Federal (Canada) privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act, concerning investigation reports into the deaths of two individuals. The RCMP demonstrated that the records met the requirements for exemption under s.16(1)(a), as they were created less than 20 years prior, obtained by an investigative body during a lawful investigation into crime detection/suppression and law enforcement. The Commissioner found that the RCMP reasonably exercised its discretion not to disclose the information, having considered relevant factors including investigative integrity and privacy. While acknowledging the RCMP's correct application of the Act, the Commissioner noted a gap in the legislation regarding the disclosure of deceased individuals' personal information for compassionate reasons. The complaint was ultimately found not well founded.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the information concerned an investigation related to the detection, prevention or suppression of crime or the enforcement of any law of Canada or a province
• Whether the records were created less than 20 years before the access request was made
• Whether the institution reasonably exercised its discretion to decide whether to disclose the information

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request for emails, text messages, and briefing notes related to companies working on the ArriveCAN application. The complainant specifically questioned the absence of text messages in the records provided. The Office of the Information Commissioner (OIC) investigated CBSA's search efforts, including the program areas involved, search parameters, and policies regarding text message management. CBSA explained that text messages are often considered transitory, especially if followed by an email, and that employees are responsible for saving non-transitory messages to a corporate repository. The OIC found that the Offices of Primary Interest conducted searches in appropriate repositories and that it was reasonable to believe that relevant text messages either did not exist or were not considered relevant at the time of the request, in line with CBSA and Treasury Board Secretariat policies. Consequently, the Information Commissioner concluded that CBSA conducted a reasonable search.

• Whether the Canada Border Services Agency conducted a reasonable search for records
• Whether text messages related to the ArriveCAN application existed and should have been provided
• Whether CBSA's information management policies regarding text messages were appropriately applied

The complainant alleged that Health Canada's 1,000-day extension of time to respond to an access request was unreasonable. The request sought information regarding an application for religious exemption to serve ayahuasca. Health Canada claimed the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, citing a large volume of records (over 14,000 pages) and the need for extensive consultations, particularly with its Legal Services Unit, due to the sensitive and precedent-setting nature of the subject matter. The institution argued that processing the request within a shorter timeframe would unreasonably interfere with its operations and that consultations could not be completed within 30 days. The Information Commissioner found that Health Canada met all the requirements for both paragraphs 9(1)(a) and 9(1)(b), concluding that the calculation of the extension was logical and supportable, and that the extension was reasonable. Consequently, the complaint was deemed not well founded, and the due date for the response remains December 19, 2025.

• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under s.9(1)(a)
• Whether the extension of time was for a reasonable period under s.9(1)(a)
• Whether consultations were necessary under s.9(1)(b)
• Whether consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to named companies and expenses. The Office of the Information Commissioner (OIC) investigated by reviewing CBSA's search efforts, including the program areas tasked and the search parameters. The OIC found that the Office of Primary Interest (OPI) most likely to hold relevant records, the Information, Science and Technology Branch, had searched appropriate repositories and provided 896 pages of documents for processing. Based on this, the Commissioner concluded that CBSA conducted a reasonable search. The complaint was therefore deemed not well founded.

• Whether the institution conducted a reasonable search for records

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for records related to social distancing guidance. PHAC claimed a 1,380-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, setting the response due date to February 11, 2027. The OIC investigated whether PHAC met the requirements for such an extension. PHAC demonstrated that its calculation was logical and supportable, and that processing the request in a shorter timeframe would unreasonably interfere with its operations. The OIC concluded that PHAC had met all the requirements of the Act for the extension. Consequently, the complaint was found to be not well founded, and the extension was deemed reasonable.

• Whether the 1,380-day extension of time claimed by PHAC under s.9(1)(a) and s.9(1)(b) was reasonable
• Whether PHAC's calculation of the time extension was sufficiently logical and supportable
• Whether providing access within a materially lesser period would unreasonably interfere with PHAC's operations
• Whether consultations could reasonably be completed within 30 days