Federal (Canada) privacy & access decisions

The complainant alleged that Health Canada improperly withheld information related to a COVID-19 Vaccine Periodic Safety Update Report under sections 13(1), 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that Health Canada correctly applied section 13(1) and 19(1) to some information, but failed to reasonably exercise its discretion under section 13(2) for publicly available information. The Commissioner also found that Health Canada and the third party (Pfizer) did not establish that sections 20(1)(b) or 20(1)(c) applied. Consequently, the Commissioner ordered Health Canada to disclose information not covered by sections 13(1) or 19(1), and to re-evaluate the disclosure of section 13(1) information that is publicly available. Health Canada agreed to comply with the order.

• Whether s.13(1) ATIA applied to information obtained from the European Medical Agency (EMA)
• Whether Health Canada reasonably exercised its discretion under s.13(2) ATIA regarding publicly available information
• Whether s.19(1) ATIA applied to personal information that could identify individuals
• Whether Health Canada reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA applied to confidential third-party financial, commercial, scientific or technical information
• Whether s.20(1)(c) ATIA applied to information that could cause financial impact or harm competitive position to a third party

The OPC investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding its systematic practice of withholding access to certain personal information in its Global Case Management System (GCMS). IRCC's policy was to retrieve and process only a "Short Form" GCMS Report in response to access requests, even when individuals requested their entire file or specific content found in the "Long Form." The OPC found that the "History Section" of the GCMS file, which is part of the Long Form, contained the complainant's personal information and that IRCC's practice contravened Section 12 of the Privacy Act. While IRCC eventually provided the complainant with the requested Long Form, it did not agree to update its procedures to systematically retrieve and process the Long Form for all future requests. Consequently, the OPC found the complaint well-founded but not resolved, as IRCC had not committed to addressing the systemic issue.

• Whether IRCC's practice of providing only a "Short Form" GCMS Report in response to access requests contravenes Section 12 of the Privacy Act
• Whether the "History Section" of the GCMS file contains personal information
• Whether information in the "Long Form" GCMS Report is always exempt from disclosure
• Whether IRCC has an obligation to retrieve and process all records responsive to a Privacy Act request

An employee of the Canada Border Services Agency (CBSA) filed a complaint after their personal information, including sensitive details about an accommodation request, was inadvertently made accessible to other CBSA employees through the Apollo information management system. The issue stemmed from improperly set permissions on an old ATIP file folder, which allowed document titles and sometimes the first line of emails containing personal information to be visible via Apollo's search function. The OPC found that the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority. While the CBSA corrected the specific permissions and committed to broader reviews and improved naming conventions, it did not agree to implement mandatory and trackable training for employees on Apollo permissions management. Consequently, the OPC found the complaint well-founded but unresolved, as it was not satisfied that sufficient safeguards were in place to prevent recurrence.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority
• Whether the CBSA appropriately responded to the unauthorized disclosure
• Whether the CBSA's proposed measures, without mandatory and trackable training, are sufficient to prevent future unauthorized disclosures

The complainant alleged that Transport Canada failed to respond to an access request within the statutory 30-day period and improperly handled the request before opening the file. The request sought correspondence related to the Greater Toronto Airports Authority (GTAA) concerning noise, flight path changes, passenger-based formulas, and airspace redesign. The investigation found that Transport Canada did not respond within the 30-day timeframe, largely due to delays from a primary Office of Primary Interest (OPI) in retrieving records, exacerbated by a building fire that prevented access to paper records. Electronic records were also not processed while waiting for paper records. However, the Commissioner found that Transport Canada did not improperly handle the request initially, as it reasonably sought clarification when the request did not explicitly name the institution. The complaint regarding the delay was found to be well-founded, and Transport Canada was ordered to provide a complete response within 120 business days. Transport Canada indicated it would not fully implement the order, stating it would provide an interim response instead.

• Whether Transport Canada responded to the access request within the 30-day period as per section 7 of the Access to Information Act
• Whether Transport Canada improperly handled the request before opening the file
• Whether Transport Canada met its duty to assist the complainant under subsection 4(2.1)

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to a previous access request (A-2012-00683) and a 10-page "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate that a reasonable search had been conducted, particularly regarding a second search by its Records Operations unit for which details were lacking. The Commissioner concluded that PCO did not conduct a reasonable search. Consequently, the complaint was deemed well founded, and PCO was ordered to conduct a new search, process any additional records found, and provide a supplementary response to the complainant within 36 business days. PCO did not indicate whether it would comply with the order.

