Federal (Canada) privacy & access decisions

Three complaints alleged that Correctional Service Canada (CSC) improperly used video footage, collected for security, to monitor employee performance. The complainants provided emails from a correctional manager commenting on their patrols as evidence. CSC acknowledged using video for security and incident investigation but denied using it for performance monitoring. The OPC found that CSC reviewed the footage to identify systemic deficiencies in patrols following an inmate's death, aiming to improve security and prevent future deaths. The review was part of an action plan to address deficiencies identified in the death investigation. The OPC concluded that this use was consistent with the original purpose of collection, which was security, and therefore the complaints were not well-founded.

• Whether video footage of employees constitutes personal information under s.3 of the Privacy Act
• Whether CSC's use of video footage to review employee patrols constituted monitoring employee performance
• Whether CSC's use of video footage was for the purpose for which it was obtained or compiled, or for a use consistent with that purpose, as per s.7(a) of the Privacy Act

The complaint alleged that the Department of National Defence (DND) improperly disclosed deceased Canadian Forces (CF) members’ medical records to Military Police (MP) investigators for "sudden death suicide investigations" under paragraph 8(2)(e) of the Privacy Act, without due consideration for necessity. Complainants argued that CF-NIS investigations should be limited to determining if wounds were self-inflicted, not broader medical history. DND contended that its Directorate of Access to Information and Privacy (DAIP) was not required to "look behind" facially valid requests, and that the lawfulness of an investigation was the responsibility of the investigative body. The Office of the Privacy Commissioner (OPC) found the allegation that DND failed to properly assess the necessity of the information sought under s. 8(2)(e) to be not well-founded, concluding that DAIP generally exercised sufficient scrutiny. However, the OPC also found that DND failed to meet its obligations under subsection 8(4) of the Privacy Act and section 7 of the Privacy Regulations by not retaining copies of 8(2)(e) request forms in several cases and lacking comprehensive records of disclosures. This constituted a well-founded finding regarding DND's recordkeeping practices. The OPC recommended DND update its policies to ensure retention of all request forms, confirmation of statutory authority for investigations, and maintenance of comprehensive disclosure records. DND committed to implementing these recommendations within six months.

• Whether DND's Directorate of Access to Information and Privacy (DAIP) improperly granted full access to deceased Canadian Forces (CF) members’ medical records under paragraph 8(2)(e) of the Privacy Act.
• Whether the DAIP gave due consideration to the necessity of the requested records for the investigation.
• Whether CF-NIS requests for medical records were permissible under paragraph 8(2)(e) given their internal policies limiting the scope of suicide investigations.
• Whether DND's recordkeeping practices for 8(2)(e) requests and disclosures were consistent with subsection 8(4) of the Privacy Act and section 7 of the Privacy Regulations.
• Whether the DAIP should verify the statutory authority under which an investigative body's lawful investigation is being conducted, in line with the TBS Directive.

Four complaints were filed against Transport Canada (TC) regarding its Interim Order requiring owners of unmanned aircraft (drones) to display their name, address, and telephone number on the device. Complainants argued this contravened the disclosure provisions of the Privacy Act by forcing public exposure of personal information without consent, and raised concerns about harassment or identity theft. TC stated the Interim Order was an interim measure to address significant safety risks posed by recreational drone users, citing a 200% increase in incidents since 2014. The OPC determined that while the information is personal, the requirement does not constitute a 'collection' of personal information by TC under sections 4 and 5 of the Privacy Act, and thus the disclosure provisions of section 8 do not apply. The OPC found no violation of the Act but noted TC's commitment to rework identification requirements in future regulations to address privacy concerns.

• Whether the requirement to display personal information on unmanned aircraft constitutes a collection of personal information by Transport Canada under sections 4 and 5 of the Privacy Act
• Whether the disclosure provisions of section 8 of the Privacy Act apply to the personal information displayed on unmanned aircraft as per the Interim Order
• Whether the Interim Order contravenes the Privacy Act by obligating individuals to expose personal information to the public without consent

An anonymous complainant alleged that Statistics Canada (StatCan) improperly disclosed confidential census information to Shared Services Canada (SSC) when it transferred its informatics infrastructure, contravening the Statistics Act and risking unauthorized disclosure. The complainant raised concerns about StatCan's supervision over SSC employees, the storage of data in shared data centers, and the potential for disclosure during decryption. StatCan argued that SSC took over infrastructure, not data, and that SSC employees with access were 'deemed employees' under the Statistics Act, sworn to confidentiality, and subject to high security clearances. The Office of the Privacy Commissioner (OPC) found that StatCan was legally required to use SSC's services and, under section 16 of the Shared Services Canada Act, StatCan retained control and accountability for the data. The OPC concluded that StatCan took reasonable measures, including comprehensive agreements and security assessments, to define its relationship with SSC and protect the census data. Therefore, the complaint was deemed not well-founded.

