Federal (Canada) Privacy Decisions

A formal investigation by the Office of the Privacy Commissioner of Canada concluded that Aboriginal Affairs and Northern Development Canada (AANDC) and the Department of Justice Canada wrongly collected personal information from activist Cindy Blackstock's personal Facebook page. The departments argued that information posted publicly on social media was not private, but the OPC rejected this argument, stating that public availability does not make information non-personal. The OPC recommended that both departments cease accessing personal information on social media without a direct link to government business and destroy improperly collected information, with both departments accepting the recommendations.

• Whether personal information posted on a public Facebook page is still considered private under the Privacy Act.
• Whether the collection of personal information from social media feeds was directly related to a government operating program or activity.
• Whether the departments' accessing of Indian status records was justified.

The OPC investigated a complaint about an RCMP officer who accessed the CPIC database to conduct a criminal background check on a prospective tenant for a private rental. The investigation found the officer used the database for personal reasons, not for a legitimate law enforcement purpose. The RCMP took remedial actions, including an apology and a reminder to employees about database use policies, which satisfied the OPC.

• Unauthorized access to the CPIC database
• Use of personal information for non-law enforcement purposes
• Compliance with RCMP policies on database access

An inmate at a maximum-security penitentiary requested video recordings of incidents involving officers. The Correctional Service of Canada (CSC) denied access, citing third-party information and security concerns. The OPC found complaints regarding 16 destroyed videos to be well-founded, as CSC had not even reviewed them before denial. For two other videos, which CSC claimed contained third-party information and posed security risks, the OPC found CSC correctly applied exemptions, thus resolving those complaints.

• Timeliness of responding to access to information requests
• Destruction of records prior to fulfilling requests
• Application of exemptions for security of penal institutions
• Proper review of records before withholding information

An estranged wife, employed as a civilian at a Canadian Forces Base, accessed her husband's medical records without authorization. She also deleted a physiotherapy appointment and accessed a paper file. The Department of National Defence (DND) determined this was a willful breach of rules and implemented restrictions on her access. The OPC found the complaint to be well-founded, as the access was inconsistent with the original purpose of the information and not a permissible use under the Privacy Act.

• Unauthorized access to medical records
• Access and use inconsistent with original purpose
• Willful breach of departmental rules

Transport Canada denied a man's security clearance based on information from the RCMP. The man complained that the RCMP improperly disclosed his personal information, specifically details of an absolute discharge from a 2009 incident. The RCMP disclosed this information without the required ministerial approval, which contravened the Criminal Records Act.

• Disclosure of personal information by the RCMP.
• Compliance with the Criminal Records Act regarding absolute discharges.
• Authorization for disclosure of information for security clearances.

The complainant alleged that the Canada Revenue Agency (CRA) contravened the Privacy Act by improperly accessing his tax file. The investigation found that a CRA employee accessed the complainant's tax file without authorization and beyond the requirements of their position. The CRA has since confirmed the employee no longer has access to taxpayer information.

• Unauthorized access to personal information
• Contravention of use and disclosure provisions of the Privacy Act

A complainant expressed concern that the online publication of her full name and date of birth in the Canada Gazette, as required by the agreement establishing the Qalipu Mi’kmaq First Nation Band, put her at risk of identity theft. The Office of the Privacy Commissioner of Canada (OPC) investigated and found that the disclosure was consistent with the Privacy Act, as the information was published for the purpose for which it was originally collected: the identification and recognition of Band members. Therefore, the complaint was not well-founded.

• Disclosure of personal information without consent
• Purpose of collection and disclosure
• Risk of identity theft

A complainant alleged that Correctional Service of Canada (CSC) denied him access to the full version of a report concerning his treatment and supervision. CSC initially provided a condensed version, which the OPC found to be a misrepresentation of the information and contrary to CSC's obligations under the Privacy Act. Following the OPC's investigation, CSC provided the complainant with the full report, with some personal information of other parties withheld, and committed to reviewing its access request handling procedures and communicating staff obligations under the Privacy Act.

• Was the respondent in compliance with its obligations to identify and provide all relevant information in response to an access request?
• Whether the respondent's provision of an abbreviated report was a misrepresentation of the information.

The Office of the Privacy Commissioner investigated a complaint from an individual whose personal health information was accessed by an employee of National Defence. The investigation found that the employee improperly accessed the complainant's health records for personal reasons, not for any professional or authorized purpose. National Defence has since implemented new controls, updated policies, and provided training to its healthcare staff to prevent future breaches.

• Inappropriate access to personal health information
• Use of personal information for personal reasons
• Adequacy of National Defence's privacy training and controls