• Whether the institution conducted a reasonable search for records

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for Microsoft Teams messages and related policies. ISED claimed a 390-day extension, citing the volume of records, complexity, and the need for senior-level review, as well as internal and external consultations. The Commissioner found that ISED failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to determine the necessary length. Specifically, the 240-day extension for volume and interference was deemed excessive, and the 150-day extension for consultations lacked sufficient justification. The Commissioner concluded that the extension was invalid, leading to a deemed refusal of access. The complaint was found to be well-founded, and ISED was ordered to provide a complete response within 60 business days.

• Whether the 240-day extension under s.9(1)(a) ATIA for volume and interference was reasonable
• Whether the 150-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether ISED made a serious effort to assess the necessary length of the extension of time
• Whether there was a link between the reasons for the extension and its length
• Whether the calculation of the length of the extension was sufficiently rigorous, logical, and supportable
• Whether ISED was in deemed refusal under s.10(3) ATIA

The complainant sought records related to the Canada Student Service Grant from Employment and Social Development Canada (ESDC), alleging improper withholding of information under several exemptions and an unreasonable search for records. The Commissioner found that ESDC improperly withheld information claimed under paragraphs 20(1)(b) and 20(1)(c), determining that the institution failed to demonstrate the information's confidentiality, its financial/commercial/scientific/technical nature, or a reasonable expectation of harm from disclosure. For information withheld under paragraphs 21(1)(a) and 21(1)(b), the Commissioner concluded that factual information and final decisions did not meet the exemption requirements and that ESDC failed to reasonably exercise its discretion for other information that did meet the requirements. Similarly, while the majority of information claimed under section 23 met the requirements for solicitor-client privilege, some portions did not, and privilege was waived for other parts by the Privy Council Office. However, the Commissioner found that ESDC conducted a reasonable search for records, despite the complainant's concerns about missing emails, handwritten notes, and cabinet confidences. Consequently, the complaint was found to be well founded regarding the improper application of exemptions and the failure to exercise discretion. The Commissioner ordered ESDC to disclose specific information and to re-exercise its discretion for other information withheld under sections 21 and 23. ESDC notified the Commissioner of its intent to comply with the order, though it also indicated a desire to apply additional exemptions not raised during the investigation, which the Commissioner rejected.

• Whether ESDC improperly withheld information under s.16(2) ATIA
• Whether ESDC improperly withheld information under s.19(1) ATIA
• Whether the information met the requirements of s.20(1)(b) ATIA (confidential financial, commercial, scientific or technical information)
• Whether the information met the requirements of s.20(1)(c) ATIA (material financial impact or harm to competitive position)
• Whether the information met the requirements of s.21(1)(a) ATIA (advice or recommendations)
• Whether the information met the requirements of s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information met the requirements of s.23 ATIA (solicitor-client and litigation privilege)
• Whether ESDC reasonably exercised its discretion to disclose information under s.20(5) ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.21 ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.23 ATIA
• Whether ESDC conducted a reasonable search for records
• Whether PCO waived solicitor-client privilege over certain information

An anonymous applicant complained that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(b) of the Access to Information Act. The request sought annual rent figures for leases exceeding $500,000 signed by PSPC in specific cities between 2018 and 2022. PSPC and several third parties argued that disclosure would harm PSPC's competitive position and negotiations, and constitute confidential third-party financial information, also suggesting paragraphs 20(1)(c) and 20(1)(d). The Commissioner found PSPC's and the third parties' arguments for all claimed exemptions to be speculative, failing to demonstrate a reasonable expectation of probable harm or objective confidentiality. Specifically, the rent figures were not considered "supplied by" the third parties for the purpose of s.20(1)(b). Consequently, the complaint was found to be well founded, and the Commissioner ordered PSPC to disclose the records in full. PSPC subsequently gave notice that it would comply with the order.