• Whether Statistics Canada improperly disclosed confidential census information to Shared Services Canada by transferring its informatics infrastructure.
• Whether the sharing of census information with SSC contravenes the Statistics Act.
• Whether Statistics Canada maintains sufficient supervision over SSC employees accessing census data.
• Whether the storage of census data in SSC data centers shared with other federal institutions creates a risk of unauthorized disclosure.
• Whether there is a risk of disclosure of confidential census data when it is decrypted for processing.
• Whether Statistics Canada has taken sufficient steps to oversee SSC’s handling of census data on its behalf, consistent with its obligations under the Privacy Act.
• Whether the transfer of personal information by StatCan to SSC for IT infrastructure services is authorized by the SSCA and consistent with the Privacy Act.
• Whether StatCan has implemented appropriate privacy protection clauses and safeguards in its agreements with SSC.
• Whether SSC employees with access to confidential census data have been properly sworn in as "deemed employees" under the Statistics Act.

A complainant raised concerns that the Canada Revenue Agency (CRA) outsourced the storage of Canadian taxpayer information to Mobilshred Inc., which the complainant believed was a division of a US-based company, Recall. The complainant was concerned that this could make the personal information vulnerable to disclosure under the USA PATRIOT Act. The OPC investigated whether the CRA had properly safeguarded personal information from unauthorized disclosure. The CRA clarified that Mobilshred Inc. is a Canadian company, and the contract explicitly requires all physical records to remain in Canada. The OPC found that the CRA took appropriate steps to mitigate risks by ensuring all information remained in Canada and that Mobilshred Inc. is a Canadian entity. The complaint was found to be not well-founded.

• Whether the CRA properly safeguarded personal information entrusted to Mobilshred Inc. from unauthorized disclosure under the Privacy Act
• Whether Canadian taxpayer information was vulnerable to disclosure to US authorities under the USA PATRIOT Act due to the contract with Mobilshred Inc.
• Whether Mobilshred Inc. is a Canadian entity or affiliated with a US-based company

A complaint was filed against Canada Post Corporation (CPC) regarding its collection, use, and disclosure of electronic signatures for parcel tracking. The complainant raised concerns about the clarity of information provided to addressees regarding their option to opt-out of having their signature displayed online, and the absence of labels on signature devices at a specific postal outlet. The investigation also examined the privacy and security controls of CPC's online tracking website. CPC argued that disclosure of signatures to senders was authorized under the Privacy Act and that it provided an opt-out option. The OPC found that the collection and disclosure of signatures for parcel tracking were consistent with the Act, but raised concerns about the adequacy of security controls for online signatures. CPC committed to implementing enhanced security measures.

• Whether the collection of electronic signatures by CPC contravenes the Privacy Act
• Whether the disclosure of electronic signatures to the sender of a parcel contravenes the Privacy Act
• Whether the disclosure of electronic signatures online contravenes the Privacy Act
• Whether CPC adequately safeguards digitized signatures displayed online
• Whether the information provided to addressees about opting out of online signature display is sufficiently clear

This report addresses complaints against the Canadian Broadcasting Corporation (CBC) regarding its publication of personal information inadvertently disclosed by the Canada Revenue Agency (CRA). The CRA mistakenly mailed a spreadsheet containing taxpayers' personal information to a CBC journalist. The CBC subsequently published an article detailing the breach, identifying several affected individuals, and including their photographs. Complainants alleged the CBC contravened the Privacy Act by disclosing this information. The CBC argued that the information was obtained legally and that the Privacy Act does not apply to information collected, used, or disclosed for journalistic purposes under section 69.1 of the Act. The OPC found that the CBC's actions were purely journalistic and therefore fell under this exclusion, meaning the Privacy Act did not apply to the CBC's handling of the information.

• Whether the information published by the CBC constituted personal information under section 3 of the Privacy Act
• Whether the CBC's collection, use, and disclosure of the personal information was for journalistic purposes
• Whether the exclusion provision under section 69.1 of the Privacy Act applied to the CBC's actions

A complaint was filed on behalf of RCMP members regarding the disclosure of informal disciplinary records to the Crown, arguing it was inconsistent with the Supreme Court's R. v. McNeil decision. The complainant contended that only records from formal disciplinary hearings should be disclosed. The RCMP maintained that both formal and informal misconduct records could be relevant under McNeil, and the OPC agreed with this interpretation, finding the complaint not well-founded. However, the OPC expressed serious concerns about the RCMP's policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services. The OPC recommended the RCMP reconsider its retention policies, but the RCMP indicated it would continue its current practice.

• Whether the disclosure of informal disciplinary records to the Crown is consistent with R. v. McNeil
• Whether the RCMP's retention period for disciplinary records is appropriate

A group of Canada Border Services Agency (CBSA) employees complained that a new policy requiring them to wear name tags displaying their surnames, instead of badge numbers, violated sections 7 and 8 of the Privacy Act. They argued this constituted an unreasonable invasion of privacy and made them vulnerable to violence and intimidation, as their names could be used to find personal information. The CBSA contended that the name tags were part of a service excellence initiative, promoted professionalism and accountability, and that an employee's name on a name tag falls under an exception to the definition of personal information in the Act. The OPC found that while a surname on a name tag is information about an identifiable individual, it falls under paragraph (j) of the definition of personal information, which excludes information relating to the position or functions of a government employee for the purposes of sections 7 and 8. Therefore, the OPC concluded that the policy did not violate the Act.

