Federal (Canada)Privacy ActWell-founded

Canada Revenue Agency and the Canadian Broadcasting Corporation (CRA) - 2015

Organization: Canada Revenue AgencyComplainant: Anonymous applicant
Plain-language brief

The Canada Revenue Agency (CRA) inadvertently mailed the personal information of approximately 1,000 individuals to a Canadian Broadcasting Corporation (CBC) journalist. This occurred due to an ATIP clerk mistakenly switching cover letters for two different response packages. The disclosed information included names, addresses, and details of donations. The CBC refused the CRA's requests to return the information, leading the CRA to initiate legal action. The OPC found that the CRA disclosed personal information without consent, contravening the Privacy Act. While the OPC noted the CRA's immediate remedial actions and action plan, it concluded that the disclosure did not meet the requirements of the Act.

Key issues
  1. 1Whether the inadvertent mailing of personal information to a journalist constituted a disclosure without consent under the Privacy Act
  2. 2Whether the information disclosed was 'personal information' as defined by section 3 of the Privacy Act
  3. 3Whether the disclosure met the requirements of section 8 of the Privacy Act
Outcome breakdownFavours: Applicant / complainant
  • Unauthorized disclosure: Disclosure contravened Privacy Act
  • CRA remedial actions: Noted but did not alter finding
Outcome

Complaint well-founded — corrective measures taken by institution

Reasoning

The OPC found that the CRA disclosed personal information without consent due to a lack of communication and quality assurance. However, the CRA's immediate and ongoing remedial actions, including an action plan and internal review, satisfied the OPC that no further action was required from its office.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The OPC encouraged the CRA to continue implementing its Action Plan, incorporate regular quality assurance monitoring, and monitor the recommendations from the third-party review of its ATIP privacy management control framework.

Statutes considered
  • s.3 Privacy Act
  • s.7 Privacy Act
  • s.8 Privacy Act

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro