Federal (Canada) privacy & access decisions

A public servant complained that Public Works and Government Services Canada (PWGSC) refused to provide her with personal information collected during an investigation under the Public Servants Disclosure Protection Act, which had exonerated her. The OPC found that PWGSC correctly applied section 22.3 of the Privacy Act, which mandates refusal to disclose information created for whistleblower disclosures or related investigations. Therefore, the complaint was not well-founded regarding access to information. However, the OPC was concerned that individuals cleared of wrongdoing were not informed of their vindication. The OPC urged PWGSC to inform subjects when allegations are unsubstantiated, and PWGSC subsequently did so for the complainant. The Commissioner also asked the Treasury Board Secretariat to develop guidelines for all departments to inform individuals when allegations of wrongdoing are unsubstantiated, citing procedural fairness and natural justice.

• Whether the complainant had a right to access personal information collected during a whistleblower investigation
• Whether section 22.3 of the Privacy Act was correctly applied to refuse disclosure
• Whether individuals cleared of wrongdoing in whistleblower investigations should be informed of their vindication

An individual complained that the Canada Border Services Agency (CBSA) improperly collected information from his personal online blog after his term position ended. The complainant alleged that his tracking device showed visits from government computers. The OPC investigated whether the CBSA had inappropriately collected personal information. The investigation found that several CBSA employees had viewed the blog, but did so in a personal capacity, which was deemed to accord with the government's Acceptable Use Policy. The OPC found no evidence that the agency had collected personal information in connection with these visits. Therefore, the complaints were determined to be not well-founded.

• Whether the Canada Border Services Agency improperly collected personal information from the complainant's blog
• Whether employees viewing a public blog from government workstations constitutes collection of personal information by the agency

The Commissioner initiated a complaint against the RCMP regarding its handling of personal information collected by the Canadian Firearms Program and used by EKOS Research Associates Inc. to survey firearms licensees. The RCMP provided contact information to EKOS, which then collected demographic data and information on guns owned by respondents. The investigation found that EKOS did not provide identifying data in its report to the firearms program and met all contractual requirements for secure data handling. The Assistant Commissioner determined that the collection and use of information for a client-satisfaction survey was consistent with the purpose for which it was initially collected under the Privacy Act. The RCMP was also found compliant in providing information to EKOS, as the contract included appropriate confidentiality and security provisions. The complaint was therefore deemed not well-founded, though the OPC recommended the RCMP clarify its public information on data uses and conduct Privacy Impact Assessments.

• Whether the collection of personal information by the Canadian Firearms Program for a client-satisfaction survey was consistent with the purpose for which it was initially collected under the Privacy Act
• Whether the disclosure of personal information by the RCMP to EKOS Research Associates Inc. for the survey was compliant with the Privacy Act

The OPC investigated a complaint against the RCMP regarding the use and disclosure of personal information from the Canadian Firearms Program (CFP) to EKOS Research Associates Inc. for a survey of firearms licensees. The investigation examined whether the RCMP improperly used or disclosed personal information in contravention of sections 7 and 8 of the Privacy Act. The OPC found that the use of information for a client-satisfaction survey to improve CFP services was consistent with the original collection purpose, thus not contravening section 7. Furthermore, the disclosure to EKOS, acting as an agent under a contract with confidentiality and security provisions, did not contravene section 8. The complaint was therefore deemed not well-founded. The OPC noted that the CFP committed to updating its InfoSource entry and website to better inform the public about information use for surveys and acknowledged that a Privacy Impact Assessment would have been beneficial.

• Whether the use of personal information for a client-satisfaction survey was consistent with the purpose for which it was obtained or compiled under s.7(a) of the Privacy Act
• Whether the disclosure of personal information to EKOS Research Associates Inc. for the survey contravened s.8 of the Privacy Act
• Whether the personal information collected by the RCMP related directly to an operating program or activity of the institution under s.4 of the Privacy Act

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by allegedly accessing her wireless Internet connection to post messages on a white supremacist website during an investigation. An Internet Service Provider, responding to a subpoena, linked an IP address associated with the alleged CHRC activity to the complainant. The OPC's investigation found no evidence that the CHRC collected, used, or disclosed any personal information about the complainant or was even aware of her prior to the tribunal hearing. Technological experts suggested the IP address association was a third-party mismatch. The complaint was found to be not well-founded.

• Whether the Canadian Human Rights Commission improperly collected and used the complainant's personal information
• Whether the CHRC accessed the complainant's wireless Internet connection
• Whether an IP address can be considered personal information

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless internet connection to post messages on a white supremacist website. The OPC investigated whether the CHRC contravened sections 4 to 8 of the Privacy Act. The investigation first determined that the complainant's IP address, when linked to her identity via a subpoena, constituted personal information under section 3 of the Act. However, the OPC found no evidence that the CHRC ever collected or had knowledge of the complainant's personal information prior to the allegations. Technological experts suggested the association of the complainant's IP address with the CHRC was likely a third-party mismatch. Consequently, the Assistant Privacy Commissioner concluded there was no contravention of the Privacy Act.

• Whether the complainant's IP address constituted personal information under section 3 of the Privacy Act
• Whether the CHRC collected the complainant's personal information
• Whether the CHRC improperly used, disclosed, or retained the complainant's personal information in contravention of sections 4 to 8 of the Privacy Act