• Whether the surname of a Border Services Officer (BSO) displayed on a name tag constitutes "personal information" under section 3 of the Privacy Act
• Whether the surname on a name tag falls within the exception to the definition of personal information under paragraph (j) of section 3 of the Privacy Act
• Whether the CBSA's requirement for BSOs to wear name tags displaying their surnames violates sections 7 and 8 of the Privacy Act

A woman complained to the OPC that Aboriginal Affairs and Northern Development Canada (AANDC) was putting her at risk of identity theft by publishing her full name and date of birth in the Canada Gazette, which is available online. This information was published as part of the enrollment process for the Qalipu Mi’kmaq First Nation Band. The OPC investigated whether this disclosure was consistent with the Privacy Act. The OPC determined that the disclosure was for the purpose for which the information was originally collected, which was for the identification and recognition of Band members. Therefore, the disclosure was permissible under the Privacy Act without the individual's consent. The complaint was found to be not well-founded, but the OPC recommended AANDC explore future options to mitigate identity theft risks.

• Whether the disclosure of full name and date of birth in the Canada Gazette was consistent with the Privacy Act
• Whether personal information can be disclosed without consent when it is for the purpose for which it was originally collected

A man complained that Canada Post checked his credit rating when he requested an online change of address. The OPC investigated whether Canada Post's practice of using Equifax for identity verification in online change-of-address requests violated the Privacy Act. The OPC found that Canada Post has a legitimate need to confirm identity to prevent identity theft and that it does not conduct a credit verification. However, the OPC was concerned that individuals were not adequately informed about the sharing of their personal information with Equifax. Canada Post implemented the OPC's recommendations to improve transparency.

• Whether Canada Post's use of Equifax for identity verification constituted a credit check
• Whether Canada Post had the statutory authority to collect personal information for identity verification
• Whether individuals were adequately informed about the sharing of their personal information with Equifax

A complaint was filed on behalf of a refugee, alleging that personal information about him was disclosed to a National Post reporter. The refugee was a passenger on the 'Ocean Lady' and was later identified in a news story as a fugitive sought by INTERPOL. The complainant named four federal institutions as potentially responsible for the disclosure: the Canada Border Services Agency, the Canadian Security Intelligence Service, Citizenship and Immigration Canada, and the Royal Canadian Mounted Police. The OPC's investigation confirmed the individual was a wanted fugitive with publicly available INTERPOL information. Due to journalistic confidentiality, the OPC could not determine how the reporter obtained the information. In the absence of evidence, the OPC found no support for the allegation that any of the named institutions disclosed the information.

• Whether any of the named federal institutions disclosed personal information about a refugee to a newspaper reporter
• Whether the publicly available INTERPOL notice constituted a disclosure by the institutions

An individual complained that Canada Post required his driver's licence number to terminate his postal box rental. Canada Post stated it requires personal identification to prevent fraudulent use or closure of postal boxes and has used recorded ID to investigate illegal shipments. The OPC's investigation found that Canada Post has a statutory obligation to provide a secure postal service. The collection and use of personal information, including driver's licence numbers, was deemed consistent with this mandate. The OPC concluded that the collection of identification numbers was reasonable. The complaint was dismissed as not well-founded.

• Whether requiring a driver's licence number to terminate a postal box rental is a reasonable collection of personal information under PIPEDA
• Whether Canada Post's collection and use of personal information for security purposes is consistent with its statutory obligations

An individual complained that the Public Service Commission of Canada (PSC) improperly collected and disclosed personal information about his medical release from the Canadian Forces. This information was collected for a program that grants priority consideration to former military personnel for federal public service positions. The OPC's investigation found that the complainant had provided written consent for the collection and disclosure of his medical release record for this specific hiring program. All aspects of the process were determined to be in full conformity with the Privacy Act. Consequently, the complaint was dismissed.

• Whether the Public Service Commission of Canada improperly collected personal information about the complainant's medical release from the Canadian Forces
• Whether the Public Service Commission of Canada improperly disclosed personal information about the complainant's medical release from the Canadian Forces
• Whether the collection and disclosure of personal information conformed with the Privacy Act

The Minister of Agriculture and Agri-Food Canada filed a privacy complaint against the Canadian Wheat Board (CWB) following media reports about an internal audit. The audit raised concerns about potential improper disclosure of farmers' personal information, including Social Insurance Numbers (SINs), to third parties like grain handlers and the Canada Revenue Agency. The OPC's investigation found that the CWB had appropriate protocols, procedures, and agreements in place to manage personal information. Specifically, the CWB did not disclose SINs to third parties and only shared personal data with the tax agency when legally required. Consequently, the complaint was dismissed as not well-founded.

• Whether the Canadian Wheat Board improperly disclosed farmers' Social Insurance Numbers (SINs) to third parties
• Whether the Canadian Wheat Board improperly disclosed other personal information of farmers to third parties