, so we do not state its conditions, the factors a decision maker weighs, the reply deadline or the other sections here. We also did not read the Civil Code articles on privacy and reputation, the Commission d'accès à l'information's guidance or any Quebec court decision.

What follows from that is practical. If the page or the holder is in Quebec, read the current text of that Act yourself or ask a Quebec lawyer before you write to anyone, and check whether a particular search engine operator falls inside it. Do not copy a request template that quotes a section number without checking it against the statute. The Commissioner's findings on sensitivity, harm, time elapsed and public interest are a useful guide to the kind of weighing a regulator does, even where the legal test differs.

The Criminal Code: intimate images, threats and a judge's deletion order

When the problem is an intimate image, the first law is criminal, and the protective order of operations is simple: report to the platform and to police, and preserve evidence before anything is removed. Section 162.1(1) of the Criminal Code makes it an offence to knowingly publish, distribute, transmit, sell, make available or advertise an intimate image of a person, knowing that the person did not consent or being reckless about consent. The offence can be prosecuted by indictment, with a maximum of ten years' imprisonment in the base offence, or on summary conviction. Section 162.1(1.1) separately covers threats to publish, with the same maximum of ten years on indictment.

Section 164.1 is the removal tool. On sworn information giving reasonable grounds to believe that illicit material is stored on a computer system within the court's jurisdiction, a judge may order the custodian of the system to give the court a copy, stop making the material available, and provide information that identifies and locates the person who posted it. The person who posted it gets notice and may appear to oppose. A court satisfied on a balance of probabilities that the material is illicit may then order its deletion. For an intimate image tied to an offence under section 162.1, the court must order deletion within 48 hours after the order is made, and a deletion order does not take effect until the time for final appeal has expired.

These are criminal-process tools run by police and prosecutors, not a form you file. Jurisdiction attaches to a computer system within the court's reach, which is a problem for an offshore host, and a deletion order removes a copy from one system, not every re-upload. Where the material is an intimate image, our leak removal page describes how we handle the takedown side while police handle the offence.

Anti-SLAPP: why a legal threat in Canada can cost the sender

A strategic lawsuit against public participation is a claim whose real purpose is to silence debate. Several provinces have a way to stop one early, and it changes the arithmetic of a legal letter: over a post on a public-interest matter, you may be the one who must show your claim is strong.

British Columbia's Protection of Public Participation Act is the text we read in full. Section 4 lets a person sued over expression on a matter of public interest apply to dismiss the claim, and the court must dismiss unless the claimant shows there are grounds to believe the claim has substantial merit and the respondent has no valid defence, and that the harm is serious enough that the public interest in continuing outweighs the public interest in protecting the expression. Section 5 pauses further steps while the application is pending, section 7 gives full indemnity costs on dismissal unless inappropriate, and section 8 allows damages where the claim was brought in bad faith or for an improper purpose.

Ontario (through its Courts of Justice Act) and Quebec (the abusive-proceedings rules of its Code of Civil Procedure) have comparable early-dismissal tools. We could not read the current text of either for this guide, so we do not state their tests, deadlines or costs rules here. A lawyer in the province will tell you how the tool works before you send or answer a letter.

Before you send a lawyer's letter about a post, ask whether it concerns a matter of public interest and whether you can show real merit. If the honest answer is "it is an accurate, unflattering article about my business", the letter is the wrong tool in every province.

The right order of operations, with an invented scenario

The sequence below is the order we use when a Canadian file starts, with timings that are typical experience, not promises. Courts, publishers and regulators set their own pace.

