Condita Research
← Back to catalogue/Federal (Canada)
Federal (Canada)Privacy ActWell-founded

Violating principle of 'need-to-know' leads to data breach - September 5, 2014

Organization: Aboriginal Affairs and Northern Development Canada (AANDC)Complainant: Anonymous applicant
BookmarkView Governing Law
Plain-language brief

An individual complained that Aboriginal Affairs and Northern Development Canada (AANDC) improperly disclosed personal information to La Presse newspaper. The newspaper published an article referencing a document created by AANDC that listed individuals who had made Access to Information Act (ATIA) requests related to former Minister Jim Prentice. AANDC confirmed the document's existence and reported that it had been created to respond to ATIA requests. The OPC found that AANDC improperly disclosed the personal information of those listed in the document, which ultimately reached La Presse. Furthermore, AANDC shared this information with officials who did not have a legitimate need-to-know. The complaint was found to be well-founded.

Key issues
  1. 1Whether the document contained personal information under s.3 of the Privacy Act
  2. 2Whether all AANDC officials who accessed the document had a need-to-know the identity of the requesters under s.7(a) of the Privacy Act and TBS Policy on Access to Information s.6.2.3
  3. 3Whether the disclosure of the information to La Presse constituted a contravention of s.8 of the Privacy Act
Outcome breakdownFavours: Applicant / complainant
  • Improper disclosure: Disclosure to La Presse was improper
  • Need-to-know principle: Information shared without legitimate need-to-know
  • Complaint outcome: Complaint well-founded
Outcome

Complaint well-founded — corrective measures recommended

Reasoning

AANDC contravened the Privacy Act by distributing a document containing personal information to officials who lacked a legitimate need-to-know and by being responsible for the improper disclosure of this list to La Presse.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The OPC recommended that AANDC review its policies and procedures for processing ATIP requests to ensure appropriate mechanisms are in place to respect the need-to-know principle, and report back within six months.

Statutes considered
  • s.3 Privacy Act
  • s.7(a) Privacy Act
  • s.8(1) Privacy Act
  • s.8(2) Privacy Act
  • s.6.2.3 Treasury Board Secretariat Policy on Access to Information

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro