Federal (Canada) privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act, concerning investigation reports into the deaths of two individuals. The RCMP demonstrated that the records met the requirements for exemption under s.16(1)(a), as they were created less than 20 years prior, obtained by an investigative body during a lawful investigation into crime detection/suppression and law enforcement. The Commissioner found that the RCMP reasonably exercised its discretion not to disclose the information, having considered relevant factors including investigative integrity and privacy. While acknowledging the RCMP's correct application of the Act, the Commissioner noted a gap in the legislation regarding the disclosure of deceased individuals' personal information for compassionate reasons. The complaint was ultimately found not well founded.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the information concerned an investigation related to the detection, prevention or suppression of crime or the enforcement of any law of Canada or a province
• Whether the records were created less than 20 years before the access request was made
• Whether the institution reasonably exercised its discretion to decide whether to disclose the information

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to respond to an access request within the 30-day statutory period. The request sought specific documents related to a briefing note on litigation, some of which had been previously released. The investigation confirmed that CIRNAC did not respond by the deadline, leading to a deemed refusal of access under subsection 10(3) of the Act. The Information Commissioner found the delay by the Resolution & Partnerships unit in retrieving records, despite multiple follow-ups from the ATIP office, to be unacceptable. The Commissioner ordered CIRNAC to complete record retrieval and provide a full response within 36 business days. Additionally, the Commissioner recommended that CIRNAC develop proper processes and performance indicators to ensure timely record provision by its Offices of Primary Interest. CIRNAC agreed to implement the order but did not commit to the recommendations. The complaint was found to be well founded.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution is deemed to have refused access to the requested records under subsection 10(3) of the Act
• Whether the delay by the Office of Primary Interest (Resolution & Partnerships unit) in retrieving records was acceptable

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the extended time limit, constituting a deemed refusal under the Access to Information Act. The request sought historical records related to the Canadian Intelligence Program and the Joint Intelligence Organization. The investigation confirmed that LAC did not respond by the extended deadline of February 13, 2020, for a request received in July 2019. Despite the records comprising 135 pages and a consultation with Global Affairs Canada being completed, LAC had not finalized processing the request almost five years later. The Information Commissioner found the delay unacceptable and ordered LAC to provide a complete response within 36 business days. However, LAC notified the Commissioner that it would not implement the order due to workload prioritization, stating the records required careful review and further consultation.

• Whether Library and Archives Canada responded to the access request within the extended time limit under subsection 9(1) of the Access to Information Act
• Whether Library and Archives Canada is deemed to have refused access under subsection 10(3) of the Act due to delay

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to "Ops 3" and "Ops 4" files under the Access to Information Act. Initially, PCO provided only two pages, which were a Records Retention and Disposal Authority form, not the requested operational records. The Office of the Information Commissioner (OIC) found that PCO's initial search was inadequate, particularly as no documents from specific Interdepartmental Committee on Security and Intelligence files, which were known to exist, were located. Following the OIC's intervention, PCO conducted a subsequent search and identified 251 additional responsive pages. The Commissioner concluded that the complaint was well founded because PCO did not conduct a reasonable search initially. PCO was ordered to complete the retrieval and processing of all responsive records and provide a supplementary response to the access request by December 22, 2024. PCO has committed to implementing this order.

• Whether the Privy Council Office conducted a reasonable search for records responsive to the access request

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request for emails, text messages, and briefing notes related to companies working on the ArriveCAN application. The complainant specifically questioned the absence of text messages in the records provided. The Office of the Information Commissioner (OIC) investigated CBSA's search efforts, including the program areas involved, search parameters, and policies regarding text message management. CBSA explained that text messages are often considered transitory, especially if followed by an email, and that employees are responsible for saving non-transitory messages to a corporate repository. The OIC found that the Offices of Primary Interest conducted searches in appropriate repositories and that it was reasonable to believe that relevant text messages either did not exist or were not considered relevant at the time of the request, in line with CBSA and Treasury Board Secretariat policies. Consequently, the Information Commissioner concluded that CBSA conducted a reasonable search.

