5822-05416 — Canada Border Services Agency
The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld information related to cybersecurity and data breach risk assessments of the ArriveCAN application under subsection 16(2) and paragraph 20(1)(d) of the Access to Information Act. During the investigation, CBSA initially disclosed some records but continued to withhold others under subsection 16(2) and additionally claimed subsection 19(1). The Commissioner found that while some information met the requirements of subsection 16(2) (facilitating an offence), other portions did not. Furthermore, the Commissioner concluded that CBSA failed to properly exercise its discretion under subsection 19(2) regarding personal information, as it did not demonstrate efforts to seek consent or consider public availability. The complaint was found to be well founded. Although the Commissioner issued an initial report with orders, CBSA subsequently made further disclosures, and the complainant indicated satisfaction, making a formal order unnecessary.
- 1Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied to cybersecurity review information, including intranet/internal network addresses and specific vulnerabilities
- 2Whether s.16(2) ATIA was properly applied to statements related to asset identification and valuation, lists of components, summaries of changes, names of reference documents, and executive overviews
- 3Whether CBSA reasonably exercised its discretion under s.16(2) ATIA for information that met the exemption's requirements
- 4Whether s.19(1) ATIA (personal information) was properly applied to pictures and contact information of KPMG employees
- 5Whether CBSA made reasonable efforts to seek consent for disclosure of personal information under s.19(2)(a) ATIA
- 6Whether CBSA considered if personal information was publicly available under s.19(2)(b) ATIA
- 7Whether CBSA properly exercised its discretion under s.19(2) ATIA
- s.16(2) exemption: Exemption partially upheld, partially not met
- s.20(1)(d) exemption: Not addressed in summary
- s.19(1) exemption: Discretion improperly exercised
- Complaint outcome: Well founded
- Disclosure of records: Further disclosures made
Complaint well founded — further disclosure made, no order necessary
The Commissioner found that CBSA improperly withheld some information under subsection 16(2) and failed to properly exercise its discretion under subsection 19(2) regarding personal information. Although the complaint was well-founded, the institution's subsequent disclosures satisfied the complainant, negating the need for a formal order.
The Canada Border Services Agency was reminded of its obligation to provide full representations during the investigation and subsequently disclosed additional information to the complainant, who was satisfied.
- s.16(2) ATIA
- s.19(1) ATIA
- s.19(2) ATIA
- s.20(1)(d) ATIA
- s.30(1)(a) ATIA
- s.35(2)(c) ATIA
- s.37(1) ATIA
- s.37(1)(c) ATIA
- s.37(2) ATIA
- s.37(3)(a) ATIA
- s.34 ATIA
- s.43 ATIA
- s.4(2.1) ATIA
- s.10(1)(b) ATIA
This summary is for informational purposes only and does not constitute legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro