Federal (Canada) privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld information related to cybersecurity and data breach risk assessments of the ArriveCAN application under subsection 16(2) and paragraph 20(1)(d) of the Access to Information Act. During the investigation, CBSA initially disclosed some records but continued to withhold others under subsection 16(2) and additionally claimed subsection 19(1). The Commissioner found that while some information met the requirements of subsection 16(2) (facilitating an offence), other portions did not. Furthermore, the Commissioner concluded that CBSA failed to properly exercise its discretion under subsection 19(2) regarding personal information, as it did not demonstrate efforts to seek consent or consider public availability. The complaint was found to be well founded. Although the Commissioner issued an initial report with orders, CBSA subsequently made further disclosures, and the complainant indicated satisfaction, making a formal order unnecessary.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied to cybersecurity review information, including intranet/internal network addresses and specific vulnerabilities
• Whether s.16(2) ATIA was properly applied to statements related to asset identification and valuation, lists of components, summaries of changes, names of reference documents, and executive overviews
• Whether CBSA reasonably exercised its discretion under s.16(2) ATIA for information that met the exemption's requirements
• Whether s.19(1) ATIA (personal information) was properly applied to pictures and contact information of KPMG employees
• Whether CBSA made reasonable efforts to seek consent for disclosure of personal information under s.19(2)(a) ATIA
• Whether CBSA considered if personal information was publicly available under s.19(2)(b) ATIA
• Whether CBSA properly exercised its discretion under s.19(2) ATIA

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information under section 17 (safety of individuals) and subsection 19(1) (personal information) of the Access to Information Act. The request sought communications between specific CBC and Twitter employees since January 1, 2018. During the investigation, the CBC released some information previously withheld under subsection 19(1) and section 17, but also applied subsection 16(2) (facilitating the commission of an offence) to some remaining information. The Commissioner found that the CBC failed to demonstrate how disclosing the name and contact information of an information security team member would reasonably be expected to facilitate an offence, especially since some of this information was publicly available. Regarding section 17, while acknowledging that psychological harm could fall under the exemption, the Commissioner concluded that the CBC did not show the harm went beyond distress or that there was a reasonable expectation of harm if the information, including names and Twitter handles of journalists, were disclosed. The Commissioner ordered the CBC to disclose the information withheld under subsection 16(2) and section 17. The CBC notified the Commissioner that it would implement the order.

• Whether s.16(2) facilitating the commission of an offence was properly applied to the name and contact information of a CBC employee
• Whether there was a clear and direct linkage between disclosure and the alleged harm under s.16(2)
• Whether the information met the requirements of s.16(2)
• Whether s.17 safety of individuals was properly applied to the names and Twitter handles of CBC journalists
• Whether psychological harm is encompassed by s.17
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for journalists' identifying information
• Whether s.17 safety of individuals was properly applied to the name and contact information of a non-journalist CBC employee
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for the non-journalist employee's identifying information

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information under several exemptions of the Access to Information Act related to Taseko Mines Limited’s New Prosperity Project. The OIC investigated claims under subsections 16(2), 19(1), paragraphs 20(1)(d), 21(1)(a), 21(1)(b), and section 23. During the investigation, the complainant narrowed the scope, removing all information withheld under subsection 16(2) from the complaint. The Commissioner found that ECCC did not demonstrate that the requirements for paragraphs 20(1)(d), 21(1)(a), 21(1)(b), or section 23 were met for certain information. However, where the requirements for discretionary exemptions were met, ECCC was found to have reasonably exercised its discretion. The Commissioner ordered ECCC to disclose specific information that did not meet the exemption requirements. ECCC agreed to comply with the order, and the complaint was deemed well founded.

• Whether s.16(2) facilitating the commission of an offence applied
• Whether s.19(1) personal information applied
• Whether ECCC reasonably exercised its discretion under s.19(2)
• Whether s.20(1)(d) negotiations by a third party applied
• Whether ECCC reasonably exercised its discretion under s.20(5)
• Whether ECCC reasonably exercised its discretion under s.20(6)
• Whether s.21(1)(a) advice or recommendations applied
• Whether ECCC reasonably exercised its discretion under s.21(1)(a)
• Whether s.21(1)(b) accounts of consultations or deliberations applied
• Whether ECCC reasonably exercised its discretion under s.21(1)(b)
• Whether s.23 solicitor-client and litigation privilege applied
• Whether ECCC reasonably exercised its discretion under s.23

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld 96,781 pages of records under section 23 (solicitor-client and litigation privilege) of the Access to Information Act. The records related to the negotiation of a 1991 lease for the Louis St-Laurent Building. PSPC applied section 23 in a blanket manner, claiming both solicitor-client and litigation privilege. The Information Commissioner found that while some information met the requirements for solicitor-client privilege, PSPC failed to demonstrate that any information met the requirements for litigation privilege. Furthermore, PSPC's exercise of discretion was deemed unreasonable as it considered irrelevant factors and failed to consider relevant ones. The Commissioner also concluded that PSPC failed to adhere to section 25 by not performing a proper severance exercise. The complaint was found to be well founded, and PSPC was ordered to disclose specific types of records, all records not meeting solicitor-client privilege, and to reconsider its discretion for information genuinely subject to solicitor-client privilege.

• Whether the information met the requirements for solicitor-client privilege under s.23 ATIA
• Whether the information met the requirements for litigation privilege under s.23 ATIA
• Whether PSPC reasonably exercised its discretion to withhold information under s.23 ATIA
• Whether PSPC adhered to its severance obligations under s.25 ATIA

A complainant alleged that the Canada Revenue Agency (CRA) inappropriately disclosed her adoptive child's name and her personal information to the child's biological mother, contravening section 8 of the Privacy Act. The child's name had been changed for safety reasons after a closed adoption. The OPC found that, on the balance of probabilities, the CRA likely disclosed the child's adoptive name to the biological mother, leading to significant negative impacts on the family. The investigation also revealed deficiencies in the CRA's internal procedures for safeguarding adopted children's personal information. The OPC issued recommendations to revise procedures, provide comprehensive training, and implement oversight measures. The CRA agreed to implement two of the three recommendations, but declined the oversight measure, leading to a "well-founded and not resolved" finding.

• Whether the CRA disclosed the child’s adoptive name to the biological mother in contravention of section 8 of the Privacy Act
• Whether the CRA's internal procedures for safeguarding adopted children's personal information were adequate

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for Microsoft Teams messages related to ArriveCAN. The CBSA initially informed the complainant that no such records existed, citing a 30-day retention period for MS Teams messages. However, the OIC's investigation revealed that an administrative error prevented the request from being promptly entered into CBSA's case management system, causing a significant delay in processing. This delay meant that by the time the request was actioned, the MS Teams messages would have been automatically deleted. Despite this, CBSA policy required business-related information from MS Teams to be saved to corporate repositories. During the investigation, CBSA searched these repositories and located one responsive record, which was subsequently provided to the complainant. The Commissioner found that the CBSA did not conduct a reasonable search initially due to the processing delays and failure to task program areas, but acknowledged that a reasonable search was eventually completed during the investigation.

• Whether the institution conducted a reasonable search for records
• Whether the administrative error in processing the request impacted the search for records
• Whether the institution's MS Teams retention policy and corporate repository policy were followed

The complainant alleged that the Canada Revenue Agency (CRA) improperly denied access to personal information related to five grievances, relying on exceptions in subsection 12(1), paragraph 22(1)(b), and section 26 of the Privacy Act. The OPC found that while the CRA conducted reasonable searches, it failed to substantiate its use of some exemptions, particularly paragraph 22(1)(b). The CRA did not demonstrate a clear and direct connection between disclosure and a risk of harm, instead relying on general assertions. The OPC concluded that the complainant did not receive all entitled personal information and found the complaint well-founded. The OPC recommended the CRA reassess its reliance on paragraph 22(1)(b) and disclose more information. However, the CRA maintained its position, leading the OPC to consider the complaint unresolved.