• Whether the Canada Border Services Agency conducted a reasonable search for records
• Whether text messages related to the ArriveCAN application existed and should have been provided
• Whether CBSA's information management policies regarding text messages were appropriately applied

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records from the Deputy Minister’s Office concerning the funding or fiscal management of the Assembly of First Nations between January 1, 2016, and April 1, 2019. The investigation revealed that CIRNAC's initial search was inadequate, as it did not task all relevant sectors despite internal recommendations and evidence suggesting the existence of more records. Specifically, the Policy and Strategic Direction (PSD) sector and the Audit and Evaluation sector were not initially tasked, even though the Deputy Minister's Office suggested their relevance. Furthermore, CIRNAC did not adequately explain why records from PSD prior to 2017 were inaccessible or why there was a paucity of records despite the Deputy Minister's known involvement in related discussions. The Commissioner concluded that CIRNAC did not conduct a reasonable search and ordered the institution to perform a new search and provide a revised response.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records from the Deputy Minister’s Office relating to funding or fiscal management of the Assembly of First Nations from January 1, 2016 to April 1, 2019
• Whether all relevant sectors were tasked in the search
• Whether the inaccessibility of records prior to 2017 was adequately explained
• Whether the paucity of located records was reasonable given the Deputy Minister's involvement

The complainant alleged that Health Canada failed to respond to an access request within the 30-day statutory period, as required by section 7 of the Access to Information Act. The request sought internal and external records related to a Regulatory Impact Analysis Statement for the Regulations Amending the Tobacco Products Regulations. Health Canada acknowledged that it had not responded by the deadline and was deemed to have refused access under subsection 10(3). The institution identified 20,250 pages of responsive records and indicated that extensive consultations with its Legal Services Unit, 10 other government departments, and 25-30 third parties would be required. Health Canada proposed a response date of July 17, 2030, citing the volume and complexity of records, and workload. The Commissioner found this proposed timeline unreasonable given the significant delay already incurred and the complainant's denied access rights. The Commissioner ordered Health Canada to provide a complete response by April 7, 2026, which the institution agreed to implement.

• Whether Health Canada responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether Health Canada's proposed response date of July 17, 2030, was reasonable

The complainant, a father involved in a custody dispute, submitted an ATIP request to Immigration, Refugees and Citizenship Canada (IRCC) for his minor child's passport application, which had been submitted by his former spouse. He provided a court order authorizing him to obtain his children's information from third parties. IRCC denied the request, stating that the child's consent was required. The complainant alleged that IRCC improperly denied access despite the court order. The OPC investigated whether the complainant had a right of access under paragraph 10(a) of the Privacy Regulations, which allows access on behalf of a minor under certain conditions. The OPC found that while the child was a minor and the complainant had legal authorization to administer the child's affairs, the request was not made on the child's behalf, but rather for the complainant's own interests. Therefore, the third condition of paragraph 10(a) was not met, and IRCC's denial was deemed reasonable.

• Whether the complainant had a right of access to his child’s personal information under section 10 of the Privacy Regulations
• Whether the child was a minor at the time of the ATIP request
• Whether the complainant had legal authorization to administer the child's affairs
• Whether the complainant exercised the right of access on the minor’s behalf
• Whether the child had the decision-making capacity to provide consent for the release of their personal information

The complainant alleged that National Defence (DND) improperly withheld information under subsection 19(1) (personal information) of the Access to Information Act and failed to conduct a reasonable search for records. The request sought records related to the funding of a medical residency training program. DND conceded that it had not properly applied subsection 19(1) in all instances and issued a supplementary disclosure, with the Commissioner finding the remaining withholdings appropriate. However, the Commissioner concluded that DND did not conduct a reasonable search initially, as additional records were found during the investigation, and some responsive records that should have existed were not retained. The Commissioner recommended DND ensure employees receive training and support on information management responsibilities. DND agreed to implement the recommendations and shared a plan for improving records management practices. The complaint was found to be well founded.

• Whether information was properly withheld under subsection 19(1) ATIA
• Whether the information met the requirements of subsection 19(1) ATIA
• Whether DND reasonably exercised its discretion under subsection 19(2) ATIA
• Whether DND conducted a reasonable search for records
• Whether DND failed to pursue inquiries to locate all responsive records

The complainant alleged that Environment and Climate Change Canada (ECCC) failed to respond to an access request within the extended timeframe, as required by subsection 9(1) of the Access to Information Act. The request sought records concerning meetings and lobbying efforts of Pathways Alliance Inc. between January 14, 2023, and May 4, 2023. ECCC received the request on May 4, 2023, and extended the response period by 120 days, setting a new deadline of October 10, 2023, which it failed to meet. The investigation revealed that delays were primarily due to two offices of primary interest (OPIs) taking over 10 months to retrieve responsive records. The Commissioner found this delay unacceptable and concluded that ECCC did not meet its obligations under the Act. The complaint was found to be well founded, and ECCC was ordered to provide a complete response by August 7, 2024, and was given recommendations to improve internal processes.

