Federal (Canada) privacy & access decisions

A complainant alleged that the Canada Revenue Agency (CRA) inappropriately disclosed her adoptive child's name and her personal information to the child's biological mother, contravening section 8 of the Privacy Act. The child's name had been changed for safety reasons after a closed adoption. The OPC found that, on the balance of probabilities, the CRA likely disclosed the child's adoptive name to the biological mother, leading to significant negative impacts on the family. The investigation also revealed deficiencies in the CRA's internal procedures for safeguarding adopted children's personal information. The OPC issued recommendations to revise procedures, provide comprehensive training, and implement oversight measures. The CRA agreed to implement two of the three recommendations, but declined the oversight measure, leading to a "well-founded and not resolved" finding.

• Whether the CRA disclosed the child’s adoptive name to the biological mother in contravention of section 8 of the Privacy Act
• Whether the CRA's internal procedures for safeguarding adopted children's personal information were adequate

The complainant alleged that the Canada Revenue Agency (CRA) improperly denied access to personal information related to five grievances, relying on exceptions in subsection 12(1), paragraph 22(1)(b), and section 26 of the Privacy Act. The OPC found that while the CRA conducted reasonable searches, it failed to substantiate its use of some exemptions, particularly paragraph 22(1)(b). The CRA did not demonstrate a clear and direct connection between disclosure and a risk of harm, instead relying on general assertions. The OPC concluded that the complainant did not receive all entitled personal information and found the complaint well-founded. The OPC recommended the CRA reassess its reliance on paragraph 22(1)(b) and disclose more information. However, the CRA maintained its position, leading the OPC to consider the complaint unresolved.

• Whether the Canada Revenue Agency conducted reasonable searches for responsive records
• Whether the Canada Revenue Agency properly applied subsection 12(1) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied paragraph 22(1)(b) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied section 26 of the Privacy Act to withhold information
• Whether the Canada Revenue Agency demonstrated a clear and direct connection between disclosure and a risk of harm under paragraph 22(1)(b)
• Whether general assertions of harm are sufficient to justify withholding information under paragraph 22(1)(b)
• Whether the mere fact of an ongoing investigation meets the threshold for harm under paragraph 22(1)(b)
• Whether the potential for strategic advantage is sufficient to justify withholding information under paragraph 22(1)(b)
• Whether professional expertise alone is sufficient to substantiate an exemption claim under paragraph 22(1)(b)
• Whether a case-by-case assessment is required for the application of paragraph 22(1)(b)

The Office of the Privacy Commissioner (OPC) investigated complaints against the NSIRA Secretariat regarding its access to sensitive polygraph records during a review of the Communications Security Establishment's (CSE) Internal Security Program. Complainants questioned whether the collection of personal information complied with section 4 of the Privacy Act and if the Secretariat met its Personal Information Bank (PIB) obligations under section 10. The OPC found that while some un-redacted elements in security screening files posed a re-identification risk, the polygraph recordings themselves were sufficiently anonymized. Given NSIRA's broad mandate and right of access, the OPC concluded the collection issue was not well-founded. However, the Secretariat's delay in requesting approval for PIB changes was found well-founded, though resolved by subsequent submission. The OPC recommended the Secretariat prioritize PIB approvals and publish its Info Source page for transparency. The Secretariat committed to these actions.

• Whether the NSIRA Secretariat's collection of personal information (polygraph records) complied with section 4 of the Privacy Act.
• Whether the anonymization measures applied to polygraph records were sufficient to prevent re-identification.
• Whether the NSIRA Secretariat's viewing of personal information, even if not recorded, constituted a 'collection' under section 4.
• Whether the NSIRA Secretariat met its obligations under section 10 of the Privacy Act regarding Personal Information Banks (PIBs).
• Whether the NSIRA Secretariat's request for PIB approval was timely.
• Whether the NSIRA Secretariat published its Info Source page as required by TBS policy.