• Whether PSPC improperly withheld information under paragraph 18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to harm the competitive position of PSPC under s.18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with contractual or other negotiations of PSPC under s.18(b) ATIA
• Whether PSPC's representations on harm under s.18(b) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(b) ATIA
• Whether annual rent figures constitute financial, commercial, scientific or technical information under s.20(1)(b) ATIA
• Whether annual rent figures are confidential by an objective standard under s.20(1)(b) ATIA
• Whether annual rent figures are publicly available
• Whether the circumstances give rise to a reasonable expectation that annual rent figures would not be disclosed
• Whether the relationship between PSPC and third parties would be fostered for public benefit by confidentiality of annual rent figures
• Whether annual rent figures were "supplied by" the third party to PSPC under s.20(1)(b) ATIA
• Whether third parties consistently treated annual rent figures as confidential under s.20(1)(b) ATIA
• Whether PSPC improperly withheld information under paragraph 20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to prejudice a third party's competitive position under s.20(1)(c) ATIA
• Whether third parties' representations on harm under s.20(1)(c) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(d) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with the contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether third parties' representations on interference under s.20(1)(d) were speculative
• Whether the complaint was well founded under s.30(1)(a) ATIA
• Whether an order for disclosure should be issued under s.36.1 ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to a video posted on Facebook. The request specifically excluded draft copies, media articles, and French records where English equivalents existed. During the investigation, it was discovered that ISC's Communications and Public Affairs unit had removed records deemed to be drafts, including logistics, filming arrangements, and approvals, based on their interpretation of the exclusion criteria. This led to an incomplete initial search. Following the OIC's intervention, ISC located an additional 1,087 pages of records. The Commissioner found that while the appropriate offices were tasked, the initial removal of records based on an incorrect interpretation of "drafts" rendered the search unreasonable. The complaint was found to be well-founded, and ISC was ordered to process the newly found records and provide a supplementary response.

• Whether Indigenous Services Canada conducted a reasonable search for records
• Whether the institution's interpretation of 'draft copies' exclusion was appropriate

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under subsections 16(2) and 19(1) of the Access to Information Act. The request sought records concerning a meeting between Clerk John Hannaford and the official languages commissioner. The Commissioner found that PCO appropriately applied subsection 16(2) to a phone number, concluding that its disclosure could reasonably facilitate the commission of an offence and that PCO's exercise of discretion was reasonable. However, the Commissioner determined that PCO improperly applied subsection 19(1) to a signature and two initials, as PCO failed to demonstrate why this information, used in the performance of official duties, was not excluded from the definition of personal information by paragraph 3(j) of the Privacy Act. The Office of the Privacy Commissioner concurred with this assessment. Despite being given an opportunity to release the information informally, PCO did not respond. The Commissioner ordered PCO to disclose the signature and initials, which PCO ultimately agreed to do after obtaining consent from the individuals involved, while still maintaining its disagreement with the Commissioner's position.

• Whether the disclosure of a phone number could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether the institution reasonably exercised its discretion in applying s.16(2) ATIA
• Whether a signature and initials on official documents constitute personal information under s.19(1) ATIA
• Whether the signature and initials are excluded from the definition of personal information by paragraph 3(j) of the Privacy Act
• Whether the institution sufficiently justified the application of s.19(1) ATIA

An anonymous applicant complained that Transport Canada improperly withheld records related to a workplace fatality under sections 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act, and failed to conduct a reasonable search. During the investigation, Transport Canada also invoked sections 16(1)(c) and 16(2), and the reasonable search complaint was resolved. The Commissioner found that most personal information was properly withheld under section 19(1), and Transport Canada's exercise of discretion under section 19(2) was reasonable. However, the Commissioner rejected the application of sections 16(1)(c), 20(1)(c), and 24(1), finding no reasonable expectation of harm or that the information did not meet the exemption criteria. While section 16(2) was upheld for URLs and passwords, Transport Canada failed to demonstrate it had exercised its discretion. Section 20(1)(b) was upheld in part, with significant portions of information ordered disclosed as they did not meet all the exemption's requirements. Consequently, the complaint was found well-founded, and Transport Canada was ordered to disclose specific information and re-exercise its discretion for other records.

