Federal (Canada) Privacy Decisions

The complainant alleged that Health Canada improperly withheld records related to a COVID-19 vaccine safety update report, citing exemptions for confidential government information, personal information, and third-party commercial information. The Information Commissioner found that while some information was properly withheld under exemptions for confidential government information (section 13(1)) and personal information (section 19(1)), Health Canada failed to properly exercise its discretion regarding publicly available information under section 13(1). The Commissioner also found that exemptions for third-party commercial or financial information (section 20(1)(b) and (c)) were not met. The Commissioner ordered Health Canada to disclose the information withheld under third-party exemptions and reconsider the disclosure of publicly available information under section 13(1).

• Proper application of section 13(1) (confidential information from government bodies)
• Proper application of section 19(1) (personal information)
• Proper application of section 20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Proper application of section 20(1)(c) (financial impact on a third party)

The OPC investigated a complaint alleging that Immigration, Refugees and Citizenship Canada (IRCC) improperly withheld access to personal information. The complainant requested the "History Section" of their case file, but IRCC only provided a subset of information from other sections, referred to as the "Short Form" report. The OPC found that IRCC's practice of systematically retrieving and processing only the Short Form report contravenes section 12 of the Privacy Act, as it fails to provide individuals with access to all personal information under the government's control. Although the specific file was eventually provided, IRCC refused to update its procedures to address the systemic issue.

• Whether IRCC's practice of only retrieving and processing a "Short Form" subset of records in response to access requests complies with the Privacy Act's access obligations.
• Whether the "History Section" of the Global Case Management System (GCMS) file contains personal information.
• Whether IRCC's assertion that information outside the "Short Form" would always be withheld under exemptions is valid.
• Whether IRCC's failure to commit to updating its procedures constitutes a continuing contravention of the Privacy Act.

An employee of the Canada Border Services Agency (CBSA) complained that their personal information was inadvertently disclosed to colleagues due to improperly set folder permissions in the CBSA's information management system, Apollo. The CBSA confirmed the contravention of section 8 of the Privacy Act. While the CBSA took steps to correct the issue and improve practices, it did not commit to mandatory, trackable training for managing permissions, leading the OPC to find the complaint well-founded but unresolved.

• Whether CBSA contravened section 8 of the Privacy Act by improperly disclosing employee personal information.
• Adequacy of CBSA's response and corrective measures.
• Whether CBSA's training and awareness initiatives for managing information system permissions are sufficient.
• Whether the matter is resolved given CBSA's non-commitment to mandatory, trackable training.

The complainant alleged that Transport Canada failed to respond to an access to information request within the legislated 30-day timeframe. The request, for correspondence regarding the Greater Toronto Airports Authority, was significantly delayed due to the slow retrieval of records by a key office within Transport Canada, further exacerbated by a building fire. The Information Commissioner found the complaint to be well-founded, ordering Transport Canada to provide a complete response within 120 business days.

• Timeliness of response to access request
• Institution's duty to assist requesters
• Impact of building fire on record retrieval
• Processing of electronic vs. paper records

The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search for records related to a previous access request and a "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate a reasonable search was conducted. The Information Commissioner ordered PCO to conduct a new search and provide a supplementary response to the complainant.

• Reasonableness of the search conducted by the institution
• Sufficiency of documentation provided by the institution regarding its search efforts
• Burden of proof on institutions to demonstrate a reasonable search

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) unreasonably extended the time to respond to an access request for Microsoft Teams messages and related policies. The investigation found that ISED's justification for a 390-day extension was inadequate, as it failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to assess this length. The OIC also noted significant delays in processing. The Commissioner ordered ISED to provide a complete response within 60 business days.

• Reasonableness of time extension under subsection 9(1)
• Justification for length of extension for record volume and operational interference
• Justification for length of extension for consultations
• Deemed refusal under subsection 10(3) due to invalid time extension

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld records related to the Canada Student Service Grant. The complainant also alleged that ESDC did not conduct a reasonable search. The Information Commissioner found that ESDC improperly withheld information under exemptions related to third-party commercial information, advice and deliberations, and solicitor-client privilege. The Commissioner also found that ESDC did not reasonably exercise its discretion for some of these exemptions. The Commissioner ordered ESDC to disclose certain information and re-exercise its discretion on others. The complaint was found to be well founded.

• Improperly withheld third-party commercial information
• Improperly withheld advice or recommendations and accounts of deliberations
• Improperly withheld information under solicitor-client privilege
• Failure to reasonably exercise discretion

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information regarding leases valued over $500,000 annually. The complainant sought records for leases signed between 2018-2022 in specific cities. PSPC invoked exemptions under paragraphs 18(b) and 20(1)(b) of the Access to Information Act, claiming harm to its competitive position and the confidentiality of third-party financial information. The Information Commissioner found that neither PSPC nor the third parties established the requirements for these exemptions, noting that rent amounts were negotiated terms and the claims of harm were speculative. The Commissioner ordered PSPC to disclose the records in full.

• Whether the annual rent figures for leases were properly withheld under paragraph 18(b) (competitive position of government institutions).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(b) (confidential third-party financial or commercial information).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(c) (material financial impact on a third party).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(d) (interference with third-party negotiations).

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records concerning a specific video posted on Facebook. During the investigation, it was found that ISC had initially excluded records interpreted as drafts, leading to the retrieval of 1,087 additional pages. The Information Commissioner found the original search unreasonable but concluded that ISC had since conducted a reasonable search. The Commissioner ordered ISC to process and respond to the additional records within 36 business days.

• Reasonableness of the search conducted by the institution
• Interpretation and application of exclusion criteria for records

The complainant alleged that the Privy Council Office (PCO) improperly withheld information related to a meeting, citing exemptions under subsection 16(2) (facilitating the commission of an offence) and subsection 19(1) (personal information) of the Access to Information Act. The OIC found that PCO failed to demonstrate that a signature and two initials, withheld under subsection 19(1), met the requirements of the exemption, particularly considering they related to official duties and transparency. Although PCO initially applied subsection 16(2) to a phone number, the OIC concluded this exemption was met. However, the OIC ordered PCO to disclose the information withheld under subsection 19(1).

• Application of subsection 16(2) to a phone number
• Application of subsection 19(1) to signatures and initials
• Whether signatures/initials used for official duties are excluded from the definition of personal information under paragraph 3(j) of the Privacy Act
• Reasonableness of the institution's exercise of discretion to withhold information

The complainant alleged that Transport Canada improperly withheld information related to a workplace fatality under several exemptions, including personal information and third-party commercial/technical information. The complainant also alleged that Transport Canada had not conducted a reasonable search. The OIC found that while the initial search was not reasonable, it was resolved during the investigation. The Commissioner ordered Transport Canada to disclose certain information that did not meet the criteria for third-party exemptions, and re-exercise discretion on other withheld information.

• Proper application of the personal information exemption (s.19(1) ATIA).
• Proper application of third-party information exemptions (s.20(1)(b) and (c) ATIA).
• Proper application of investigation conduct exemption (s.16(1)(c) ATIA).
• Reasonableness of the search for records.

The complainant alleged that the Privy Council Office (PCO) improperly withheld information concerning intelligence committee meetings from 1972, citing exemptions related to confidential government information, international affairs, national security, investigative bodies, and personal information. PCO released some information during the investigation but continued to withhold other records. The Information Commissioner found that PCO had not met the requirements for most of the claimed exemptions, particularly given the age of the records and the fact that similar information had been previously disclosed publicly. Consequently, the Commissioner ordered PCO to release most of the remaining withheld information and to re-exercise discretion on a few specific pages.

• Timeliness of exemption claims for historical records
• Demonstration of reasonable expectation of harm
• Public domain status of information
• Proper exercise of discretion

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request regarding government communications about the recognition of Yaroslav Hunka in September 2023 by the extended deadline. The OIC found that PCO did not respond by the April 7, 2025, extended due date and was deemed to have refused access. Despite the ongoing processing and consultations, the OIC found the delay unacceptable and ordered PCO to provide a complete response within 36 business days.

• Timeliness of response to access request
• Definition of a 'response' under the ATIA
• Effect of deemed refusal under subsection 10(3)
• Timeliness of implementing OIC order

The complainant alleged that Shared Services Canada (SSC) improperly withheld information requested under the Access to Information Act. The request was for a report from Gartner, Inc. The complainant argued the information was wrongly withheld under exemptions related to personal information, third-party financial/commercial/scientific/technical information, financial impact on a third party, and negotiations by a third party. The Information Commissioner found that while some information met the criteria for exemption under paragraph 20(1)(b), SSC failed to demonstrate that other withheld information met exemption requirements or that reasonable severance was not possible. The Commissioner ordered SSC to re-exercise its discretion on certain information and disclose specific parts of the report.

• Improper withholding of information under exemptions 19(1), 20(1)(b), 20(1)(c), and 20(1)(d) of the ATIA.
• Whether information qualified as confidential third-party financial, commercial, scientific, or technical information under paragraph 20(1)(b).
• Whether reasonable severance was possible under section 25 of the ATIA.
• Whether SSC reasonably exercised its discretion to withhold information under subsection 16(2).

The complainant alleged that Parks Canada failed to respond to an access request within the extended deadline. The request concerned data on human activity and coastal erosion impacts in the Gulf Islands National Park Reserve, and records related to a park closure decision. Parks Canada cited technical issues, staffing shortages, and third-party consultations as reasons for the delay. The Information Commissioner found the complaint well-founded, ordering Parks Canada to provide a complete response by April 30, 2026.

• Failure to respond within statutory time limits.
• Justification for delays due to technical issues and staffing shortages.
• Balancing third-party consultation requirements with the right to timely access.