Federal (Canada) privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated six complaints against the Canada Border Services Agency (CBSA) regarding the examination of personal digital devices at ports of entry. Complainants, all Canadian citizens, questioned the CBSA's authority to conduct these searches. The OPC found that the CBSA contravened section 4 of the Privacy Act by exceeding its legal authority in one case (accessing online banking/social media) and section 6(1) by destroying records in two cases. Systemic issues were identified, including BSOs failing to follow CBSA's own policy on disabling internet connectivity, note-taking, and search thresholds. The OPC concluded all six complaints were well-founded and made several recommendations for operational changes and legislative reform. The CBSA accepted the operational recommendations, committing to new policies, mandatory training, oversight, and transparency, but disagreed with the legislative reform recommendations. Consequently, the operational issues are considered conditionally resolved.

• Whether CBSA's collection of personal information via digital device searches contravened section 4 of the Privacy Act.
• Whether the definition of "goods" under the Customs Act extends to electronic documents on digital devices.
• Whether CBSA's authority to search digital devices is limited to information stored on the device.
• Whether Border Services Officers (BSOs) complied with CBSA's internal policy (Operational Bulletin PRG-2015-31) regarding digital device examinations (e.g., airplane mode, note-taking, search threshold).
• Whether the copying of content from a digital device by a BSO was consistent with CBSA's legal authority and policy.
• Whether the CBSA complied with its obligations under subsection 6(1) of the Privacy Act to retain personal information used for administrative purposes.
• Whether the CBSA's practices regarding training, awareness, and accountability mechanisms for digital device searches were adequate.
• Whether the Customs Act requires amendment to include a clear legal framework and a higher threshold for digital device examinations.
• Whether the threshold for digital device examinations should be "reasonable grounds to suspect".

The Office of the Privacy Commissioner of Canada (OPC) and the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) conducted a joint investigation into Facebook, Inc.'s compliance with PIPEDA and PIPA following revelations about the "thisisyourdigitallife" (TYDL) app and its data sharing with Cambridge Analytica. The investigation focused on Facebook's consent practices for both installing users and their friends, its data safeguards, and its overall accountability. The OPC found that Facebook failed to obtain meaningful consent from users for the disclosure of their personal information to third-party apps, including the TYDL app, and that its safeguards against unauthorized access and use were inadequate. Furthermore, Facebook was deemed to have abdicated its responsibility for user information, demonstrating a lack of accountability. Despite recommendations from the OPC, Facebook rejected or refused to implement them, leading to a finding that the complaint was well-founded and remains unresolved. The OPC stated it would pursue further action under its authorities.

• Whether the OPC and OIPC BC had jurisdiction to investigate the matter.
• Whether Facebook's provision of access to personal information via its Graph API constitutes a "disclosure" under PIPEDA.
• Whether Facebook obtained valid and meaningful consent from installing users for the disclosure of their personal information to third-party apps, including the TYDL App.
• Whether Facebook made reasonable efforts to ensure third-party apps obtained meaningful consent from installing users.
• Whether Facebook's reliance on overbroad and conflicting language in its privacy communications was sufficient for meaningful consent from installing users.
• Whether Facebook obtained meaningful consent from friends of installing users (Affected Users) for the disclosure of their personal information to third-party apps.
• Whether Facebook had adequate safeguards to protect user information against unauthorized access, use, and disclosure by apps.
• Whether Facebook's monitoring and enforcement of its Platform Policy were adequate.
• Whether Facebook's implementation of Graph v2 and App Review adequately addressed safeguard concerns for ongoing compliance.
• Whether Facebook was accountable for the user information under its control.
• Whether Facebook's policies and practices gave effect to the privacy principles under PIPEDA and PIPA.

A Global Affairs Canada (GAC) employee complained that GAC contravened the Privacy Act by requesting the return of his diplomatic passport, which contained personal travel information, for an administrative investigation. The complainant argued that GAC's policy required him to use the diplomatic passport for both personal and work travel while posted abroad, and returning it would lead to an improper collection of his personal information. GAC contended that the diplomatic passport is government property and it had the authority to collect the information for an investigation into alleged misconduct. The OPC found that GAC failed to demonstrate how the personal travel history related directly to an operating program or activity, as required by the Privacy Act. Although no collection occurred because the complainant refused to return the passport, the OPC concluded that GAC lacked the authority to collect such personal information. The complaint was deemed well-founded, and the OPC recommended GAC clarify its policies and inform diplomatic passport users of the privacy implications.

• Whether the information in the diplomatic passport constitutes personal information under s.3 of the Privacy Act
• Whether Global Affairs Canada's request for the diplomatic passport constituted a collection of personal information
• Whether Global Affairs Canada demonstrated its authority to collect the personal travel information under s.4 of the Privacy Act
• Whether the collection of personal travel information related directly to an operating program or activity of Global Affairs Canada

The complainant alleged that Employment and Social Development Canada (ESDC) improperly collected his personal information a second time, despite his previous objection, through Grey House Publishing Canada for the Prime Minister’s Volunteer Awards program. ESDC maintained that it acquired the distribution list compliantly, relying on its contract with Grey House which stipulated compliance with Canadian legislation and consent. The OPC found that while ESDC was not required to collect the information directly for administrative purposes, it failed to ensure Grey House obtained proper consent as per their contract and continued to collect the complainant's information despite his explicit request to be removed. The OPC concluded that ESDC did not comply with section 4 of the Privacy Act.

• Whether the complainant's name, telephone number, and email address constitute personal information under the Act
• Whether ESDC was required to collect personal information directly from the complainant under section 5 of the Act
• Whether ESDC complied with section 4 of the Act regarding the collection of personal information
• Whether ESDC adequately ensured Grey House Publishing Canada complied with consent requirements as per their contract
• Whether ESDC improperly collected the complainant's information after he requested removal from the distribution list

The complainant, an air passenger rights advocate, requested access to all records about himself held by the Canadian Transportation Agency (CTA). The CTA initially withheld 760 pages, arguing that most references to the complainant's name were not personal information because he was acting on behalf of an organization. The OPC found that the information was indeed personal information, as the organization was not a separate legal entity and the records contained views and information directly about the complainant. The OPC also found that the CTA incorrectly applied exemptions under section 26 (third-party personal information) and subsection 70(1) (cabinet confidences) in some instances, and over-redacted under section 27 (solicitor-client privilege). The complaint was found to be well-founded, and the CTA agreed to implement the OPC's recommendations to disclose the withheld information.

• Whether information relating to the complainant's advocacy activities, where his name appears, constitutes personal information under section 3 of the Privacy Act
• Whether the CTA correctly invoked paragraph 12(1)(b) to deny access to information it deemed not to be personal information
• Whether the CTA correctly withheld third-party personal information under section 26 of the Privacy Act
• Whether the CTA correctly withheld information under section 27 of the Privacy Act (solicitor-client privilege)
• Whether the CTA correctly withheld information under subsection 70(1) of the Privacy Act (cabinet confidences)