• Whether the Canada Revenue Agency conducted reasonable searches for responsive records
• Whether the Canada Revenue Agency properly applied subsection 12(1) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied paragraph 22(1)(b) of the Privacy Act to withhold information
• Whether the Canada Revenue Agency properly applied section 26 of the Privacy Act to withhold information
• Whether the Canada Revenue Agency demonstrated a clear and direct connection between disclosure and a risk of harm under paragraph 22(1)(b)
• Whether general assertions of harm are sufficient to justify withholding information under paragraph 22(1)(b)
• Whether the mere fact of an ongoing investigation meets the threshold for harm under paragraph 22(1)(b)
• Whether the potential for strategic advantage is sufficient to justify withholding information under paragraph 22(1)(b)
• Whether professional expertise alone is sufficient to substantiate an exemption claim under paragraph 22(1)(b)
• Whether a case-by-case assessment is required for the application of paragraph 22(1)(b)

An anonymous applicant complained that Transport Canada improperly withheld information from rail workplace fatality investigation reports under sections 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Commissioner found that while some information was properly withheld as personal information under section 19(1), Transport Canada failed to reasonably exercise its discretion regarding publicly available personal information. For section 20(1)(b), most of the withheld information did not meet the requirements for confidentiality or being "supplied by" a third party, with only specific financial and technical details qualifying. The Commissioner rejected the application of section 20(1)(c), finding that the institution and third parties did not demonstrate a clear and direct connection between disclosure and a reasonable expectation of harm. Furthermore, a third party's claim under section 23 for solicitor-client and litigation privilege was also rejected due to insufficient evidence. Consequently, the complaint was well-founded, and Transport Canada was ordered to disclose most of the withheld information.

• Whether the withheld information constituted "personal information" under subsection 19(1) ATIA
• Whether Transport Canada reasonably exercised its discretion under subsection 19(2)(b) ATIA regarding publicly available personal information
• Whether the withheld information was "financial, commercial, scientific or technical" under paragraph 20(1)(b) ATIA
• Whether the withheld information was "confidential" under paragraph 20(1)(b) ATIA
• Whether the withheld information was "supplied by a third party" under paragraph 20(1)(b) ATIA
• Whether the third party "consistently treated the information as confidential" under paragraph 20(1)(b) ATIA
• Whether disclosure of the information could reasonably be expected to result in "material financial loss or gain" or "prejudice to the competitive position" of a third party under paragraph 20(1)(c) ATIA
• Whether the withheld information was subject to "solicitor-client privilege" under section 23 ATIA
• Whether the withheld information was subject to "litigation privilege" under section 23 ATIA

The complainant alleged that Health Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(c) of the Access to Information Act concerning documents about the impact of campfires on air quality. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). Health Canada had withheld names of third parties and short texts about them under paragraph 20(1)(c), claiming potential financial impact on third parties. The third parties, Canadian Automobile Association (CAA) and Canadian Institute of Planners (CIP), were invited to make representations. The CAA opposed disclosure, citing "future risk" from misinformation, but provided no evidence of specific harm. The CIP stated disclosure would not cause it harm. The Commissioner found that the information did not meet the requirements of paragraph 20(1)(c) as there was no clear and direct connection between disclosure and a risk of harm beyond mere possibility. Health Canada agreed to disclose the information following an order from the Commissioner. The complaint was found to be well founded, and Health Canada was ordered to disclose the information.

• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether disclosure could result in material financial loss or gain to the third party with a reasonable expectation of harm
• Whether disclosure could injure the competitive position of the third party with a reasonable expectation of prejudice
• Whether the third parties provided sufficient evidence to demonstrate a reasonable expectation of harm under s.20(1)(c)

The complainant alleged that Transport Canada improperly withheld information from a Final Report of an investigation into an accidental death at a Canadian Pacific Railway Company (CP) yard. Transport Canada initially withheld information under paragraphs 16(1)(c), 19(1), and 20(1)(b) of the Access to Information Act. CP also asserted additional exemptions under paragraphs 20(1)(c), section 23, and subsection 24(1). The Information Commissioner found that Transport Canada did not meet the burden for withholding an incident number under 16(1)(c). For 19(1), the Commissioner found that while much of the witness statement information was personal and posed a serious re-identification risk, factual information could be severed and disclosed. Regarding 20(1)(b), the Commissioner determined that some technical and commercial information met the exemption criteria, but other information, particularly safety-related content, did not meet the confidentiality requirement. The Commissioner rejected CP's additional exemption claims under 20(1)(c), 23, and 24(1) due to insufficient evidence. The complaint was found to be well founded, and Transport Canada was ordered to disclose specific information.