• Whether Transport Canada improperly withheld information under s.19(1) ATIA (personal information).
• Whether Transport Canada reasonably exercised its discretion under s.19(2) ATIA regarding personal information.
• Whether Transport Canada improperly withheld information under s.16(1)(c) ATIA (conduct of investigations).
• Whether disclosure of information could reasonably be expected to harm the conduct of lawful investigations under s.16(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.16(2) ATIA (facilitating the commission of an offence).
• Whether Transport Canada reasonably exercised its discretion under s.16(2) ATIA regarding information that could facilitate an offence.
• Whether Transport Canada improperly withheld information under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information).
• Whether the information met the "financial, commercial, scientific or technical" requirement of s.20(1)(b) ATIA.
• Whether the information was "confidential" by an objective standard under s.20(1)(b) ATIA.
• Whether the information was "supplied by" a third party under s.20(1)(b) ATIA.
• Whether the third party "consistently treated the information as confidential" under s.20(1)(b) ATIA.
• Whether Transport Canada improperly withheld information under s.20(1)(c) ATIA (financial impact on a third party).
• Whether disclosure could reasonably be expected to result in material financial loss or gain to the third party under s.20(1)(c) ATIA.
• Whether disclosure could reasonably be expected to injure the competitive position of the third party under s.20(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.24(1) ATIA (disclosure restricted by another law).
• Whether the information related to a "secret process or trade secret" under s.24(1) ATIA.
• Whether Transport Canada conducted a reasonable search for records.

An anonymous applicant complained that the Privy Council Office (PCO) improperly withheld records related to meetings of the Joint Intelligence Committee and Intelligence Advisory Committee from 1972. PCO initially claimed exemptions under subsections 13(1), 15(1), 16(1)(a), 16(1)(b), 16(1)(c), and 19(1) of the Access to Information Act. During the investigation, PCO conceded that some exemptions were improperly applied and released additional information, and the complainant narrowed the scope of the complaint. The Information Commissioner found that PCO failed to demonstrate that most of the remaining withheld information met the requirements for exemption under subsections 13(1) and 15(1), often citing a lack of evidence for confidentiality or a reasonable expectation of harm, especially given the historical nature and public availability of similar records. For a British Joint Intelligence Committee Draft Paper title, while s.13(1) applied, PCO did not reasonably exercise its discretion under s.13(2) as the title was publicly available. Consequently, the Commissioner ordered PCO to disclose numerous pages in their entirety and to re-exercise discretion for specific information. The complaint was found to be well-founded, and PCO agreed to implement the orders.

• Whether information regarding visits of Intelligence Community members from other countries met the requirements of s.13(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.13(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.13(1) ATIA.
• Whether information regarding other specified countries met the requirements of s.13(1) ATIA.
• Whether mention of a conference met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.13(1) ATIA.
• Whether PCO reasonably exercised discretion under s.13(2) ATIA for the title of a British Joint Intelligence Committee Draft Paper.
• Whether information on pages 212 and 215 met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.15(1) ATIA.
• Whether information regarding the visits of Intelligence Community members from other countries met the requirements of s.15(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.15(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.15(1) ATIA.
• Whether discussion of the Special Research Bureau (SRB) Program Forecast met the requirements of s.15(1) ATIA.
• Whether information regarding other countries (activities, bi-national relationships, threats, UK JIC) met the requirements of s.15(1) ATIA.
• Whether reference to a Joint Intelligence Report met the requirements of s.15(1) ATIA.
• Whether remarks concerning an individual from a foreign country met the requirements of s.15(1) ATIA.
• Whether mention of a conference met the requirements of s.15(1) ATIA.
• Whether PCO improperly withheld information under s.16(1)(a) ATIA.
• Whether PCO improperly withheld information under s.16(1)(b) ATIA.
• Whether PCO improperly withheld information under s.16(1)(c) ATIA.
• Whether PCO improperly withheld information under s.19(1) ATIA.

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request by the extended due date, concerning government communications about former House of Commons Speaker Anthony Rota's recognition of Yaroslav Hunka. PCO had extended the response period by 360 days, making the due date April 7, 2025, but failed to respond by this date. The Commissioner found that PCO did not meet its obligation to respond within the extended period, deeming it to have refused access under subsection 10(3) of the Act. Despite PCO indicating that records had been reviewed and consultations completed, and proposing an anticipated response deadline of October 24, 2025, this deadline was also not met. The Commissioner concluded that the delay was unacceptable and in contravention of PCO's obligations. The complaint was found to be well founded, and PCO was ordered to provide a complete response within 36 business days.

