Measures to anonymize sensitive polygraph records mitigated privacy impacts of NSIRA review
The Office of the Privacy Commissioner (OPC) investigated complaints against the NSIRA Secretariat regarding its access to sensitive polygraph records during a review of the Communications Security Establishment's (CSE) Internal Security Program. Complainants questioned whether the collection of personal information complied with section 4 of the Privacy Act and if the Secretariat met its Personal Information Bank (PIB) obligations under section 10. The OPC found that while some un-redacted elements in security screening files posed a re-identification risk, the polygraph recordings themselves were sufficiently anonymized. Given NSIRA's broad mandate and right of access, the OPC concluded the collection issue was not well-founded. However, the Secretariat's delay in requesting approval for PIB changes was found well-founded, though resolved by subsequent submission. The OPC recommended the Secretariat prioritize PIB approvals and publish its Info Source page for transparency. The Secretariat committed to these actions.
- 1Whether the NSIRA Secretariat's collection of personal information (polygraph records) complied with section 4 of the Privacy Act.
- 2Whether the anonymization measures applied to polygraph records were sufficient to prevent re-identification.
- 3Whether the NSIRA Secretariat's viewing of personal information, even if not recorded, constituted a 'collection' under section 4.
- 4Whether the NSIRA Secretariat met its obligations under section 10 of the Privacy Act regarding Personal Information Banks (PIBs).
- 5Whether the NSIRA Secretariat's request for PIB approval was timely.
- 6Whether the NSIRA Secretariat published its Info Source page as required by TBS policy.
- Collection of personal information: Complaint not well-founded
- PIB obligations: Complaint well-founded
- PIB approval delay: Resolved by subsequent submission
- Transparency recommendations: Recommendations made and committed to
Complaint not well-founded regarding collection of personal information; well-founded and resolved regarding Personal Information Bank obligations.
The OPC found that the anonymization measures significantly mitigated re-identification risks, and NSIRA's broad mandate justified access, leading to a 'not well-founded' finding for the collection issue. However, the Secretariat's delay in updating Personal Information Banks was 'well-founded' but resolved by subsequent action taken during the investigation.
The OPC recommended the Secretariat collaborate with TBS to obtain final approval for PIB changes and publish its Info Source page on its website.
- s.4 Privacy Act
- s.10 Privacy Act
- s.11 Privacy Act
- s.71(4) Privacy Act
- s.8(1)(a) NSIRA Act
- s.8(1)(b) NSIRA Act
- s.9(1) NSIRA Act
- s.41(2) NSIRA Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro