Federal (Canada) privacy & access decisions

First Nations activist Cindy Blackstock complained that Aboriginal Affairs and Northern Development Canada (AANDC) and the Department of Justice Canada (DOJ) contravened the Privacy Act by collecting her personal information from her Facebook page. The departments argued that information posted publicly on Facebook was not personal. The OPC rejected this argument, finding that publicly available information can still be personal under the Privacy Act. The OPC found that the collection of personal information from Ms. Blackstock's personal Facebook page was not directly related to a government operating program or activity. Both departments accepted the OPC's recommendations to cease such collection, destroy previously collected personal information, and develop policies for social media monitoring.

• Whether information posted on a personal Facebook page constitutes "personal information" under the Privacy Act
• Whether the public availability of personal information on the Internet renders it non-personal
• Whether the collection of personal information from Ms. Blackstock's personal Facebook page was directly related to a government operating program or activity
• Whether the monitoring of Ms. Blackstock's public speeches constituted collection of "personal information" under the Privacy Act
• Whether repeated accessing of Ms. Blackstock's Indian status records was a contravention of the Privacy Act

An inmate at a maximum-security penitentiary requested video recordings of incidents involving officers. The Correctional Service of Canada (CSC) denied access, citing third-party information and security concerns. The OPC found complaints regarding 16 destroyed videos to be well-founded, as CSC had not even reviewed them before denial. For two other videos, which CSC claimed contained third-party information and posed security risks, the OPC found CSC correctly applied exemptions, thus resolving those complaints.

• Timeliness of responding to access to information requests
• Destruction of records prior to fulfilling requests
• Application of exemptions for security of penal institutions
• Proper review of records before withholding information

A complainant alleged that a Canadian Forces (CF) employee, with whom he had a prior personal relationship, inappropriately accessed his personal health information. The investigation found that the employee accessed the complainant’s health information in the Canadian Forces Health Information System (CFHIS) multiple times after receiving an anonymous message about the complainant's health. The employee admitted to accessing and using the information for personal reasons, which was inconsistent with the purpose for its collection. The complaint was found to be well-founded. As a result, National Defence acknowledged the importance of privacy awareness and training, implemented new controls in CFHIS, updated its health service policy, and provided training to CF healthcare staff.

• Whether a National Defence employee inappropriately accessed personal health information for personal reasons
• Whether the access was inconsistent with the purpose for which the information was collected

A man applied for a Transportation Security Clearance in July 2010, which was denied by Transport Canada (TC) in September 2011 based on information from the RCMP. The man complained that the RCMP improperly disclosed his personal information to TC. The RCMP had obtained information about an incident involving the complainant in 2009, which resulted in an absolute discharge a few months later. The RCMP provided this information to TC in 2011. The OPC found that the disclosure contravened the Criminal Records Act because more than a year had passed since the absolute discharge and no ministerial approval was obtained. The disclosure was also not authorized under the Privacy Act. The complaint was found to be well-founded.

• Whether the RCMP's disclosure of personal information to Transport Canada contravened the Criminal Records Act
• Whether the RCMP's disclosure of personal information to Transport Canada was authorized under the Privacy Act

A sergeant complained that his estranged wife, a civilian employee at a Canadian Forces Base, had unauthorized access to his military health records. The sergeant provided an audit log showing his wife accessed his Canadian Forces Health Information Services (CFHIS) account and deleted a physiotherapy appointment. National Defence (DND) confirmed the unauthorized access and noted she also accessed a paper physiotherapy file. DND determined she willfully breached departmental rules and implemented system restrictions to bar her access. The OPC found the access and use of medical information inconsistent with its original purpose and not a permissible use under the Privacy Act, upholding the complaint as well-founded. DND has since implemented new CFHIS controls and is evaluating its systems and practices for health information.

• Whether the estranged wife's access to the sergeant's medical records was authorized
• Whether the access and use of medical information was consistent with the purpose for which it was originally intended
• Whether the access and use met permissible uses defined in the Privacy Act

A complainant alleged that the Canada Revenue Agency (CRA) contravened the Privacy Act when an employee accessed his tax file without authorization in 2005 and 2006. The complainant became suspicious after community members showed knowledge of his financial information. An audit trail report revealed that a CRA employee had accessed his T1 tax account twice, viewing sensitive personal information including his Social Insurance Number, income, and family details. The OPC's investigation confirmed that the employee accessed the account without authorization and beyond the scope of their duties. The complaint was found to be well-founded, and CRA confirmed the employee no longer has access to taxpayer information.

• Whether a CRA employee accessed the complainant's tax file without authorization
• Whether the unauthorized access contravened the use and disclosure provisions of the Privacy Act

A woman complained that two RCMP employee landlords performed a criminal background check on her using the Canadian Police Information Centre (CPIC) database when she applied to rent a basement apartment. The landlords requested personal identification to "look into" prospective tenants. An internal RCMP investigation confirmed that one officer accessed CPIC for personal reasons, citing the applicant being from "out of town" and concerns for officer safety and organizational security. The OPC found that the CPIC database contains personal information and its use is restricted to legitimate law enforcement purposes. The investigation concluded that the officer's access was for personal reasons, not authorized operational purposes. The complaint was found to be well-founded, and the RCMP took remedial actions including an apology to the complainant and a communiqué to employees regarding CPIC use policies.

• Whether the CPIC database contains personal information under the Privacy Act
• Whether the RCMP officer accessed the CPIC database for personal reasons
• Whether the access to the CPIC database was for an authorized operational purpose

The adult children of a deceased veteran sought access to their father's pension file from Veterans Affairs Canada to administer his estate. Veterans Affairs refused, citing a 20-year protection period under the Pension Act and the children's ineligibility for pension benefits. The children complained to the OPC, arguing the documents were necessary to determine if pension entitlements were fully paid and if the claim was processed in bad faith. The OPC found it unreasonable for Veterans Affairs to dictate estate information needs. The OPC concluded that under the Privacy Act's Regulations, the complainants were entitled to the file for estate administration. The complaint was upheld as well-founded, and Veterans Affairs subsequently released the file.

• Whether Veterans Affairs Canada was justified in withholding a deceased veteran's pension file from his adult children
• Whether the Pension Act's 20-year protection period for personal information overrides the need for estate administration
• Whether the Privacy Act's Regulations entitle complainants to a deceased pensioner's file for estate administration

A Canadian Forces member complained that Veterans Affairs Canada (VAC) improperly disclosed the exact percentage of his disability pension to the Department of National Defence (DND) without his consent. This was the second such complaint from the same individual, with a similar complaint in 2008 having been found well-founded. The OPC's investigation found that an agreement between VAC and DND limited information sharing to five specific pieces of information, none of which included the disability percentage. VAC argued the disclosure was in the public interest under subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act, but the OPC found no evidence that the disclosure was deliberate or necessary for the complainant's treatment. The disclosure appeared to be an accidental forwarding of an internal email chain. The OPC found the complaint well-founded and made recommendations to VAC.

• Whether Veterans Affairs Canada disclosed personal information (disability pension percentage) to the Department of National Defence without consent
• Whether the disclosure was in accordance with the information-sharing agreement between VAC and DND
• Whether the disclosure was useful or necessary to facilitate the complainant's medical treatment
• Whether the disclosure qualified under the "public interest" provisions of subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act

An inmate complained that the Correctional Service of Canada (CSC) contravened the Privacy Act by openly posting details of medical appointments. The postings included his name, appointment time, and partial offender number, which were visible to the general penitentiary population. The inmate also alleged similar disclosures for other inmates, including complete offender numbers and other medical information. The CSC acknowledged the breach and committed to notifying inmates individually rather than posting lists. However, the CSC did not agree to use only partial offender numbers on internal employee lists for notifications. The OPC upheld the complaint as well-founded.

