Canada Border Services Agency over-discloses personal information to the Information Commissioner in relation to an ATIA request

An individual complained that the Canada Border Services Agency (CBSA) over-disclosed their personal information to the Information Commissioner (IC) when seeking approval to decline two Access to Information Act (ATIA) requests. The CBSA provided not only information related to the ATIA requests but also a sensitive labour relations report about the complainant. The CBSA argued the disclosure was a "consistent use" under paragraph 8(2)(a) of the Privacy Act, as the information was collected in the context of workplace conflict and the disclosure was to determine how to handle the complainant's requests for their personal information. The OPC found that while information related to the ATIA requests was a consistent use, the disclosure of the labour relations report was not, as its original purpose (addressing workplace conflict) was distinct from responding to ATIA requests. The OPC concluded that the CBSA contravened section 8 of the Privacy Act and recommended the CBSA develop guidance for consistent use disclosures. The CBSA disagreed with the finding and declined to implement the recommendation, leading to a "well-founded and not resolved" outcome.