Federal (Canada) privacy & access decisions

The Information Commissioner received a complaint alleging that the titles of certain briefing notes published on the Open Canada website were improperly withheld. The complaint did not arise from an access request made under Part 1 of the Access to Information Act (ATIA). The Commissioner reviewed the complaint under section 30 of the ATIA, which outlines the types of complaints that can be investigated. It was determined that the complaint did not fall under paragraphs 30(1)(a) to (d.1) as it did not relate to an access request. Furthermore, it did not fall under paragraph 30(1)(e) or 30(1)(f) as it did not concern a matter relating to requesting or obtaining access to records under Part 1 of the ATIA. The Commissioner noted that subsection 91(1) of the ATIA specifically precludes her from exercising powers related to the proactive publication of information under Part 2 of the Act. Consequently, the complaint was found inadmissible, and the Commissioner declined to investigate due to a lack of authority.

• Whether the complaint fell within the scope of section 30(1)(a) to (d.1) of the ATIA (complaints related to access requests)
• Whether the complaint fell within the scope of section 30(1)(e) or (f) of the ATIA (other matters relating to requesting or obtaining access under Part 1)
• Whether the Commissioner has authority to investigate complaints related to proactive publication under Part 2 of the ATIA (s.91(1))

This document is a compliance letter from Nova Scotia Power to the OPC, outlining actions taken and commitments made following a significant data breach that occurred in March 2025. The breach, caused by malware, led to the exfiltration of personal information belonging to approximately 375,000 current and 540,000 former customers. The compromised data included names, contact information, financial details, driver's license numbers, and SINs. The OPC received numerous complaints regarding the breach, including concerns about the collection and retention of SINs and the timeliness and method of notification to affected individuals. Nova Scotia Power has committed to deleting customer SINs (subject to legal requirements) and undergoing an external security assessment by October 2026. Upon satisfactory fulfillment of these commitments, the OPC's investigation will be discontinued.

• Whether Nova Scotia Power's security safeguards were adequate to protect personal information
• Whether Nova Scotia Power's collection and retention of Social Insurance Numbers (SINs) was appropriate
• Whether Nova Scotia Power's notification of affected individuals was timely and appropriate
• Whether Nova Scotia Power has taken sufficient corrective measures to address the breach and prevent future incidents

The Office of the Information Commissioner (OIC) received a complaint alleging that a federal institution failed to respond within an extended timeframe for an access request and engaged in inappropriate communication. The OIC accepted the complaint regarding the delay but deemed the complaint about inappropriate communication inadmissible. The institution had, on May 2, 2022, suggested the requester abandon their request, which the requester declined on May 22, 2022. The complainant argued the 60-day period for filing a complaint about the communication started when the extended response timeframe expired on August 25, 2022. However, the OIC determined that the alleged inappropriate conduct occurred on May 2, 2022, when the institution first communicated its proposal regarding the request. Since the complaint about communication was filed after the mandatory 60-day limit from May 2, 2022, the Commissioner found it inadmissible.

• Whether the institution responded within the extended timeframe for an access request
• Whether the complaint regarding the institution's alleged inappropriate communication was submitted within the 60-day time limit under s.31 ATIA
• When the complainant became aware of the grounds for complaint regarding alleged inappropriate communication

The complainant filed a complaint with the Office of the Information Commissioner (OIC) regarding an access request. The institution had responded to the access request by email, but the complainant inadvertently deleted the email before reviewing its contents. The complainant argued that the 60-day time limit for filing a complaint under section 31 of the Access to Information Act (ATIA) should begin from the date they became aware of the grounds for complaint, which was when they recovered and reviewed the deleted email. The OIC determined that the complaint was inadmissible because it was submitted outside the mandatory 60-day timeframe. The Commissioner clarified that the 60-day period begins the day after the requester receives the institution's response, not when they become aware of the grounds for complaint due to their own actions. The OIC concluded that the ATIA does not grant the Commissioner the power to extend this statutory time limit.

• Whether the complaint was filed within the 60-day time limit prescribed by section 31 of the ATIA
• Interpretation of 'in any other case' in section 31 of the ATIA regarding the start of the complaint period
• Whether the Information Commissioner has the power to extend the 60-day time limit for filing a complaint

The Information Commissioner ceased investigation into complaint 5819-02602. The complainant had indicated a desire to pursue the matter solely as a point of principle, despite the underlying issue for which the information was sought having already been settled. The Commissioner determined that the complainant's apparent lack of interest in actually obtaining the records, coupled with the request to continue the investigation based purely on principle, rendered the complaint trivial. Consequently, the investigation was ceased under paragraph 30(4)(a) of the Access to Information Act, which permits the Commissioner to discontinue an investigation if the complaint is deemed trivial, frivolous, vexatious, or made in bad faith.

• Whether the complaint was trivial, frivolous, vexatious, or made in bad faith under paragraph 30(4)(a) of the Access to Information Act

The complainant filed a complaint with the Office of the Information Commissioner (OIC) regarding an access request. The institution provided documentation showing that the complaint was submitted more than seven weeks after the 60-day statutory deadline set out in section 31 of the Access to Information Act. The complainant acknowledged the delay, explaining that the institution's response to their request had been "misplaced" after receipt, and asked the Commissioner to exercise "residual discretion" to extend the deadline. The Commissioner considered the complainant's representations and the documentary evidence. Citing Federal Court of Appeal jurisprudence, the Commissioner concluded that she does not have the authority to extend statutory timeframes for filing complaints. Therefore, the complaint was rejected as it did not meet the requirements of section 31.