• Whether Environment and Climate Change Canada responded to the access request within the extended period under subsection 9(1) of the Access to Information Act
• Whether the delay in responding was attributable to a lack of responsiveness from Offices of Primary Interest (OPIs)

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day statutory period for documents related to Operation Safe Haven. The OIC found that DND did not respond by the deadline and was deemed to have refused access under subsection 10(3) of the Act. The delay was attributed to the Canadian Forces Intelligence Command (CFINTCOM), an Office of Primary Interest (OPI), which failed to provide responsive records in a timely manner. The Commissioner concluded that this delay was unacceptable and affected DND's ability to meet its obligations under the Act. The complaint was found to be well founded, and DND was ordered to provide a complete response within 60 business days. The Commissioner also recommended DND develop better processes and accountability measures for OPIs regarding timely record provision.

• Whether National Defence responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether National Defence was deemed to have refused access to the requested records pursuant to subsection 10(3) of the Act
• Whether the delay by the Canadian Forces Intelligence Command (CFINTCOM) in retrieving records was acceptable

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day statutory period for all documents relating to the course of action of Operation Aegis. The OIC found that DND received the request on September 1, 2023, and did not extend the response period or transfer the request, making the deadline October 1, 2023. DND failed to respond by this date, leading to a deemed refusal under subsection 10(3) of the Act. The investigation revealed that delays were primarily due to the Canadian Forces Intelligence Command (CFINTCOM), one of DND's Offices of Primary Interest (OPIs), which had not yet provided all responsive records to the Departmental Access to Information and Privacy (DAIP) office. The Commissioner deemed CFINTCOM's delay unacceptable and emphasized the collective responsibility of the institution to ensure timely access to information. The complaint was found to be well-founded, and DND was ordered to provide a complete response within 60 business days.

• Whether National Defence responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether National Defence validly extended the 30-day period under section 9 of the Access to Information Act
• Whether National Defence is deemed to have refused access to the requested records under subsection 10(3) of the Access to Information Act
• Whether the delay by the Office of Primary Interest (Canadian Forces Intelligence Command) in retrieving records was acceptable

An institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act, arguing the request was both an abuse of the right to make a request and vexatious. The request sought emails from three employees containing specific keywords and the HR file of one employee. The institution claimed it had fulfilled its duty to assist the requester by engaging in numerous communications to clarify and narrow the request. The Commissioner found that the institution had indeed made every reasonable effort to assist the requester. However, the Commissioner determined that the institution failed to provide clear and compelling evidence that the request constituted an abuse of the right of access or was vexatious. The Commissioner noted that seeking information related to government employees is not inherently abusive and that the institution did not adequately substantiate claims of undue burden or privacy invasion. Consequently, the application to decline to act on the request was denied.

• Whether the institution met its obligation to assist the requester under subsection 4(2.1) ATIA
• Whether the access request is an abuse of the right to make a request under subsection 6.1(1) ATIA
• Whether the access request is vexatious under subsection 6.1(1) ATIA

The complainant alleged that the Social Sciences and Humanities Research Council of Canada (SSHRC) improperly withheld information related to the Canada Research Chairs’ Equity, Diversity and Inclusion (EDI) Public Accountability and Transparency Requirements under several sections of the Access to Information Act. Initially, SSHRC claimed exemptions under s.16(2)(c), s.19(1), s.20(1)(c), s.20(1)(d), s.21(1)(a), and s.21(1)(b). During the investigation, the s.16(2)(c) claim was removed from the scope, and SSHRC additionally relied on s.20(1)(b). The Commissioner found that SSHRC appropriately withheld information under s.19(1) (personal information) and parts of s.21(1)(a) and s.21(1)(b) (advice/recommendations and consultations/deliberations), as the requirements for these exemptions were met and discretion was reasonably exercised. However, SSHRC failed to demonstrate that the information met the requirements for s.20(1)(b), s.20(1)(c), and s.20(1)(d) due to insufficient evidence of confidentiality, financial impact, or interference with negotiations. Consequently, the Commissioner ordered SSHRC to disclose all redacted information except that falling under s.19(1), s.21(1)(a), and s.21(1)(b). SSHRC agreed to implement the order, and the complaint was found to be well founded.

• Whether s.16(2)(c) facilitating the commission of an offence applied to the withheld information
• Whether s.19(1) personal information applied to the withheld information
• Whether SSHRC reasonably exercised discretion under s.19(2)
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information applied to the withheld information
• Whether s.20(1)(c) material financial impact on a third party applied to the withheld information
• Whether s.20(1)(d) interference with contractual or other negotiations of a third party applied to the withheld information
• Whether s.21(1)(a) advice or recommendations applied to the withheld information
• Whether s.21(1)(b) accounts of consultations or deliberations applied to the withheld information
• Whether SSHRC reasonably exercised discretion under s.21(1)