• Whether s.16(1)(c) law enforcement or investigation harm was reasonably expected for the incident number
• Whether information was personal information under s.19(1)
• Whether factual information could be severed from personal information under s.19(1)
• Whether there was a serious risk of re-identification for personal information under s.19(1)
• Whether Transport Canada reasonably exercised discretion under s.19(2)
• Whether information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether information was confidential under s.20(1)(b)
• Whether information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated information as confidential under s.20(1)(b)
• Whether Transport Canada reasonably exercised discretion under s.20(6)
• Whether s.20(1)(c) financial impact or competitive harm was reasonably expected
• Whether information was subject to solicitor-client privilege under s.23
• Whether information was subject to litigation privilege under s.23
• Whether information was restricted by another law under s.24(1) (Canada Labour Code s.144(3))

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information related to applications for legal funding at public expense, including records concerning British Columbia's Braidwood Commission on the death of Robert Dziekanski. The RCMP claimed various exemptions under the Access to Information Act. The Information Commissioner found that the RCMP improperly withheld information under paragraphs 13(1)(a) and (c), section 14, subsection 15(1), and section 23, specifically rejecting the RCMP's claims of solicitor-client, litigation, and common interest privilege for certain letters. The Commissioner also concluded that the RCMP failed to take reasonable steps to seek consent from the B.C. government for information qualifying under subsection 13(1), as required by subsection 13(2). However, the Commissioner upheld the application of subsection 19(1) and paragraph 21(1)(a) for other information, finding the RCMP's exercise of discretion reasonable in those instances. Consequently, the complaint was found to be well founded. The Commissioner ordered the RCMP to disclose the improperly withheld information and to seek consent from the B.C. government for other records before exercising discretion on their release. The RCMP gave notice that it would not fully implement these orders.

• Whether the information met the requirements of subsection 19(1) ATIA
• Whether the RCMP reasonably exercised its discretion under subsection 19(2) ATIA
• Whether the information met the requirements of section 23 ATIA regarding solicitor-client privilege
• Whether the information met the requirements of section 23 ATIA regarding litigation privilege
• Whether common interest privilege applied to letters from legal counsel to the Braidwood Commission
• Whether the RCMP reasonably exercised its discretion under section 23 ATIA
• Whether the information met the requirements of paragraph 13(1)(a) ATIA
• Whether the information met the requirements of paragraph 13(1)(c) ATIA
• Whether the information met the requirements of paragraph 13(1)(d) ATIA
• Whether the RCMP reasonably exercised its discretion to seek consent under subsection 13(2) ATIA
• Whether the information met the requirements of section 14 ATIA
• Whether the information met the requirements of subsection 15(1) ATIA
• Whether the information met the requirements of paragraph 21(1)(a) ATIA
• Whether the RCMP reasonably exercised its discretion under paragraph 21(1)(a) ATIA

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee timesheet information under subsection 19(1) of the Access to Information Act. The request was for timesheets from April 19 to May 3, 2023, a period coinciding with a labour strike. The OIC accepted that User ID and PRI, if disclosed, would reveal an employee's choice to participate in or cross a picket line, thus constituting personal information not related to their position or function. However, for the remaining timesheet data (Date, Att/Abs type, Att/Abs text, Company, Status, Hours), the OIC found CRA's argument for withholding to be speculative and lacking concrete evidence that disclosure would lead to identification, especially given the large number of employees and various reasons for absence. The OIC concluded that this remaining information did not meet the requirements of subsection 19(1). The Commissioner ordered CRA to disclose the information that did not meet the requirements of subsection 19(1). CRA gave notice that it would partially implement the order, intending to withhold information associated with leave codes used by fewer than 10 employees.

