Federal (Canada) privacy & access decisions

A military officer complained that the Department of National Defence (DND) inappropriately disclosed his personal medical information to the Department of Justice (DOJ), and that the DOJ inappropriately collected it, for litigation purposes. The complainant had initiated a lawsuit against DND, naming the Attorney General of Canada as respondent. DND disclosed the information, including physical and mental health files, to the DOJ in response to a document collection order for defending against the lawsuit. The OPC found that both the collection by DOJ and disclosure by DND were permissible under the Privacy Act, specifically paragraph 8(2)(d), as the disclosure was to the Attorney General for use in legal proceedings involving the Government of Canada. The OPC also noted that the Act makes no distinction based on the sensitivity of personal information and that doctor-patient confidentiality is not a general privilege in Canadian law. Both complaints were found to be not well-founded.

• Whether the collection of the complainant's personal medical information by the DOJ from the DND contravened the Privacy Act
• Whether the disclosure of the complainant's personal medical information by the DND to the DOJ contravened the Privacy Act
• Whether the collection by DOJ related directly to an operating program or activity of the institution under s.4 of the Privacy Act
• Whether the collection by DOJ was permissible under s.5(1) of the Privacy Act given the disclosure under s.8(2)(d)
• Whether the disclosure by DND was to the Attorney General of Canada under s.8(2)(d) of the Privacy Act
• Whether the disclosure by DND was for use in legal proceedings involving the Crown in right of Canada or the Government of Canada under s.8(2)(d) of the Privacy Act
• Whether the sensitivity of medical information impacts the permissibility of disclosure under the Privacy Act
• Whether doctor-patient confidentiality prevents disclosure under the Privacy Act for litigation purposes
• Whether the safeguarding measures for the disclosed information were adequate

The Office of the Privacy Commissioner of Canada (OPC) investigated over a hundred complaints against Statistics Canada concerning its Credit Information Project and Financial Transactions Project. These initiatives involved collecting detailed personal information from a credit bureau (TransUnion) and financial institutions without individuals' direct knowledge or consent. The OPC found that Statistics Canada had the legal authority under section 13 of the Statistics Act to collect information for the Credit Information Project, as TransUnion provided existing records, thus deeming this aspect of the complaints not well-founded. However, the OPC had serious concerns that the Financial Transactions Project, as originally designed, would have exceeded this authority by requiring financial institutions to create new records; no formal finding was made as the project was halted. While no contravention of the Privacy Act was found, the OPC identified significant privacy concerns regarding the necessity and proportionality of both projects, Statistics Canada's lack of transparency, and deficiencies in internal monitoring safeguards. Statistics Canada committed to implementing all six OPC recommendations, including redesigning both projects with privacy principles in mind, increasing transparency, and enhancing internal security measures. The OPC also called for legislative reform of the Statistics Act and Privacy Act to address modern data collection practices.

• Whether Statistics Canada's collection of personal information for the Credit Information Project was within its legal authority under section 13 of the Statistics Act.
• Whether Statistics Canada's proposed collection of personal information for the Financial Transactions Project, as originally designed, would have been within its legal authority under section 13 of the Statistics Act.
• Whether the collection of personal information for the Credit Information Project related directly to an operating program or activity of Statistics Canada under section 4 of the Privacy Act.
• Whether the collection of personal information for the Financial Transactions Project related directly to an operating program or activity of Statistics Canada under section 4 of the Privacy Act.
• Whether the Credit Information Project, as originally designed, met the principles of necessity and proportionality.
• Whether the Financial Transactions Project, as originally designed, met the principles of necessity and proportionality.
• Whether Statistics Canada provided adequate transparency to individuals regarding the collection of their personal information for the Projects.
• Whether Statistics Canada had appropriate safeguards, specifically regarding logging and monitoring for internal unauthorized access, to protect personal information collected via the Projects.
• Whether Statistics Canada's de-identification and encryption safeguards were adequate.
• Whether Statistics Canada had proper procedures for individuals to access their personal information.
• Whether there was a risk of personal information collected via the Projects being disclosed for secondary purposes.
• Whether Statistics Canada's Directive on Discretionary Disclosures adequately considered individuals' privacy interests when making disclosures under section 17(2)(a) of the Statistics Act.

The Office of the Privacy Commissioner of Canada (OPC) investigated six complaints against the Canada Border Services Agency (CBSA) regarding the examination of personal digital devices at ports of entry. Complainants, all Canadian citizens, questioned the CBSA's authority to conduct these searches. The OPC found that the CBSA contravened section 4 of the Privacy Act by exceeding its legal authority in one case (accessing online banking/social media) and section 6(1) by destroying records in two cases. Systemic issues were identified, including BSOs failing to follow CBSA's own policy on disabling internet connectivity, note-taking, and search thresholds. The OPC concluded all six complaints were well-founded and made several recommendations for operational changes and legislative reform. The CBSA accepted the operational recommendations, committing to new policies, mandatory training, oversight, and transparency, but disagreed with the legislative reform recommendations. Consequently, the operational issues are considered conditionally resolved.

