Federal (Canada) Privacy Decisions

An institution applied to the Information Commissioner for approval to decline an access to information request, arguing it was vexatious and an abuse of the right to access records. The requester sought all emails, text messages, and computer files from three HR employees. The Commissioner found the request was overly broad, placed an undue burden on the institution, and impeded the rights of others, thus constituting an abuse of the right to access records. The Commissioner also found the institution had met its duty to assist the requester prior to making the application.

• Whether the access request constitutes an abuse of the right to make a request under subsection 6.1(1) of the ATIA.
• Whether the institution met its duty to assist obligations under subsection 4(2.1) of the ATIA.
• Whether the request was vexatious.

The Office of the Privacy Commissioner of Canada investigated Home Depot for disclosing customer email addresses and purchase details to Meta (Facebook) through Meta's "Offline Conversions" tool without valid consent. Home Depot used this tool to measure the effectiveness of its Facebook ads. The OPC found that Home Depot's privacy statement and Meta's policy were insufficient to obtain implied consent for this disclosure, as customers were not reasonably expected to understand that their data would be shared for these secondary purposes. Home Depot has since discontinued the use of the tool and agreed to implement recommendations for obtaining express consent should they restart the practice.

• Whether Home Depot obtained valid consent for disclosing customer purchase data to Meta.
• Whether the information disclosed was sensitive.
• Whether Home Depot's privacy statement and Meta's policies provided sufficient notice and clarity.
• Whether express opt-in consent should have been obtained.

The complainant requested information related to applications and Minimum Safe Manning (MSM) Documents for the passenger ship Queen of Cumberland. Transport Canada withheld information under subsections 19(1) (personal information) and 20(1)(b) (confidential third-party information). The complainant later withdrew the section 19(1) aspect of the complaint. The Information Commissioner found that Transport Canada failed to demonstrate that the withheld information met the requirements of paragraph 20(1)(b), ordering the disclosure of all information previously withheld under that provision.

• Whether the withheld information met the criteria for paragraph 20(1)(b) of the ATIA, specifically concerning its technical nature, confidentiality, whether it was supplied by a third party, and if it was consistently treated as confidential by the third party.
• Whether the information was publicly available or observable by passengers, impacting the confidentiality claim.
• Whether the MSI's handwritten notes and the completed MSMDs constituted information supplied by a third party.
• The third party's (BC Ferries) lack of position on the disclosure of the information.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to Canadian universities' engagement in the Federal Contractors Program. The withheld information was claimed under sections related to personal information, confidential third-party commercial information, and disclosure restricted by another law. The Information Commissioner found the complaint to be well-founded, determining that ESDC had not adequately demonstrated that all withheld information met the exemption criteria or that it had properly exercised its discretion. As a result, the Commissioner ordered ESDC to disclose the information at issue, and ESDC indicated it would implement the order.

• Whether information withheld under subsection 19(1) (personal information) was about identifiable individuals and whether discretion was properly exercised.
• Whether a completed Employment Equity Achievement Awards Application Form met the requirements for exemption under paragraph 20(1)(b) (confidential third-party commercial information).
• Whether information withheld under subsection 24(1) (disclosure restricted by another law) was properly withheld (this was removed from scope).
• Whether the institution properly severed non-exempt information from exempt information.

The complainant alleged that Trans Mountain Corporation (TMC) improperly responded to an access request by invoking section 10(2) of the Access to Information Act, refusing to confirm or deny the existence of records, and indicating that any responsive records would be withheld under section 16(2) (facilitating the commission of an offence). The Information Commissioner found that TMC failed to demonstrate that the existence of records itself warranted withholding, especially since TMC had previously acknowledged similar records. Furthermore, TMC did not sufficiently establish that any responsive records would meet the criteria for exemption under section 16(2).

• Proper application of section 10(2) (neither confirm nor deny existence of records)
• Whether the existence or absence of records can itself be information warranting withholding under the Act
• Whether records could reasonably be expected to facilitate the commission of an offence under section 16(2)
• TMC's inconsistent responses and blanket policy regarding record disclosure

The complainant alleged that the Royal Canadian Mounted Police (RCMP) did not conduct a reasonable search for records detailing annual amounts paid due to sexual harassment or assault from 2009 to 2020. The RCMP explained that its general ledger does not record the nature of settlement claims, and they do not maintain a separate list of such payments. Therefore, the RCMP could only identify and disclose information related to publicly known class action settlements. The Information Commissioner was satisfied that the RCMP conducted a reasonable search given these limitations.

• Whether the RCMP conducted a reasonable search for records.
• The ability of the RCMP to search its general ledger for specific types of claims.
• The existence of alternative methods for the RCMP to identify and locate responsive records.

