Federal (Canada) privacy & access decisions

The complainant alleged that the Department of Justice Canada improperly withheld a "Final report: Mandatory Minimum Penalties. Recommendations to the Minister of Justice and Attorney General of Canada. Expert Panel on Sentencing Reform" under sections 14 and 21(1)(a) of the Access to Information Act. The Department argued that disclosure would harm federal-provincial affairs and that the report constituted advice or recommendations from internal-like advisors. The Commissioner found no reasonable expectation of harm to federal-provincial affairs, noting the report was six years old, drafted by volunteers, and did not detail active negotiations or provincial positions. Furthermore, the Commissioner determined that the report was prepared by external consultants, not employees or ministerial staff, thus falling under an exception to the advice and recommendations exemption. Consequently, the Commissioner ordered the Department to disclose the records in their entirety, and the Department agreed to comply.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to the records
• Whether disclosure of the report could reasonably be expected to harm the conduct of federal-provincial affairs
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the records
• Whether the report was prepared by consultants or advisers who were not directors, officers, or employees of an institution or members of a minister's staff, as per s.21(2)(b) ATIA

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee telephone numbers under paragraph 16(2)(c) of the Access to Information Act, claiming disclosure could facilitate the commission of an offence. The request was for a telephone list for the CRA Headquarters International and Large Business Directorate. The complainant also initially alleged an unreasonable search, but later withdrew this aspect of the complaint. The CRA argued that disclosing cell phone numbers, now widely used by employees, could lead to hacking, interception of communications, identity theft, fraud, and harassment, citing vulnerabilities like SS7 attacks. However, the OIC found that the CRA failed to provide clear and convincing evidence of a reasonable expectation of harm, noting that government devices are encrypted and employees are trained on security risks. The OIC also pointed out that some of the numbers were already publicly available, undermining the CRA's claim of harm. The Information Commissioner concluded that the CRA did not meet the requirements for applying paragraph 16(2)(c). The complaint was deemed well founded, and the CRA subsequently released the withheld phone numbers.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to withhold employee telephone numbers
• Whether there was a reasonable expectation of harm from disclosing employee telephone numbers
• Whether the institution's security measures for government devices mitigated the risk of harm
• Whether the public availability of some employee telephone numbers undermined the claim of harm
• Whether the institution conducted a reasonable search for records

The complainant alleged that Health Canada improperly withheld information related to a COVID-19 Vaccine Periodic Safety Update Report under sections 13(1), 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that Health Canada correctly applied section 13(1) and 19(1) to some information, but failed to reasonably exercise its discretion under section 13(2) for publicly available information. The Commissioner also found that Health Canada and the third party (Pfizer) did not establish that sections 20(1)(b) or 20(1)(c) applied. Consequently, the Commissioner ordered Health Canada to disclose information not covered by sections 13(1) or 19(1), and to re-evaluate the disclosure of section 13(1) information that is publicly available. Health Canada agreed to comply with the order.

• Whether s.13(1) ATIA applied to information obtained from the European Medical Agency (EMA)
• Whether Health Canada reasonably exercised its discretion under s.13(2) ATIA regarding publicly available information
• Whether s.19(1) ATIA applied to personal information that could identify individuals
• Whether Health Canada reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA applied to confidential third-party financial, commercial, scientific or technical information
• Whether s.20(1)(c) ATIA applied to information that could cause financial impact or harm competitive position to a third party