• Whether CBSA's collection of personal information via digital device searches contravened section 4 of the Privacy Act.
• Whether the definition of "goods" under the Customs Act extends to electronic documents on digital devices.
• Whether CBSA's authority to search digital devices is limited to information stored on the device.
• Whether Border Services Officers (BSOs) complied with CBSA's internal policy (Operational Bulletin PRG-2015-31) regarding digital device examinations (e.g., airplane mode, note-taking, search threshold).
• Whether the copying of content from a digital device by a BSO was consistent with CBSA's legal authority and policy.
• Whether the CBSA complied with its obligations under subsection 6(1) of the Privacy Act to retain personal information used for administrative purposes.
• Whether the CBSA's practices regarding training, awareness, and accountability mechanisms for digital device searches were adequate.
• Whether the Customs Act requires amendment to include a clear legal framework and a higher threshold for digital device examinations.
• Whether the threshold for digital device examinations should be "reasonable grounds to suspect".

Three complaints alleged that Correctional Service Canada (CSC) improperly used video footage, collected for security, to monitor employee performance. The complainants provided emails from a correctional manager commenting on their patrols as evidence. CSC acknowledged using video for security and incident investigation but denied using it for performance monitoring. The OPC found that CSC reviewed the footage to identify systemic deficiencies in patrols following an inmate's death, aiming to improve security and prevent future deaths. The review was part of an action plan to address deficiencies identified in the death investigation. The OPC concluded that this use was consistent with the original purpose of collection, which was security, and therefore the complaints were not well-founded.

• Whether video footage of employees constitutes personal information under s.3 of the Privacy Act
• Whether CSC's use of video footage to review employee patrols constituted monitoring employee performance
• Whether CSC's use of video footage was for the purpose for which it was obtained or compiled, or for a use consistent with that purpose, as per s.7(a) of the Privacy Act

A Global Affairs Canada (GAC) employee complained that GAC contravened the Privacy Act by requesting the return of his diplomatic passport, which contained personal travel information, for an administrative investigation. The complainant argued that GAC's policy required him to use the diplomatic passport for both personal and work travel while posted abroad, and returning it would lead to an improper collection of his personal information. GAC contended that the diplomatic passport is government property and it had the authority to collect the information for an investigation into alleged misconduct. The OPC found that GAC failed to demonstrate how the personal travel history related directly to an operating program or activity, as required by the Privacy Act. Although no collection occurred because the complainant refused to return the passport, the OPC concluded that GAC lacked the authority to collect such personal information. The complaint was deemed well-founded, and the OPC recommended GAC clarify its policies and inform diplomatic passport users of the privacy implications.

• Whether the information in the diplomatic passport constitutes personal information under s.3 of the Privacy Act
• Whether Global Affairs Canada's request for the diplomatic passport constituted a collection of personal information
• Whether Global Affairs Canada demonstrated its authority to collect the personal travel information under s.4 of the Privacy Act
• Whether the collection of personal travel information related directly to an operating program or activity of Global Affairs Canada

The complainant alleged that Employment and Social Development Canada (ESDC) improperly collected his personal information a second time, despite his previous objection, through Grey House Publishing Canada for the Prime Minister’s Volunteer Awards program. ESDC maintained that it acquired the distribution list compliantly, relying on its contract with Grey House which stipulated compliance with Canadian legislation and consent. The OPC found that while ESDC was not required to collect the information directly for administrative purposes, it failed to ensure Grey House obtained proper consent as per their contract and continued to collect the complainant's information despite his explicit request to be removed. The OPC concluded that ESDC did not comply with section 4 of the Privacy Act.

• Whether the complainant's name, telephone number, and email address constitute personal information under the Act
• Whether ESDC was required to collect personal information directly from the complainant under section 5 of the Act
• Whether ESDC complied with section 4 of the Act regarding the collection of personal information
• Whether ESDC adequately ensured Grey House Publishing Canada complied with consent requirements as per their contract
• Whether ESDC improperly collected the complainant's information after he requested removal from the distribution list

The complainant, an air passenger rights advocate, requested access to all records about himself held by the Canadian Transportation Agency (CTA). The CTA initially withheld 760 pages, arguing that most references to the complainant's name were not personal information because he was acting on behalf of an organization. The OPC found that the information was indeed personal information, as the organization was not a separate legal entity and the records contained views and information directly about the complainant. The OPC also found that the CTA incorrectly applied exemptions under section 26 (third-party personal information) and subsection 70(1) (cabinet confidences) in some instances, and over-redacted under section 27 (solicitor-client privilege). The complaint was found to be well-founded, and the CTA agreed to implement the OPC's recommendations to disclose the withheld information.

• Whether information relating to the complainant's advocacy activities, where his name appears, constitutes personal information under section 3 of the Privacy Act
• Whether the CTA correctly invoked paragraph 12(1)(b) to deny access to information it deemed not to be personal information
• Whether the CTA correctly withheld third-party personal information under section 26 of the Privacy Act
• Whether the CTA correctly withheld information under section 27 of the Privacy Act (solicitor-client privilege)
• Whether the CTA correctly withheld information under subsection 70(1) of the Privacy Act (cabinet confidences)