In Canada, the federal private-sector privacy law, PIPEDA, doesn't contain a stand-alone "right to delete" the way California's or the EU's laws do. What it gives you is the right to withdraw consent, plus a rule that businesses should not keep personal information they no longer need. A request to a people-search site therefore works best when it does both: withdraws your consent and asks for deletion. Quebec residents have additional rights under Quebec's private-sector law, as amended by Law 25.
Who PIPEDA covers
The Office of the Privacy Commissioner of Canada (OPC) says PIPEDA "applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity." Organizations in Alberta, British Columbia and Quebec may instead be covered by provincial laws that are "substantially similar." A people-search or directory site operating commercially is the kind of business PIPEDA is written for.
The two principles a request relies on
PIPEDA's rules are set out as principles in its Schedule 1. Two matter here:
- Withdrawing consent (clause 4.3.8). "An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice."
- Not keeping what isn't needed (clause 4.5.3). Personal information no longer required for the purposes it was collected for should be destroyed or made anonymous.
The OPC lists ten principles in all, including accuracy, individual access, and "challenging compliance," which is what lets you complain.
The publicly available information exception
PIPEDA lets businesses collect, use and disclose some publicly available information without consent, but only the categories in the Regulations Specifying Publicly Available Information, and only for related purposes. The categories are:
- Name, address and phone number in a public telephone directory, where the subscriber can refuse to be listed.
- Name, title, address and phone number in a professional or business directory, where the use relates directly to why the information appears there.
- Information in a public registry established by law, and in court or tribunal records, again only where the use "relate[s] directly to the purpose for which the information appears."
- Information in a publication such as a magazine, book or newspaper, where the individual provided it.
That last condition in each category does a lot of work. The OPC's 2019 finding against the directory operator 411Numbers is a direct example. The OPC accepted that a name, address and number published in a phone company's white pages counts as publicly available. But it found that "the information associated with unlisted telephone numbers does not fit within the definition of 'publicly available'" and so needed consent. It also said that "charging for removal of information that was posted without the requisite consent would also likely be considered inappropriate." The company stopped charging for removal and committed to taking unlisted numbers down.
A second example: the OPC found in 2015 that Globe24h, a site that republished Canadian court and tribunal decisions so search engines would index them, and charged a fee to remove personal information, had contravened PIPEDA. On January 30, 2017 the Federal Court confirmed those findings and ordered the operator to remove the decisions containing personal information. According to the OPC, "shortly after the Court's decision was issued, the website ceased to operate." The OPC found the site had no consent for this use; the court-records category in the regulations covers only uses that relate directly to why a record exists.
The template
This is the Canadian letter the free OptStub kit produces. It withdraws consent and requests deletion in one message.
To: [the business's privacy officer or privacy contact]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your city, province]
Address: [optional: the address the listing shows]
Phone: [optional]
Email: [optional]
Profile URL: (paste the URL of your profile page here)
I am withdrawing consent to your collection, use and disclosure of
my personal information under PIPEDA, and requesting its deletion.
If I am a Quebec resident, I also rely on Law 25.
Please confirm in writing when the deletion is complete.
If your number is unlisted, say so in the letter. The 411Numbers finding means a business can't treat an unlisted number as publicly available, so that detail is relevant to whether it needed your consent in the first place.
Quebec: Law 25 and the CAI
Quebec's private-sector privacy law, as amended by Law 25, is enforced by the Commission d'accès à l'information (CAI). According to the CAI:
- 30 days. The person in charge of protecting personal information at a business must respond to your request within 30 days of receiving it. A non-response at the end of that period counts as a refusal.
- Ceasing dissemination or de-indexing. You can ask a business to stop disseminating information about you, or to de-index a link to it, where the dissemination causes serious harm to your privacy or reputation that outweighs the public interest in knowing it.
- Disagreement review. If a business refuses, or doesn't answer in time, you can ask the CAI to review the disagreement (examen de mésentente). The request must reach the CAI in writing "dans les 30 jours du refus de la demande ou de l'expiration du délai pour y répondre" — within 30 days of the refusal or of the response deadline passing.
That 30-day filing window is short, so note the date you sent your request.
Complaining to the OPC
Outside Quebec, complaints about a business go to the OPC. It asks you to "always try to resolve the issue with the organization you had a problem with before reporting a concern," usually through the organization's privacy officer, and then to file through its online complaint system. The OPC also warns that it is "experiencing a high volume of complaints," with "processing delays of several months."
Our article on what to do if a data broker ignores you covers keeping the records a complaint needs.
Where to send requests
Canadian directory sites such as Canada411 and 411numbers are a starting point, and many US people-search sites also list Canadians. Our opt-out guides give each site's documented contact or form.
Removal is not guaranteed. A business may rely on the publicly available information exception, and data can be re-collected later from new sources, so check your listings again after your request has been answered.