Federal (Canada) privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) and the UK Information Commissioner (ICO) jointly investigated a data breach at 23andMe Inc., a direct-to-consumer genetic testing company, which affected almost 7 million customers globally, including 319,000 in Canada. The investigation focused on the adequacy of 23andMe's security safeguards and its breach notification practices following a credential stuffing attack. The OPC found that 23andMe failed to implement appropriate safeguards, such as mandatory multi-factor authentication, robust compromised-password checks, and effective detection systems, given the highly sensitive nature of genetic and health information. Additionally, 23andMe's breach notifications to the OPC and affected individuals were deemed inadequate in content and timing, as they initially omitted crucial details like raw DNA data compromise and the data being offered for sale. However, 23andMe subsequently implemented significant security enhancements and updated its notification processes. Consequently, the OPC concluded both issues were well-founded but resolved due to the satisfactory corrective measures taken by the company. This report also highlighted the ongoing bankruptcy proceedings of 23andMe and the Commissioners' commitment to ensuring privacy obligations are met if customer data is transferred.

• Whether 23andMe had appropriate safeguards to protect highly sensitive personal information under its control, specifically against credential stuffing attacks.
• Whether 23andMe's prevention measures, including mandatory Multi-factor Authentication (MFA), compromised-password checks, and minimum password requirements, were adequate.
• Whether 23andMe's detection measures, including detection systems, digital fingerprinting, and device history, were adequate to identify ongoing attacks.
• Whether 23andMe adequately investigated anomalies and claims of breach prior to public disclosure.
• Whether 23andMe's breach response, including the timeliness of disabling active user sessions, disabling raw DNA download features, and implementing mandatory MFA, was adequate.
• Whether 23andMe adequately notified the OPC about the breach, including the completeness of information provided and timeliness.
• Whether 23andMe adequately notified affected individuals about the breach, including the completeness of information provided and timeliness.
• Whether the data breach created a real risk of significant harm to affected individuals, triggering notification obligations.
• Whether 23andMe's methodology for identifying and notifying individuals whose raw DNA was downloaded by the Threat Actor was adequate.

The complainant alleged that Canada Post improperly withheld information under subsections 19(1), 18.1(1), and paragraph 20(1)(b) of the Access to Information Act. The request sought a health and safety strategy report and related invoicing from DuPont Sustainable (DSS). The OIC found that Canada Post failed to demonstrate that the information withheld under paragraph 20(1)(b) met the requirements for confidentiality, third-party supply, or consistent confidential treatment. Similarly, for subsection 18.1(1), Canada Post did not show that the information constituted a trade secret or confidential financial/commercial information belonging to it, or that it was consistently treated as confidential. However, the OIC upheld the application of subsection 19(1) for personal contact information. The Information Commissioner ordered Canada Post to disclose the information improperly withheld under paragraph 20(1)(b) and subsection 18.1(1). Canada Post agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) ATIA (personal information) was properly applied to contact details
• Whether the information was about an individual
• Whether there was a serious possibility of identification
• Whether the information fell under exceptions to 'personal information' in the Privacy Act
• Whether s.19(2) ATIA circumstances (consent, public availability, consistency with Privacy Act s.8) existed
• Whether Canada Post reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied to invoice details
• Whether the information was financial, commercial, scientific or technical
• Whether the information was objectively confidential (not publicly available)
• Whether the information was objectively confidential (reasonable expectation of confidence)
• Whether the information was objectively confidential (relationship fostered for public benefit)
• Whether the information was supplied by a third party to a government institution
• Whether the third party consistently treated the information as confidential
• Whether s.18.1(1) ATIA (trade secrets or confidential financial, commercial, scientific or technical information of Canada Post) was properly applied to invoice and presentation content
• Whether the information constituted a 'trade secret'
• Whether the information was financial, commercial, scientific or technical information belonging to Canada Post
• Whether Canada Post consistently treated the information as confidential
• Whether s.18.1(2) ATIA (general administration exclusion) applied

The complainant alleged that Health Canada failed to respond to an access request within the statutory time limits. The request sought records from specific dates related to parliamentary proceedings concerning the Public Health Agency of Canada and the National Microbiology Laboratory. Health Canada received the request and extended the response period by 210 days, but failed to respond by the extended deadline, leading to a deemed refusal under subsection 10(3) of the Act. The investigation revealed that Health Canada had completed processing the request but then put the response on hold, citing ongoing investigations into the National Microbiology Laboratory incident. The Information Commissioner found that the Act does not authorize an institution to 'pause' a response pending an investigation, emphasizing that concerns about sensitive information should be addressed through the timely application of exemptions. Although the Commissioner initially intended to order a response, Health Canada subsequently provided one, rendering the order unnecessary. The complaint was found to be well founded.

• Whether Health Canada responded to the access request within the statutory time limits or extended period
• Whether Health Canada's decision to 'pause' the response to an access request pending an investigation is authorized under the Access to Information Act
• Whether a deemed refusal occurred under subsection 10(3) of the Act

The complainant alleged that Transport Canada failed to respond to an access request within the 30-day statutory period for records related to an Issue Paper on Human External Cargo via Helicopter. The investigation revealed that Transport Canada's Office of Primary Interest (OPI), Safety and Security, missed the initial tasking request for records, causing significant delays. Transport Canada was deemed to have refused access under subsection 10(3) of the Act due to its failure to respond within the statutory timeframe. The Information Commissioner ordered Transport Canada to provide a complete response to the access request. Although Transport Canada later advised the complainant that responsive records were being processed under a separate request, the Commissioner determined this did not constitute a "complete response" as it did not provide actual access or a denial with reasons. The Commissioner also recommended that the Minister of Transport develop processes to ensure timely record provision by OPIs and establish performance indicators for senior officials regarding delays. The complaint was found to be well founded.

• Whether Transport Canada responded to the access request within the 30-day period under section 7 of the ATIA
• Whether Transport Canada's referral to another access request constituted a complete response
• Whether the delay by the Office of Primary Interest (OPI) was acceptable