• Whether the complaint was filed within the 60-day statutory timeframe under section 31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint

The Office of the Information Commissioner (OIC) received a complaint alleging that a federal institution failed to provide records in French in response to an access request. During the OIC's investigation, the institution translated the requested documents into French and provided them to the complainant. As the complainant subsequently received the documents in their preferred official language, the OIC determined that continuing the investigation was unnecessary. Consequently, the Information Commissioner ceased the investigation under paragraph 30(4)(b) of the Access to Information Act, which permits ceasing an investigation when it is no longer required due to the circumstances.

• Whether the institution failed to provide records in French
• Whether continuing the investigation was unnecessary under paragraph 30(4)(b) of the ATIA

The Office of the Information Commissioner (OIC) ceased an investigation into a complaint alleging that a federal institution failed to conduct a reasonable search for records created in the 1990s. The OIC invoked paragraph 30(4)(b) of the Access to Information Act, which permits ceasing an investigation if it is unnecessary, such as when the matter has already been investigated. The OIC had previously investigated and issued a final report on an identical complaint regarding the same institution and type of records. The complainant was given an opportunity to provide representations on why the investigation should continue but did not respond. As no new evidence was presented to differentiate this complaint from the prior one, the OIC concluded that continuing the investigation was unnecessary.

• Whether the investigation was unnecessary under paragraph 30(4)(b) of the Access to Information Act because the matter had already been the subject of an investigation or final report

An individual complained that a real estate management company collected his personal information without consent through surveillance cameras. He alleged inadequate signage and over-collection when a camera was focused on him after a dispute about his service dog. The company responded by posting new, clearer signage about video surveillance at all entrances, including the one previously lacking. They also addressed the over-collection concern by explaining that a new security guard had mistakenly focused the camera, and provided additional training to staff regarding service animals. The OPC found the company's response to be fair and reasonable, addressing the complainant's concerns proactively. Consequently, the investigation was discontinued.

• Whether the organization collected personal information without adequate signage for video surveillance
• Whether the organization over-collected personal information by focusing a camera on the complainant
• Whether the organization's response to the concerns was fair and reasonable under paragraph 12.2(1)(c) of PIPEDA

An individual filed a complaint against a retailer, alleging a failure to provide access to personal information under PIPEDA. This complaint arose after the complainant and the retailer had settled a small claims court dispute. As part of that settlement, the complainant had signed a mutual release, receiving financial compensation in exchange for releasing the retailer from all claims and complaints, including those arising under statute, related to events prior to the release date. The OPC found that the complaint was made in bad faith, given the existence of this mutual release. Consequently, the investigation was discontinued under paragraph 12.2(1)(b) of PIPEDA.

• Whether the complaint was made in bad faith under paragraph 12.2(1)(b) of PIPEDA
• Whether a mutual release agreement impacts the validity of a subsequent privacy complaint

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

The complainant alleged that a federal institution failed to respond to an access request within the statutory 30-day period or an extended period, resulting in a deemed refusal under subsection 10(3) of the Access to Information Act. The complainant submitted their complaint on January 21, 2025, arguing that the deemed refusal was 'ongoing' and therefore the 60-day time limit for complaints under section 31 should not apply from the initial awareness date. The OIC requested clarification on when the complainant first became aware of the institution's failure to respond, but the complainant maintained their 'ongoing refusal' position. The OIC determined that the complaint was inadmissible because it was not submitted within the mandatory 60-day time limit from when the complainant first became aware of the grounds for complaint. The Commissioner rejected the argument that an 'ongoing' deemed refusal continuously restarts the complaint period, citing Federal Court precedent and emphasizing that the Act does not grant the Commissioner power to extend this time limit.

• Whether the complaint was submitted within the 60-day time limit prescribed by section 31 of the Access to Information Act
• Whether an 'ongoing' deemed refusal under subsection 10(3) of the Act continuously restarts the 60-day complaint period under section 31
• Whether the Information Commissioner has the power to extend the 60-day time limit for submitting complaints

The Information Commissioner ceased investigation into seventeen complaints, finding them vexatious. The complaints alleged unreasonable time extensions taken by an institution. However, the Commissioner found that these seventeen requests sought the same information as a previous request from the same complainant, which had already been the subject of an OIC investigation where the time extension was deemed reasonable. The complainant had not pursued a Federal Court review of the previous finding. Evidence showed the institution was providing regular interim responses as committed, contrary to the complainant's assertion. The Commissioner concluded that the new complaints were an attempt to circumvent the OIC's previous findings and avoid the proper recourse mechanism of Federal Court review. Therefore, the Commissioner ceased investigation under paragraphs 30(4)(a) and (b) of the Access to Information Act.

• Whether the complaints were vexatious under s.30(4)(a) ATIA
• Whether further investigation was unnecessary under s.30(4)(b) ATIA
• Whether the new requests were substantively duplicative of a previously investigated complaint
• Whether the complainant was attempting to circumvent previous OIC findings

The complainant submitted an access to information request to a federal institution and received a response in October 2021. The institution's response included a notice informing the complainant of their right to complain to the Information Commissioner within sixty days. The complainant filed a complaint with the Office of the Information Commissioner (OIC) in January 2022, which was more than sixty days after receiving the institution's response. The OIC determined that the complaint was submitted outside the mandatory 60-day timeframe specified in section 31 of the Access to Information Act. Citing legal precedents, the Commissioner concluded that the OIC does not have the authority to extend statutory timeframes. Consequently, the complaint was rejected.

• Whether the complaint was filed within the 60-day statutory timeframe as per s.31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint