Federal (Canada) Privacy Decisions

The complainant alleged that Transport Canada improperly withheld portions of a hazardous occurrence investigation report concerning the death of a CN employee, citing personal information (subsection 19(1)) and confidential third-party commercial/technical information (paragraph 20(1)(b)) exemptions. The Information Commissioner found that certain information, including train and track numbers and details in witness statements, did not meet the criteria for exemption under subsection 19(1). The Commissioner also found that Transport Canada did not adequately demonstrate that the information met the four requirements for exemption under paragraph 20(1)(b). Consequently, the Commissioner ordered Transport Canada to disclose specific withheld information.

• Whether certain information in the investigation report qualified as personal information under subsection 19(1) ATIA, considering the serious possibility of identification.
• Whether Transport Canada reasonably exercised its discretion to disclose information under subsection 19(2) ATIA.
• Whether certain information qualified as confidential third-party financial, commercial, scientific, or technical information under paragraph 20(1)(b) ATIA.
• Whether information was objectively confidential, originated in a reasonable expectation of confidence, and its disclosure was in the public interest.

The complainant alleged that Natural Resources Canada (NRCan) improperly withheld information related to a contract under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act. The OIC found that NRCan and the third party did not demonstrate that all the requirements for these exemptions were met for most of the withheld information. The Commissioner recommended disclosing all information except for a void cheque and the unit prices and quantities. NRCan disclosed some additional information but not all that was recommended, leading to the complaint being found well-founded.

• Whether information was confidential third-party financial, commercial, scientific or technical information under paragraph 20(1)(b) of the ATIA.
• Whether disclosing information could reasonably be expected to have a material financial impact on a third party or harm its competitive position under paragraph 20(1)(c) of the ATIA.
• Whether the institution met the requirements of the exemptions claimed.
• Whether the institution implemented the Commissioner's recommendation.

An institution applied for approval to decline to act on three access requests, arguing they were made in bad faith and constituted an abuse of the right to access information. The requests sought records containing a list of offensive words over a three-year period. The Commissioner found that the institution had fulfilled its duty to assist the requester and that the requests, due to their breadth, volume, and the specific keywords used, were indeed an abuse of the right of access, warranting approval to decline acting on them.

• Whether the institution met its duty to assist the requester.
• Whether the access requests constituted an abuse of the right to access information.
• The appropriateness of using vulgar and offensive keywords in access requests.
• The cumulative burden of multiple requests from the same requester.

An institution applied to the Information Commissioner seeking approval to decline an access request, arguing it was an abuse of the right to access information and vexatious. The institution also claimed it fulfilled its duty to assist the requester. The Commissioner found the institution did meet its duty to assist but failed to provide sufficient evidence that the request was an abuse of process or vexatious. Therefore, the application to decline the request was not granted.

• Whether the institution met its duty to assist the requester.
• Whether the access request constituted an abuse of the right to make a request.
• Whether the access request was vexatious.

The complainant alleged that National Defence failed to conduct reasonable searches for records related to specific contracts under the Access to Information Act. The OIC found that National Defence had not attempted to retrieve records from a third-party contractor and had not searched all likely locations, such as a cloud-based platform. Consequently, the OIC ordered National Defence to conduct further searches, process any responsive records found, and provide updated responses to the complainant.

• Reasonableness of search efforts
• Definition of 'control' over records
• Failure to retrieve records from third-party contractor
• Deficiencies in records management

The complainant alleged that Parks Canada improperly withheld records concerning the Grassy Mountain Coal Project. The withheld information was claimed to be exempt under provisions related to personal information, advice and recommendations, and litigation privilege. The Information Commissioner found that while some information initially withheld under paragraph 21(1)(a) should have been disclosed, it was released during the investigation. The Commissioner was satisfied that the remaining withheld information met the criteria for the other exemptions claimed. The complaint was ultimately found to be well-founded.

• Whether information was properly withheld under subsection 19(1) (personal information).
• Whether information was properly withheld under paragraph 21(1)(a) (advice or recommendations).
• Whether information was properly withheld under section 23 (litigation privilege).
• Whether the institution properly excluded records deemed not relevant based on the complainant's prior agreement.

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all records sought under the Privacy Act. The investigation found that IRCC did not initially conduct a reasonable search for records, particularly concerning visa cancellations and reissuing. However, IRCC subsequently expanded its search to include all relevant offices, and although no additional information was found, the OPC was satisfied that its obligations under the Act were met, resolving the complaint.

• Reasonableness of IRCC's search for records.
• Whether IRCC failed to disclose all responsive information.
• Adequacy of IRCC's search scope and tasked offices.

An individual complained that Canada Post was using personal information collected from the outside of delivered mail to create marketing lists rented to private sector companies. The Office of the Privacy Commissioner of Canada (OPC) found that Canada Post's collection and use of this information for marketing purposes contravened section 5 of the Privacy Act because individuals were not authorized to have their information indirectly collected and used this way. While Canada Post disagreed with the findings and did not agree to cease the practice, it committed to improving transparency about its data usage.

