The right to erasure of personal information in Canada: Between fact and fiction

Éloïse Gratton May 28, 2021

It is increasingly common for businesses to receive requests from customers asking for the deletion of all of the information that the business holds about them. Such requests raise the issue of whether there is a right to the deletion or erasure of personal information under Canadian data protection laws.

The concept of the right to erasure comes from the General Data Protection Regulation (GDPR), which is frequently referred to as the benchmark legislation for data protection around the world. Effective as of 2018, the GDPR grants several rights to data subjects, including in Article 17, a right to obtain the erasure, as soon as possible, of personal data that a business holds about them, where one of the following grounds applies:

  • personal data is no longer necessary in relation to the purposes for which it was collected;
  • the data subject withdraws consent upon which the processing is based and there is no other legal ground for the processing;
  • the data subject objects to the processing of personal data concerning him or her and where there are no overriding legitimate grounds for processing;
  • personal data has been unlawfully processed;
  • personal data has to be erased for compliance with a legal obligation; or
  • personal data was collected when the data subject was a child and was not fully aware of the risks involved with the processing.

It is worth pointing out that the GDPR does not provide a general right to erasure but rather a limited right to specific circumstances. Canadian businesses subject to the extraterritorial scope of the GDPR, must ensure that they have procedures to assess and handle requests for erasure made under the legislation. Namely, should these businesses offer goods or services to individuals located in the European Union or monitor the behaviour of those individuals, to the extent that the behaviour in question takes place within the Union.

Do Canadian data protection laws provide individuals with a similar right?

You can consult our article which seeks to answer this question in order to provide guidance to businesses dealing with requests for says deletion of personal information.

This content has been updated on October 16, 2021 at 11 h 57 min.