• Whether the open posting of inmate medical appointment details constituted an unauthorized disclosure of personal information under the Privacy Act
• Whether the Correctional Service of Canada contravened the Privacy Act by disclosing inmate names, appointment times, and offender numbers to the general penitentiary population

A woman complained that her personal information, specifically positive drug test results from an ion scan during a prison visit, was inappropriately disclosed to her ex-husband, a Correctional Service of Canada (CSC) employee. Her ex-husband used this information to deny her access to their children. While CSC investigated and found that the ex-husband did not directly access the database, they did not determine how he obtained the information. The OPC's investigation confirmed that the drug test results were indeed disclosed to the ex-husband by other CSC employees, though the specific individuals responsible could not be identified. The OPC found that CSC failed to adequately address the core disclosure issue.

• Whether the woman's personal information (drug test results) was inappropriately disclosed to her ex-husband
• Whether Correctional Service of Canada adequately dealt with the disclosure issue

A woman complained to the OPC after discovering her tax information, held by the Canada Revenue Agency (CRA), was inappropriately accessed by a CRA employee who was the common-law spouse of her ex-husband. The ex-husband subsequently used this information to seek an amendment to a child support arrangement. The CRA's internal investigation confirmed the unauthorized access and disclosure but took 13 months, and the complainant was never informed of the results. The OPC's investigation found the complaint to be well-founded, noting that while the CRA had a discipline policy, allegations of misconduct needed to be addressed more quickly. The OPC also highlighted the need for enhanced privacy training for employees with access to personal tax information.

• Whether the Canada Revenue Agency inappropriately disclosed personal tax information
• Whether the Canada Revenue Agency adequately responded to the internal investigation
• Whether the Canada Revenue Agency's policies and training were sufficient to protect personal information

A Canadian woman complained after her personal information, including her passport and income tax assessment, was disclosed to a Bangladeshi man whose work permit application she was supporting. The woman had sent these documents via her MP to the Canadian High Commission in Dhaka. When the man's application was refused, the High Commission returned the entire file, including the woman's documents, to him. Citizenship and Immigration Canada acknowledged the disclosure was made without consent and should not have occurred. The OPC found the complaint to be well-founded and recommended that all High Commissions implement a system to distinguish and prevent the return of third-party documents to applicants.

• Whether Citizenship and Immigration Canada disclosed personal information without consent
• Whether the disclosure of personal information was in contravention of the Privacy Act

An individual complained that Veterans Affairs Canada improperly collected his personal information. The individual had contacted Veterans Affairs and the National Capital Commission regarding a monument. Subsequently, a Veterans Affairs official searched the individual's email address on Google, finding a discussion page with personal information. The official then emailed the URL of this page to the entire email thread, stating the individual's email was "public domain." The OPC found that Veterans Affairs did not have a demonstrable need to collect the URL linking to the personal information. The collection of this URL was deemed a violation of the Privacy Act, as collected personal information must relate directly to an operating program or activity. The complaint was well-founded, and Veterans Affairs apologized and deleted the email from its systems.

• Whether the collection of a URL linking to publicly available personal information constitutes collection under the Privacy Act
• Whether the collected personal information related directly to an operating program or activity of Veterans Affairs Canada under section 4 of the Privacy Act

An individual complained that an RCMP staff sergeant inappropriately disclosed personal information about him at a community meeting. The sergeant, invited to discuss a decade-old murder case, named the complainant as a "person of interest" and stated he had declined a polygraph test. The complainant alleged he was not fully informed about the subject matter of the discussion. The RCMP presumed consent based on the complainant's attendance and assurances from community group representatives. The OPC found that the RCMP had a responsibility to actively obtain consent for the disclosure, rather than presuming it. The complaint was upheld as well-founded.

• Whether the RCMP inappropriately disclosed personal information about the complainant at a community meeting
• Whether the RCMP obtained valid consent for the disclosure of personal information