Federal (Canada) privacy & access decisions

The complaint alleged that the Department of National Defence (DND) improperly disclosed deceased Canadian Forces (CF) members’ medical records to Military Police (MP) investigators for "sudden death suicide investigations" under paragraph 8(2)(e) of the Privacy Act, without due consideration for necessity. Complainants argued that CF-NIS investigations should be limited to determining if wounds were self-inflicted, not broader medical history. DND contended that its Directorate of Access to Information and Privacy (DAIP) was not required to "look behind" facially valid requests, and that the lawfulness of an investigation was the responsibility of the investigative body. The Office of the Privacy Commissioner (OPC) found the allegation that DND failed to properly assess the necessity of the information sought under s. 8(2)(e) to be not well-founded, concluding that DAIP generally exercised sufficient scrutiny. However, the OPC also found that DND failed to meet its obligations under subsection 8(4) of the Privacy Act and section 7 of the Privacy Regulations by not retaining copies of 8(2)(e) request forms in several cases and lacking comprehensive records of disclosures. This constituted a well-founded finding regarding DND's recordkeeping practices. The OPC recommended DND update its policies to ensure retention of all request forms, confirmation of statutory authority for investigations, and maintenance of comprehensive disclosure records. DND committed to implementing these recommendations within six months.

• Whether DND's Directorate of Access to Information and Privacy (DAIP) improperly granted full access to deceased Canadian Forces (CF) members’ medical records under paragraph 8(2)(e) of the Privacy Act.
• Whether the DAIP gave due consideration to the necessity of the requested records for the investigation.
• Whether CF-NIS requests for medical records were permissible under paragraph 8(2)(e) given their internal policies limiting the scope of suicide investigations.
• Whether DND's recordkeeping practices for 8(2)(e) requests and disclosures were consistent with subsection 8(4) of the Privacy Act and section 7 of the Privacy Regulations.
• Whether the DAIP should verify the statutory authority under which an investigative body's lawful investigation is being conducted, in line with the TBS Directive.

Four complaints were filed against Transport Canada (TC) regarding its Interim Order requiring owners of unmanned aircraft (drones) to display their name, address, and telephone number on the device. Complainants argued this contravened the disclosure provisions of the Privacy Act by forcing public exposure of personal information without consent, and raised concerns about harassment or identity theft. TC stated the Interim Order was an interim measure to address significant safety risks posed by recreational drone users, citing a 200% increase in incidents since 2014. The OPC determined that while the information is personal, the requirement does not constitute a 'collection' of personal information by TC under sections 4 and 5 of the Privacy Act, and thus the disclosure provisions of section 8 do not apply. The OPC found no violation of the Act but noted TC's commitment to rework identification requirements in future regulations to address privacy concerns.

• Whether the requirement to display personal information on unmanned aircraft constitutes a collection of personal information by Transport Canada under sections 4 and 5 of the Privacy Act
• Whether the disclosure provisions of section 8 of the Privacy Act apply to the personal information displayed on unmanned aircraft as per the Interim Order
• Whether the Interim Order contravenes the Privacy Act by obligating individuals to expose personal information to the public without consent

An anonymous complainant alleged that Statistics Canada (StatCan) improperly disclosed confidential census information to Shared Services Canada (SSC) when it transferred its informatics infrastructure, contravening the Statistics Act and risking unauthorized disclosure. The complainant raised concerns about StatCan's supervision over SSC employees, the storage of data in shared data centers, and the potential for disclosure during decryption. StatCan argued that SSC took over infrastructure, not data, and that SSC employees with access were 'deemed employees' under the Statistics Act, sworn to confidentiality, and subject to high security clearances. The Office of the Privacy Commissioner (OPC) found that StatCan was legally required to use SSC's services and, under section 16 of the Shared Services Canada Act, StatCan retained control and accountability for the data. The OPC concluded that StatCan took reasonable measures, including comprehensive agreements and security assessments, to define its relationship with SSC and protect the census data. Therefore, the complaint was deemed not well-founded.

• Whether Statistics Canada improperly disclosed confidential census information to Shared Services Canada by transferring its informatics infrastructure.
• Whether the sharing of census information with SSC contravenes the Statistics Act.
• Whether Statistics Canada maintains sufficient supervision over SSC employees accessing census data.
• Whether the storage of census data in SSC data centers shared with other federal institutions creates a risk of unauthorized disclosure.
• Whether there is a risk of disclosure of confidential census data when it is decrypted for processing.
• Whether Statistics Canada has taken sufficient steps to oversee SSC’s handling of census data on its behalf, consistent with its obligations under the Privacy Act.
• Whether the transfer of personal information by StatCan to SSC for IT infrastructure services is authorized by the SSCA and consistent with the Privacy Act.
• Whether StatCan has implemented appropriate privacy protection clauses and safeguards in its agreements with SSC.
• Whether SSC employees with access to confidential census data have been properly sworn in as "deemed employees" under the Statistics Act.