Federal (Canada) privacy & access decisions

The complainant alleged that National Defence (DND) failed to respond to an access request for specific reports and recommendations within the 30-day timeframe required by the Access to Information Act. The investigation found that DND did not respond by the extended deadline and is therefore deemed to have refused access. The Commissioner ordered DND to complete the retrieval and provide a response to the request within 36 business days.

• Timeliness of response to an access request
• Definition of a "response" under the Act
• Consequences of failing to respond within the statutory time limits

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence related to a specific standing offer. PHAC claimed an extension of 255 days due to the volume of records, citing a need for 180 days under paragraph 9(1)(a). The Commissioner found that PHAC failed to demonstrate that the 180-day extension was reasonable, as it did not show sufficient rigour in calculating the time needed. Consequently, the extension was deemed invalid, and PHAC was ordered to provide a complete response within 60 business days.

• Reasonableness of time extension under subsection 9(1)(a)
• Definition of a 'large number of records'
• Adequacy of justification for processing time
• Deemed refusal of access under subsection 10(3)

The complainant alleged that Housing, Infrastructure and Communities Canada (Infrastructure Canada) improperly withheld information related to payment requests from Signature on the Saint Lawrence Group (SSLG). The request sought official documents from January 2016 to March 2019. While the complainant later narrowed the complaint, the investigation focused on exemptions related to third-party financial information and disclosure restrictions. The Commissioner found that only information concerning pricing and contractual relationships met the criteria for exemption under paragraph 20(1)(c).

• Application of section 20(1)(c) regarding financial impact on a third party.
• Application of section 20(1)(b) regarding confidential third-party financial, commercial, scientific or technical information.
• Application of section 24(1) regarding disclosure restricted by another law.
• Burden of proof for third-party exemptions.

The complainant alleged that the time National Defence (DND) took to respond to an access request regarding military equipment sent to Ukraine was unreasonable. The OIC found that DND did not meet the requirements for a valid time extension. DND was deemed to have refused access. Following discussions facilitated by the OIC, the complainant narrowed the scope of the request, and DND then estimated a six-month response time. The Commissioner ordered DND to provide a complete response by November 25, 2024.

• Reasonableness of time extension under subsection 9(1) of the ATIA.
• Whether DND met the requirements for a time extension due to volume of records under paragraph 9(1)(a).
• Deemed refusal of access under subsection 10(3) due to failure to respond within the extended period.
• Impact of narrowing the request on the response timeline.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their own DNA profile, citing subsection 24(1) of the Access to Information Act (disclosure restricted by another law). The RCMP argued that section 6.6 of the DNA Identification Act prohibits the disclosure of such information. The Information Commissioner found that the DNA Identification Act, which is listed in Schedule II of the ATIA, indeed restricts the disclosure of DNA profiles, and therefore upheld the RCMP's decision.

• Interpretation of subsection 24(1) of the Access to Information Act
• Application of section 6.6 of the DNA Identification Act
• Whether the complainant's DNA profile is information whose disclosure is restricted by another law

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act, which allows withholding information that could facilitate the commission of an offence. The CBSA argued that disclosure could allow malicious actors to hack the application or compromise user data. The Information Commissioner found that the CBSA reasonably exercised its discretion to withhold the source code at the time of the request, considering the sensitive nature of the application and the risks of disclosure.

• Whether the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence if disclosed.
• Whether the CBSA reasonably exercised its discretion in deciding to withhold the source code.
• Whether severance of the source code was possible and reasonable.

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable amount of time to respond to an access request. The request was for communications related to designated projects in Western Canada. IAAC extended the response time by 880 days, but the Information Commissioner found that IAAC did not adequately justify the length of this extension, particularly under paragraph 9(1)(a) of the Access to Information Act. Consequently, the Commissioner deemed the extension invalid, ordered IAAC to respond by April 23, 2025, and found the complaint to be well-founded.

• Reasonableness of the 880-day time extension under subsection 9(1)(a) of the ATIA
• Whether IAAC demonstrated sufficient rigour in calculating the extension period
• Whether IAAC's delay constituted a deemed refusal of access under subsection 10(3) of the ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld investigation reports into the deaths of two individuals under subsection 16(1)(a) of the Access to Information Act. The OIC found that the RCMP met all requirements for this exemption and reasonably exercised its discretion in withholding the information. The Commissioner recommended legislative amendments to allow disclosure of personal information about deceased individuals for compassionate reasons.

• Proper application of exemption 16(1)(a) (investigative bodies)
• Reasonable exercise of discretion by the institution
• Consideration of disclosure for compassionate reasons
• Overlap between the Privacy Act and Access to Information Act for deceased individuals