Federal (Canada) privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding erroneous quarantine notifications sent by the ArriveCAN application to approximately 10,200 Apple device users. These notifications, issued between June 28 and July 20, 2022, incorrectly instructed fully vaccinated travellers to quarantine due to a defect in ArriveCAN version 3.0. The OPC found that the Canada Border Services Agency (CBSA) failed to take all reasonable steps to ensure the accuracy of personal information used for an administrative purpose, as required by subsection 6(2) of the Privacy Act. Specifically, the OPC identified shortcomings in rigorous pre-release testing, effective human intervention, and timely correction and recourse for affected individuals. The CBSA disagreed with the finding and refused to implement the OPC's recommendation to correct the inaccurate "quarantine_exempted" value in its database. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the Canada Border Services Agency (CBSA) took all reasonable steps to ensure that personal information used for an administrative decision was as accurate as possible under subsection 6(2) of the Privacy Act.
• Whether the "quarantine_exempted" data field constituted personal information used for an administrative purpose by the CBSA.
• Whether the CBSA conducted rigorous pre-release testing for issues that could lead to the highest negative impacts on individual users.
• Whether the CBSA ensured effective human intervention with respect to high-impact decisions on individuals.
• Whether the CBSA provided effective and timely correction and recourse for individuals affected by inaccurate information.

A former refugee complained that the Canadian Border Services Agency (CBSA) contravened his privacy rights by using commercial genetic genealogy (FamilyTreeDNA) to determine his nationality for deportation. He alleged lack of legal authority, unnecessary collection, invalid consent, deceptive practices, inadequate disclosure limitation, and insufficient Personal Information Bank (PIB) description. The Office of the Privacy Commissioner (OPC) found that while the collection was directly related to CBSA's program, the agency contravened section 5 of the Privacy Act by failing to obtain valid, informed authorization for indirect collection from FTDNA. CBSA also contravened section 8 by making incidental disclosures of the complainant's personal information to other FTDNA users, failing to monitor account settings, and not using a pseudonym. Furthermore, the CBSA's PIB descriptions were non-compliant with section 11, as they did not adequately describe the collection of genetic profiles of other FTDNA users. The OPC made several recommendations, which CBSA committed to implement for most parts, but two accounts remained open at the time of the report, leading to an ongoing, unresolved contravention. Consequently, the complaint was found well-founded in part and conditionally resolved in part.

• Whether CBSA's collection of genetic genealogy information was directly related to an operating program or activity under s.4 of the Privacy Act
• Whether CBSA collected unnecessary information under s.4 of the Privacy Act
• Whether CBSA obtained valid authorization from the complainant for the indirect collection of his personal information from FTDNA under s.5(1) of the Privacy Act
• Whether the complainant's consent for indirect collection was voluntary and not given under duress
• Whether the complainant was adequately informed about FTDNA's terms and his rights as a DNA donor for valid authorization
• Whether CBSA acted deceptively in its collection via FTDNA
• Whether the incidental indirect collection of genetic profile information of hundreds of other individuals contravened s.5(1) of the Privacy Act
• Whether CBSA's incidental disclosures of the complainant's personal information contravened s.8 of the Privacy Act
• Whether allowing potential disclosure of the complainant's personal information to other law enforcement bodies (via "law enforcement matching" opt-in) contravened s.8 of the Privacy Act
• Whether the disclosure of ancillary personal information (ethnicity) to genetic matches contravened s.8 of the Privacy Act
• Whether the disclosure of the complainant's identity to genetic matches (failure to use a pseudonym) contravened s.8 of the Privacy Act
• Whether CBSA's Personal Information Bank (PIB) descriptions complied with the transparency obligations under s.11 of the Privacy Act
• Whether the PIB adequately described the collection of biometric information for individuals subject to removal orders
• Whether the PIB adequately described the collection of genetic profiles of other FTDNA users (relatives of individuals subject to removal orders)

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(b) of the Access to Information Act, related to applications and Minimum Safe Manning Documents for the motor vessel Spirit of Vancouver Island. The complaint regarding subsection 19(1) was later removed from the investigation's scope. During the investigation, Transport Canada also applied paragraph 20(1)(b.1) to one document. The Commissioner found that while portions of one document met the requirements of paragraph 20(1)(b.1), the titles and headings did not. Furthermore, neither Transport Canada nor the third party provided sufficient representations to justify withholding information under paragraph 20(1)(b), except for the titles and headings of the document also claimed under 20(1)(b.1). The Commissioner ordered Transport Canada to disclose all information withheld under paragraphs 20(1)(b) and 20(1)(b.1), with the exception of the main content of page 50, and to disclose the titles and headings on page 50. Transport Canada indicated it would "likely" comply with the order.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(b.1) third-party emergency management plans information was properly withheld
• Whether the information concerned critical infrastructure information under s.20(1)(b.1)
• Whether the information was supplied in confidence under s.20(1)(b.1)
• Whether the information was supplied for the preparation, maintenance, testing or implementation of emergency management plans under s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(5) regarding s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(6) regarding s.20(1)(b.1)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

An employee of the Immigration and Refugee Board of Canada (IRB) complained that their intimate personal and sensitive medical information, contained in a Fitness to Work (FTW) report, was disclosed to their management team without consent and for no reasonable purpose. The OPC investigated whether the IRB respected section 8 of the Privacy Act, specifically regarding consent and consistent use. The IRB argued the disclosure was a consistent use, but the OPC found that while some information disclosure was consistent, the highly intimate personal and sensitive medical information was not. The OPC concluded that the IRB contravened the Act by disclosing information internally that fell outside what is permissible. Despite some new processes, the IRB did not fully acknowledge wrongdoing or agree to all recommendations, leading to a well-founded and unresolved finding.

• Whether the IRB obtained valid consent for the disclosure of the FTW report to the management team under section 8(1) of the Privacy Act
• Whether the disclosure of intimate personal and sensitive medical information in the FTW report to the management team was a 'consistent use' under section 8(2)(a) of the Privacy Act
• Whether the IRB adhered to the Treasury Board Secretariat's Occupational Health Evaluation Standard regarding disclosure of medical information to employers

The complainant alleged that Public Safety Canada (Public Safety) took an unreasonable extension of time to respond to an access request for correspondence between Public Safety and the Royal Canadian Mounted Police (RCMP). Public Safety claimed a 240-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. The Commissioner found that Public Safety properly notified the complainant of the extension. However, Public Safety failed to demonstrate that the request involved a large number of records or that processing it within 30 days would unreasonably interfere with its operations, thus not meeting the requirements of paragraph 9(1)(a). While Public Safety needed to consult with the RCMP, the Commissioner found the 180-day consultation period requested by the RCMP, based on service standards rather than complexity, to be unreasonable. Consequently, the Commissioner concluded that Public Safety did not meet the requirements for a valid extension under either paragraph 9(1)(a) or 9(1)(b), rendering the extension invalid. Public Safety was deemed to have refused access under subsection 10(3) of the Act.

• Whether the institution properly notified the complainant of the extension of time
• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution's operations under s.9(1)(a)
• Whether the institution needed to carry out consultations on the requested records under s.9(1)(b)
• Whether the consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)
• Whether the institution responded within the time limits

The complainant alleged that the Public Health Agency of Canada (PHAC) failed to conduct a reasonable search for records in response to two access requests. The requests sought electronic records related to masks, sent or received by a specific warehouse manager within defined timeframes. Initially, PHAC found no responsive records because the employee had deleted their entire mailbox, considering the contents transitory. During the OIC's investigation, PHAC conducted additional searches using IT forensics and identified 107 pages of responsive records, which were subsequently released. The Commissioner found that PHAC's initial search was inadequate as it did not consider other potential sources of records, such as emails sent to or from the employee by others, or corporate repositories. Despite the subsequent release of records and PHAC's commitment to an action plan for improved information management, the Commissioner concluded that the complaints were well founded due to the initial failure to conduct a reasonable search.

• Whether the Public Health Agency of Canada conducted a reasonable search for records in response to the first access request (5820-04413)
• Whether the Public Health Agency of Canada conducted a reasonable search for records in response to the second access request (5820-04414)
• Whether the deletion of an employee's email account impacted the ability to conduct a reasonable search
• Whether PHAC considered all reasonable sources for responsive records

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request for records concerning the procurement of new handguns for the military within the 30-day statutory time limit. PSPC received the request on June 4, 2021, and the response was due by July 5, 2021, but no response was provided. PSPC cited a backlog, operational challenges, heavy workloads, staff turnover, and competing priorities as reasons for the delay, and indicated a plan to respond by February 28, 2025. The Commissioner found that PSPC's reasons, including staffing shortages and the need for inter-institutional consultations, did not absolve it of its statutory obligation to provide a timely response. The Commissioner concluded that PSPC failed to meet its obligations under the Act and was deemed to have refused access. The complaint was found to be well founded, and PSPC was ordered to provide a complete response within 36 business days, an order which PSPC indicated it would not fully implement.

• Whether the institution responded to the access request within the 30-day time limit set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (backlog, operational challenges, staff turnover, competing priorities, inter-institutional consultations) absolved it of its statutory obligation to respond within the time limit

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day statutory period, leading to a deemed refusal. The request sought records related to strategic communications campaigns concerning perceptions about drones. DND argued that the request did not meet the requirements of section 6 of the Access to Information Act, claiming it lacked sufficient detail to identify records with reasonable effort. The Information Commissioner found that the request, which included a timeframe and subject, provided sufficient detail for an experienced employee to identify the records. The Commissioner also rejected DND's arguments that parts of the request were hypothetical or related to external academic papers. Consequently, DND was found to be in a state of deemed refusal. The complaint was well founded, and DND was ordered to provide a complete response to the access request.

• Whether National Defence responded to the access request within the 30-day period set out in section 7 of the Act
• Whether the access request met the requirements of section 6 of the Act to provide sufficient detail to identify records with reasonable effort
• Whether the request for 'strategic communications campaign(s)' was too broad
• Whether parts of the request were related to a hypothetical strategic communications plan
• Whether parts of the request were related to an academic paper not available within DND/CAF

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to sufficiently identify redacted portions of records and the basis for withholding information in response to an access request for historical information about Warren Hart. CSIS used negative (white) redactions and cited exemptions only in the response letter, arguing that marking redactions on the records could cause harm. The Information Commissioner found that CSIS did not provide a cogent explanation for how clearly marked redactions and exemptions would reveal protected information. The Commissioner concluded that CSIS failed to meet its obligations regarding severance and the duty to assist. CSIS was recommended to provide a new response with clearly identified redactions and specific exemption provisions, and to cease using negative redactions and citing exemptions only in response letters. CSIS agreed to implement these recommendations.

• Whether CSIS sufficiently identified redacted portions of records
• Whether CSIS sufficiently identified the basis for withholding information
• Whether the use of negative (white) redactions by CSIS was appropriate
• Whether citing exemptions only in response letters by CSIS was appropriate
• Whether CSIS's practice contravened the duty to assist under subsection 4(2.1) ATIA
• Whether CSIS's practice contravened the severance requirement under section 25 ATIA
• Whether clearly marking redactions and exemptions on records would reveal protected information or cause harm

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to unidentified aerial phenomena (UAP) held by two named individuals. The investigation revealed that DND's Office of Primary Interest misread the request, limiting the search to only 'reports of UAP' instead of the broader 'general subject of UAP', and also unnecessarily restricted its search to keywords. The Office of the Information Commissioner (OIC) requested DND to perform an additional search, which resulted in the retrieval of 11 additional pages of records. The Commissioner concluded that DND did not conduct a reasonable search. The complaint was found to be well founded, and DND was ordered to provide access to the additional records.

• Whether National Defence conducted a reasonable search for records
• Whether the Office of Primary Interest misread the access request
• Whether limiting the search to keywords constituted a reasonable search

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsection 15(1) of the Access to Information Act, concerning records of the Intelligence Advisory Committee from 1989-1995. These records pertained to migration trends and global developments. The Office of the Information Commissioner (OIC) found that the Canadian Government had previously disclosed similar records and that the information reflected public and Parliamentary debate, leading the OIC to conclude that disclosure would not harm national security or international relations. Consequently, the OIC determined that the requirements for exemption under subsection 15(1) were not met. As a result of the OIC's intervention, LAC disclosed the records in their entirety on January 20, 2023. The complainant expressed satisfaction with this disclosure.

• Whether s.15(1) ATIA (national security and international relations) was properly applied to records of the Intelligence Advisory Committee, 1989-1995
• Whether disclosure of the records would cause harm to national security or international relations

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The request sought information related to applications and Minimum Safe Manning (MSM) Documents for the passenger ship, Queen of Cumberland. During the investigation, the complainant removed the s.19(1) aspect from the complaint. The OIC found that Transport Canada and the third party (BC Ferries) failed to demonstrate that all requirements for the s.20(1)(b) exemption were met. Specifically, the OIC was not convinced that all information was financial, commercial, scientific, or technical, nor that it was consistently treated as confidential or supplied by the third party. Consequently, the Commissioner ordered Transport Canada to disclose the information withheld under paragraph 20(1)(b). Transport Canada indicated it would likely comply with the order.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied to a government institution by a third party under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the relationship between the government and the third party is fostered for public benefit by the confidential communication

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and 24(1) of the Access to Information Act regarding records about Canadian universities' engagement in the Federal Contractors Program. The OIC removed the s.24(1) claim from the scope of the complaint as the only information withheld under it (business numbers) was no longer at issue. The Commissioner found that ESDC did not demonstrate that all information withheld under s.19(1) was personal information about identifiable individuals, nor did it appropriately exercise its discretion under s.19(2)(b). Furthermore, neither ESDC nor the third party (University of Waterloo) demonstrated that the requirements of s.20(1)(b) were met for a completed Employment Equity Achievement Awards Application Form. The complaint was found to be well founded, and the Commissioner ordered ESDC to disclose the information at issue. ESDC subsequently gave notice that it would fully implement the order.

• Whether information withheld under s.19(1) was personal information about identifiable individuals
• Whether ESDC properly severed non-personal information from personal information under s.19(1)
• Whether ESDC reasonably exercised its discretion under s.19(2)(b) regarding publicly available information
• Whether the Employment Equity Achievement Awards Application Form met the requirements of s.20(1)(b)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

The complainant alleged that Trans Mountain Corporation (TMC) improperly responded to an access request by invoking subsection 10(2) of the Access to Information Act, neither confirming nor denying the existence of records, and stating that if records existed, they would be withheld under subsection 16(2). The OIC found that TMC failed to demonstrate that the existence or absence of records itself warranted withholding, especially since TMC had previously confirmed the existence of similar records in response to a nearly identical request. The Commissioner also determined that TMC did not show how all responsive records, if they existed, could reasonably be expected to facilitate the commission of an offence under subsection 16(2). Consequently, the Commissioner concluded that TMC's reliance on subsection 10(2) was not justified. The complaint was found to be well founded, and TMC was ordered to provide a new response confirming or denying the existence of records and, if records exist, to provide access unless a specific exemption applies.

• Whether the institution met the requirements for invoking subsection 10(2) of the ATIA
• Whether the existence or absence of records itself is information that warrants being withheld under the Act
• Whether, if responsive records existed, they could reasonably be exempted under specific provisions of the Act
• Whether the institution's reliance on subsection 10(2) was a reasonable exercise of discretion
• Whether disclosure of records could reasonably be expected to facilitate the commission of an offence under subsection 16(2)

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information related to the Roberts Bank Terminal 2 Project, specifically concerning biofilm and shorebirds, under several exemptions of the Access to Information Act. The complaint initially included exemptions s.16(2) and s.19(1), but these were later removed from the scope of the investigation. The OIC found that ECCC had appropriately applied s.21(1)(a) and s.21(1)(b) to most of the withheld records, as they constituted advice, recommendations, or accounts of consultations. However, ECCC's application of s.20(1)(b), s.21(1)(a), and s.21(1)(b) to a scientific manuscript was deemed improper, as the manuscript was found not to be confidential and ECCC later agreed to its disclosure. The Commissioner also noted inconsistencies in ECCC's disclosure practices. The complaint was found to be well founded, and ECCC was ordered to disclose the manuscript and correct the inconsistencies.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied (removed from scope)
• Whether s.19(1) ATIA (personal information) was properly applied (removed from scope)
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied to the scientific manuscript
• Whether the scientific manuscript was 'financial, commercial, scientific or technical' information under s.20(1)(b)
• Whether the scientific manuscript was 'confidential' under s.20(1)(b) (Air Atonabee test)
• Whether the information in the scientific manuscript was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information in the scientific manuscript as confidential under s.20(1)(b)
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the scientific manuscript
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to the scientific manuscript
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to other records
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to other records
• Whether ECCC reasonably exercised its discretion to disclose information under s.21(1)(a) and s.21(1)(b)
• Whether there were inconsistencies in ECCC's disclosure of information