• Whether Canada Post's collection of personal information from mail for marketing purposes complies with section 4 of the Privacy Act.
• Whether Canada Post's use and disclosure of personal information for marketing purposes complies with sections 7 and 8 of the Privacy Act.
• Whether Canada Post's indirect collection of personal information for marketing purposes, without explicit authorization, contravenes section 5 of the Privacy Act.
• What constitutes valid authorization for indirect collection of personal information under the Privacy Act.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to correspondence with a third party, citing personal information and third-party business and financial information exemptions. DFO and the third party conceded that two exemptions were improperly applied, and the Information Commissioner found that the remaining exemption for confidential third-party information was not met. The Commissioner ordered DFO to disclose the information.

• Application of subsection 19(1) (personal information)
• Application of paragraphs 20(1)(a) (trade secrets) and 20(1)(c) (financial impact on third party)
• Application of paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Confidentiality criteria for paragraph 20(1)(b)

This investigation concerned an individual's complaint that their Permanent Resident Card renewal application, submitted to Immigration, Refugees and Citizenship Canada (IRCC), was inappropriately disclosed to the Canada Border Services Agency (CBSA). The complainant alleged this disclosure was contrary to the purpose for which the information was collected and that it was used in support of a cessation application to terminate refugee protection. The OPC found that the disclosure was consistent with the purpose for which the information was obtained, as both departments share a mandate under the Immigration and Refugee Protection Act and information sharing for immigration legislation enforcement is considered a consistent use. Therefore, the complaints against both departments were found not well-founded.

• Whether IRCC was authorized to disclose the complainant's personal information to the CBSA.
• Whether the disclosure was for a purpose for which the information was obtained or a consistent use.
• The interpretation of "consistent use" under paragraph 8(2)(a) of the Privacy Act.
• The impact of the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB).

The complainant alleged that the Public Health Agency of Canada (PHAC) did not conduct a reasonable search for records concerning the fee schedule or dispersal of payments to provinces and territories under a specific section of the Budget Implementation Act. During the OIC's investigation, PHAC re-searched and found approximately 104 additional responsive pages. The Information Commissioner concluded the initial search was not reasonable but was satisfied after the additional retrieval.

• Reasonableness of the search conducted by PHAC
• PHAC's obligation to identify and locate all responsive records

The complainant alleged the National Capital Commission (NCC) improperly withheld records concerning renovation projects at Rideau Hall under various provisions of the Access to Information Act. While the NCC initially cited exemptions related to facilitating offences and negotiations, the investigation focused on the personal information exemption. The NCC eventually disclosed some information it had withheld, but the Commissioner found that the remaining personal information, including an employee's name, title, and contact details, did not meet the exemption criteria. Furthermore, the NCC failed to reasonably exercise its discretion regarding publicly available personal information. The Commissioner ordered the NCC to disclose the information and to properly exercise its discretion.

• Whether the NCC properly applied the personal information exemption (subsection 19(1)) to employee contact information.
• Whether the NCC reasonably exercised its discretion to disclose publicly available personal information.
• Whether certain information qualified as personal information under subsection 19(1) or was excluded under paragraph 3(j) of the Privacy Act.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information from rail industry workplace fatality investigation reports under several Access to Information Act exemptions. The Information Commissioner found the complaint to be well-founded. The Commissioner ordered ESDC to disclose information that did not meet the exemption criteria and to re-exercise its discretion where it had not been adequately demonstrated. ESDC indicated it would implement the order.

• Application of exemption 16(1)(c) to investigation reports
• Definition and application of personal information exemption 19(1) to deceased individuals
• Justification for withholding third-party commercial/technical information under 20(1)(b)
• Assessment of financial impact and competitive harm to third parties under 20(1)(c)

The complainant alleged that CMHC improperly withheld records concerning the Canada Mortgage Bonds (CMB) and National Housing Act Mortgage-Backed Securities (NHA MBS) programs, citing several exemptions including government and third-party financial information. While CMHC justified withholding some information under exemptions for government financial/technical information and material available for purchase, it failed to provide sufficient justification for withholding third-party information under paragraph 20(1)(b). The Information Commissioner ordered CMHC to disclose this third-party information.

• Application of paragraph 18(a) to government financial, commercial, scientific or technical information
• Application of paragraph 20(1)(b) to confidential third-party financial, commercial, scientific or technical information
• Application of paragraph 68(a) to material available for purchase
• Reasonableness of CMHC's discretion in withholding information

The complainant alleged that Agriculture and Agri-Food Canada (AAFC) improperly withheld information related to communications about pig care standards. The information was claimed to be exempt under personal information (subsection 19(1)) and confidential third-party information (paragraph 20(1)(b)) exemptions. While some information was disclosed during the investigation, and the Commissioner found the remaining personal information properly withheld, the Commissioner determined that the information withheld under paragraph 20(1)(b) did not meet the exemption criteria. Therefore, the complaint was found to be well-founded.

• Control of records
• Application of subsection 19(1) (personal information)
• Application of paragraph 20(1)(b) (confidential third-party information)