Federal (Canada) privacy & access decisions

The complainant alleged that Transport Canada improperly withheld information under several provisions of the Access to Information Act related to a vessel-seaplane collision. Transport Canada initially claimed exemptions under paragraphs 16(1)(c), 19(1), 20(1)(b), 20(1)(d), and 21(1)(b). During the investigation, the complainant narrowed the scope, and Transport Canada dropped its reliance on 16(1)(c) and 21(1)(b). The Commissioner found that Transport Canada could not justify most of its claims under 20(1)(b) and 20(1)(d), except for a limited amount of information under 20(1)(b) that met all four requirements. Furthermore, Transport Canada failed to demonstrate that it had considered its obligation to exercise discretion under subsection 20(6) for the information that did meet the 20(1)(b) exemption. The Commissioner ordered Transport Canada to disclose the information for which exemptions were not justified and to properly exercise its discretion for the remaining information. Transport Canada indicated it would likely comply with the order, and the complaint was found to be well founded.

• Whether s.16(1)(c) ATIA (conduct of investigations) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether Transport Canada reasonably exercised its discretion under s.20(6) ATIA for information meeting s.20(1)(b)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to the management of the government's parliamentary agenda. Initially, PCO's Offices of Primary Interest (OPIs) provided nil responses, leading PCO to inform the complainant that no relevant records were found. However, the complainant provided detailed reasons why records should exist, prompting the OIC to request further representations from PCO. During the OIC's investigation, PCO conducted additional searches, which located 26 pages of relevant records that were not found in the initial search because they were stored in a PCO-ATIP library rather than directly by the OPI. The Commissioner found that PCO had not conducted a reasonable search initially. Consequently, the complaint was deemed well-founded, and PCO was ordered to process and release the newly found records.

• Whether the institution conducted a reasonable search for records under s.30(1)(a) ATIA

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act, concerning Joint Intelligence Committee Intelligence for NORAD records from 1958-63. During the investigation, LAC provided two supplementary releases of previously withheld information. The Office of the Information Commissioner (OIC) determined that NORAD qualifies as an international organization of states for the purposes of paragraph 13(1)(b). The OIC found that not all information initially exempted by LAC met the requirements of subsections 13(1) and 15(1), leading to a well-founded complaint. However, an order was deemed unnecessary because LAC had already released some information, and the remaining withheld information was found to properly meet the requirements of subsection 13(1).

• Whether information was properly withheld under s.13(1) ATIA
• Whether NORAD constitutes an international organization of states or an institution thereof for the purposes of s.13(1)(b) ATIA
• Whether information was obtained in confidence from a foreign state under s.13(1)(a) ATIA
• Whether information was obtained in confidence from an international organization of states under s.13(1)(b) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the circumstances in s.13(2) ATIA existed (consent or public availability)
• Whether information was properly withheld under s.15(1) ATIA

A former employee complained that Staples Canada ULC (Staples) failed to adequately protect and remove personal information from returned laptops before reselling them through its Openbox program. The complainant alleged that Staples lacked adequate internal policies, processes, and training for staff to wipe data from these devices. The OPC's investigation found deficiencies in Staples' policies, procedures, and training, and that employees did not consistently follow manufacturer guidelines for data wiping, leading to residual personal information on 23% of sampled devices. Staples agreed to implement recommendations to improve its data wiping procedures, training, and to arrange for independent third-party spot checks. The OPC concluded that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3.

• Whether Staples had adequate security safeguards to protect personal information on returned laptops under Principle 4.7.1 PIPEDA
• Whether Staples' methods of protection included adequate physical, organizational, and technological measures under Principle 4.7.3 PIPEDA
• Whether Staples' internal policies and procedures for data wiping were clear and consistent
• Whether Staples provided adequate training to employees responsible for wiping data from returned devices
• Whether Staples consistently performed full data wipes according to manufacturer instructions on returned laptops

An individual complained that a private swimming pool required parents to consent to the use of their children's photos and videos for promotional purposes as a condition of service for swimming lessons. The complainant argued this violated PIPEDA's consent requirements, specifically Principle 4.3.3, which prohibits requiring consent for information beyond what is necessary for the service. The swimming pool contended that the photo policy was a reasonable business need for promotion and staff training, and that tracking individual consent would be burdensome. The OPC found that images of children in swim attire are sensitive personal information and that requiring consent for promotional photos and staff training videos was not strictly necessary for providing swimming lessons. The OPC concluded that this practice contravened PIPEDA Principles 4.3.3 and 4.3.6. The complaint was found to be well-founded and resolved after the swimming pool agreed to implement an opt-in photo policy.

• Whether requiring consent for promotional photos and videos of children as a condition of service for swimming lessons contravenes Principle 4.3.3 of PIPEDA
• Whether images of children in swim attire constitute sensitive personal information
• Whether the collection, use, or disclosure of images for promotional or staff training purposes is strictly necessary for the provision of swimming lessons
• Whether the organization offered individuals a choice regarding the collection, use, or disclosure of images for promotional or staff training purposes
• Whether the organization should have sought express consent for the collection, use, or disclosure of images of children