A realistic sequence for a Canadian file

Days 1 to 3: capture and classifySave dated captures of each page, note the publisher, host and province, and sort each item as false, accurate but old, personal data, or intimate image. Do not contact anyone yet.
Days 3 to 7: confirm which law appliesIs the holder an organization acting commercially, a journalist, an individual, or an enterprise in Quebec? Note any limitation period with your lawyer in the right province.
Weeks 1 to 3: the simplest target firstAsk the publisher to correct or update, or report to the platform under its rules. For an intimate image, report to police the same day.
Weeks 3 to 8: the privacy requestWrite to the organization or search engine operator with the section 5(3) argument, or, in Quebec, the provision your Quebec lawyer confirms. Set a diary date at thirty days.
Months 2 to 12: regulator or courtIf the answer is no, decide between a complaint to the Commissioner, a Quebec complaint, or a civil step. Weigh cost and delay.
Throughout: strengthen what ranksPublish accurate pages you own so the first results for your name give a fuller picture while a request is pending.

Invented scenario: an old article and a working professional

Generic parties, stated assumptions. A professional in a province outside Quebec has an eight-year-old local news article about a charge that was withdrawn. It does not mention the withdrawal and ranks second for their name. They hold no public role, and the publisher is a small local outlet.

The first step is a polite request to the editor to add a note that the charge was withdrawn, with a document showing it. That is a correction request, and journalism sits outside PIPEDA's privacy rules, so it is the right ask. If the editor adds the note, the listing may stop being the problem. If not, the next ask is to the search engine operator, framed on the factors the Commissioner weighed: a private person, a withdrawn charge, an article that omits it, elapsed time, a name search. The operator may refuse, as in the Commissioner's file. Then the choice is a slow complaint to the Commissioner or building accurate pages that rank above the article, and most files run both. In Quebec the same professional would ask a Quebec lawyer whether the province's own act adds a request.

What Canadian law will not do, and the tactics that backfire

Canadian routes fail in predictable ways. The first is aiming at the wrong holder: a PIPEDA request to a newspaper over its journalism, a defamation letter to a platform over a user's post, or a Quebec request to someone outside the scope of that act. The second is arguing accuracy where the real argument is appropriateness. The third is citing the Commissioner's finding as a settled right: the Commissioner cannot make binding orders under the statute as it stands, so a request saying "the Commissioner has ordered" is wrong on its face.

The fourth is the Streisand effect: a heavy response to a small post can produce a bigger article about the response. The fifth is an adviser who promises removal, which no honest adviser can. Fake reviews, fake profiles and pressure on a journalist are not part of any lawful route.

Your next step: sort the pages, then choose one holder and one route

List each page that worries you, with its date, holder, province, whether it is false or accurate, and whether it ties you to a public role. That list is what a lawyer or adviser needs first. Then pick the cheapest route in the first table that reaches the right holder.

If this is happening to you now

If a page or an image is live and you cannot tell whether it is a privacy, criminal or civil problem, send Reputation Partners the URL, the date it appeared and the province. We read the file, say which holder and route fit, and say plainly when a route will fail. Start with a private audit.

Questions people ask

Does Canada have a right to be forgotten?

Not as a named statute. The Privacy Commissioner found in 2025 that PIPEDA supports de-listing from name searches in limited circumstances, but the search engine involved declined and the matter is before the Federal Court. Quebec has its own private-sector act, which we could not read for this guide, so check it with a Quebec lawyer. Elsewhere, treat de-listing as a request to be argued, not an entitlement.

Can I make a newspaper delete an old article in Canada?

Usually not through privacy law, because PIPEDA excludes personal information handled for journalistic purposes. What you can do is ask the editor to correct, update or add the outcome, such as a withdrawn charge, with documents. Many publishers will add a note even when they refuse to unpublish. A search listing for your name is a separate request to a different holder.

What can I do if someone threatens to post my private images?

Section 162.1(1.1) of the Criminal Code covers threats to publish an intimate image. Keep every message with dates, do not pay or negotiate, report to the platform and to police, and tell a person you trust. Evidence matters more than argument, and a judge can later order deletion of images that were shared.

Should I sue first or write first?

Write first, in almost every case. A correction request or platform report costs little and shows what the holder will say. A claim needs a province, a defamation test and a clock that we do not state here, and in provinces with anti-SLAPP rules, such as British Columbia, an early challenge can shift costs onto you. Have a lawyer in the right province confirm the clock.