• Whether the institution responded within the time limits required by section 7 of the ATIA
• Whether the institution's extension under subsection 9(1) of the ATIA was properly applied and adhered to
• Whether the institution is deemed to have refused access under subsection 10(3) of the ATIA due to failure to respond

The complainant alleged that Shared Services Canada (SSC) improperly withheld information from a Gartner, Inc. report on cloud economics under various sections of the Access to Information Act. Initially, SSC claimed exemptions under subsections 19(1), 20(1)(b), 20(1)(c), and 20(1)(d), later dropping 19(1) and 20(1)(d) but adding 16(2). Gartner also asserted exemptions under 20(1)(a) and 68(a). The Commissioner found that while some information met the requirements of paragraph 20(1)(b), much of the claimed information did not, including administrative details and government-supplied data. The Commissioner also concluded that SSC failed to properly exercise discretion for information withheld under subsection 16(2) and did not establish that paragraphs 20(1)(a) or 20(1)(c) applied. Furthermore, SSC failed to adhere to severance requirements under section 25. The complaint was found to be well founded, and SSC was ordered to re-exercise discretion for the subsection 16(2) claim and disclose specific portions of the report.

• Whether the complaint falls under paragraph 30(1)(a) of the Act
• Whether subsection 19(1) (personal information) applied to the information
• Whether paragraph 20(1)(d) (negotiations by a third party) applied to the information
• Whether subsection 16(2) (facilitating the commission of an offence) applied to the security measures on page 134
• Whether Shared Services Canada reasonably exercised its discretion under subsection 16(2)
• Whether paragraph 20(1)(a) (third-party trade secrets) applied to the information
• Whether the information was a "plan or process, tool, mechanism or compound" under paragraph 20(1)(a)
• Whether the information was "secret" under paragraph 20(1)(a)
• Whether the third party intended to treat the information as secret under paragraph 20(1)(a)
• Whether paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) applied to the information
• Whether the information was financial, commercial, scientific or technical under paragraph 20(1)(b)
• Whether the information was objectively confidential under paragraph 20(1)(b) (not available from other sources)
• Whether the information was objectively confidential under paragraph 20(1)(b) (reasonable expectation of non-disclosure)
• Whether the information was objectively confidential under paragraph 20(1)(b) (relationship fostered for public benefit)
• Whether the third party supplied the information to a government institution under paragraph 20(1)(b)
• Whether the third party consistently treated the information as confidential under paragraph 20(1)(b)
• Whether paragraph 20(1)(c) (financial impact on a third party) applied to the information
• Whether disclosure could result in material financial loss or gain to the third party under paragraph 20(1)(c)
• Whether disclosure could injure the competitive position of the third party under paragraph 20(1)(c)
• Whether there was a reasonable expectation of harm well beyond a mere possibility under paragraph 20(1)(c)
• Whether section 25 (severance) was properly applied by Shared Services Canada
• Whether paragraph 20(1)(b) applied to administrative details
• Whether paragraph 20(1)(b) applied to introductory slides
• Whether paragraph 20(1)(b) applied to engagement objectives
• Whether paragraph 20(1)(b) applied to section title slides
• Whether paragraph 20(1)(b) applied to table of contents
• Whether paragraph 20(1)(b) applied to government information
• Whether paragraph 20(1)(b) applied to file names and icons
• Whether paragraph 20(1)(b) applied to project-specific advice paid for by the government
• Whether paragraph 20(1)(b) applied to application names and descriptions

The complainant alleged that Parks Canada failed to respond to an access request within the extended time limit under subsection 9(1) of the Access to Information Act. The request sought records related to human activity and coastal erosion impacts on culturally significant areas within Gulf Islands National Park Reserve, and records leading to the park's closure decision. Parks Canada received the request on May 5, 2025, and extended the response period to October 27, 2025, but failed to respond by this date, leading to a deemed refusal under subsection 10(3). The institution attributed the delay to staffing shortages, technical issues with redaction software, and the need for extensive third-party consultations, particularly with First Nations due to the sensitive nature of the records. The Commissioner found the technical delays unacceptable and emphasized that staffing issues and competing priorities do not justify delays under the Act. Parks Canada committed to providing a partial response by February 27, 2026, and a complete response by April 30, 2026. The Commissioner ordered Parks Canada to provide a complete response by April 30, 2026, which the institution agreed to implement.

• Whether Parks Canada responded to the access request within the extended time limit under subsection 9(1) of the ATIA
• Whether technical issues with redaction software justify delay in responding to an access request
• Whether staffing shortages and heavy workload justify delay in responding to an access request
• Whether the need for third-party consultations justifies delay in responding to an access request