• Whether User ID and PRI on timesheets constitute personal information under s.19(1) ATIA
• Whether the release of User ID and PRI would reveal an employee's personal choice regarding strike participation, thus not falling under the s.3(j) Privacy Act exception
• Whether the remaining timesheet information (Date, Att/Abs type, Att/Abs text, Company, Status, Hours) constitutes personal information under s.19(1) ATIA
• Whether there is a serious possibility that disclosing the remaining timesheet information would lead to the identification of individuals
• Whether CRA's evidence for identification was speculative or concrete
• Whether CRA reasonably exercised its discretion under s.19(2) ATIA for information meeting s.19(1) requirements

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information under several exemptions of the Access to Information Act, specifically paragraphs 18(a), 18(b), 20(1)(b), 20(1)(c), and subsection 19(1), related to the lease of equipment. The complainant also alleged that PAPA failed to conduct a reasonable search for records. The investigation focused on the application of paragraph 20(1)(c) to specific rental rate amounts on two pages and the reasonable search allegation. The Commissioner found that PAPA could not demonstrate that the disclosure of the rental rates would reasonably be expected to cause material financial impact or harm the competitive position of the third party. However, the Commissioner was satisfied that PAPA conducted a reasonable search for records. Consequently, the complaint was found to be well founded regarding the exemption claim, and PAPA was ordered to disclose the redacted information.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to rental rate amounts on pages 54 and 55
• Whether disclosure of rental rates could result in material financial loss or gain to the third party
• Whether there is a reasonable expectation of harm to the third party's financial impact or competitive position
• Whether Port Alberni Port Authority conducted a reasonable search for records

The complainant alleged that the National Research Council Canada (NRC) improperly withheld information under sections 20(1)(d), 21(1)(a), 21(1)(c), and 23 of the Access to Information Act. The request concerned records related to negotiations with the Professional Institute of the Public Service of Canada (PIPSC) regarding overtime conversion. The OIC found that the NRC failed to demonstrate that the requirements for exemptions under paragraphs 20(1)(d), 21(1)(a), and 21(1)(c) were met for all the withheld information. Specifically, the OIC determined that the NRC could not establish a reasonable expectation of interference with negotiations for the information withheld under 20(1)(d), and that the NRC did not reasonably exercise its discretion for some information under 21(1)(a). However, the OIC upheld the application of section 23 for solicitor-client privilege. The Commissioner ordered the NRC to disclose certain information originally withheld under paragraphs 20(1)(d), 21(1)(a), and 21(1)(c). The NRC agreed to implement the order, and the complaint was found to be well founded.

• Whether s.20(1)(d) contractual or other negotiations exemption was properly applied
• Whether disclosure of information could reasonably be expected to interfere with third-party negotiations under s.20(1)(d)
• Whether the institution met the requirements for s.20(1)(d)
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether the information constituted advice or recommendations developed by or for a government institution or minister under s.21(1)(a)
• Whether the institution reasonably exercised its discretion to disclose information under s.21(1)(a)
• Whether s.21(1)(c) positions or plans developed for negotiations exemption was properly applied
• Whether the information consisted of positions or plans developed for negotiations by or on behalf of the Government of Canada under s.21(1)(c)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the information constituted confidential legal advice under s.23
• Whether the institution reasonably exercised its discretion to disclose information under s.23

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought data analyzed in the Sea Lice Science Response Report (2022/045) from January to June 2022. DFO initially withheld the information, citing confidentiality, but later conceded that much of the data, including temperature and salinity data, could be disclosed. The Information Commissioner found that neither DFO nor the third parties demonstrated that the information met all the requirements of paragraph 20(1)(b), specifically regarding objective confidentiality and whether all information was supplied by a third party. One third party also raised section 26, but the Commissioner found it did not apply as the 90-day publication timeline had passed. The Commissioner ordered DFO to fully disclose the records, and DFO agreed to comply.

• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was objectively confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether the information would be published by a government institution within 90 days under s.26 ATIA