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information related to the Roberts Bank Terminal 2 Project under several sections of the Access to Information Act, including those related to facilitating offences, personal information, third-party commercial information, and advice or deliberations. ECCC initially withheld records under these exemptions, including a scientific manuscript. During the investigation, ECCC agreed to release the manuscript and some other withheld information. The Information Commissioner found the complaint well-founded, ordering ECCC to disclose the manuscript and correct inconsistencies in disclosure.

• Applicability of exemption for facilitating the commission of an offence (s. 16(2) ATIA)
• Applicability of exemption for personal information (s. 19(1) ATIA)
• Applicability of exemption for confidential third-party scientific information (s. 20(1)(b) ATIA)
• Applicability of exemptions for advice and deliberations (ss. 21(1)(a) and 21(1)(b) ATIA)

The complainant alleged that the Department of Justice Canada improperly withheld records related to the Alternate Independent Process for St-Anne’s Residential School hearings. The records were claimed to be exempt under various sections of the Access to Information Act, including solicitor-client and litigation privilege (section 23). The Information Commissioner found that the Department did not adequately establish solicitor-client or litigation privilege for many of the withheld records, particularly those communicated outside the scope of the solicitor-client relationship or involving parties without sufficiently common interests. The Commissioner recommended the disclosure of information not meeting the exemption criteria.

• Applicability of solicitor-client privilege
• Applicability of litigation privilege
• Demonstration of common interest privilege
• Reasonable exercise of discretion to withhold records

The Office of the Information Commissioner (OIC) received a complaint alleging that a federal institution did not respond to an access request within an extended timeframe and raised concerns about the institution's communication conduct. The OIC accepted the complaint regarding the delay but found the complaint about inappropriate conduct inadmissible as it was filed outside the 60-day time limit. The OIC determined the time limit for the conduct complaint began on May 2, 2022, when the institution first communicated its proposed response, not when the extended response deadline passed.

• Timeliness of filing a complaint regarding alleged inappropriate communication
• Determination of when the 60-day time limit to file a complaint begins
• The impact of an institution's communication conduct on the complainant's awareness of grounds for complaint

The complainant alleged that Health Canada improperly withheld information from a non-clinical overview of the Novavax COVID-19 vaccine, citing exemptions for confidential third-party financial, commercial, scientific or technical information (paragraph 20(1)(b)). The Information Commissioner of Canada (OIC) found that the information met the criteria for exemption under paragraph 20(1)(b) at the time the request was processed. The OIC also concluded that the conditions under which Health Canada would be required to exercise discretion to release the information (subsections 20(5) and 20(6)) were not met. Therefore, the complaint was found not to be well founded.

• Whether the withheld information qualifies as confidential third-party financial, commercial, scientific or technical information under paragraph 20(1)(b) of the Access to Information Act.
• Whether the conditions for exercising discretion to release information under subsections 20(5) and 20(6) of the Access to Information Act were met.

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (Solicitor-client privilege) of the Access to Information Act. While the information met the requirements for solicitor-client privilege, LAC did not demonstrate it had reasonably exercised its discretion to decide whether to disclose the information. The Information Commissioner ordered LAC to re-exercise its discretion, considering all relevant factors. LAC agreed to implement the order.

• Whether the withheld information met the requirements for solicitor-client privilege.
• Whether LAC reasonably exercised its discretion to disclose the information.
• Consideration of the historical significance of the records and the mandate of Library and Archives Canada in exercising discretion.

Immigration, Refugees and Citizenship Canada (IRCC) inadvertently disclosed the email addresses of 636 individuals seeking emergency assistance related to the situation in Afghanistan. These individuals were included in the "TO" field of mass emails, rather than the "BCC" field, exposing their contact information to other recipients. The Office of the Privacy Commissioner of Canada (OPC) found that IRCC contravened section 8 of the Privacy Act due to insufficient controls to prevent such disclosures and that the complaint was well-founded. While IRCC took immediate steps to mitigate the breach, the OPC emphasized the need for robust preventative measures.

• Disclosure of personal information without consent
• Adequacy of preventative measures for mass emails
• Mitigation of harm to affected individuals
• Risk of recurrence of similar breaches

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly excluded weather radar data, claiming it was available for purchase. ECCC demonstrated that both real-time and archived weather data are offered through a cost-recovery system. As the information was available for purchase, it was excluded from the application of the Access to Information Act.

• Whether the exclusion of material available for purchase under paragraph 68(a) of the ATIA was properly applied.
• Whether real-time data, which must be created after the request is made, falls under the scope of the ATIA.
• Whether the cost-recovery system for accessing weather data renders the information 'available for purchase' under section 68(a).

The Information Commissioner determined that a complaint was inadmissible because it was not filed within the 60-day time limit required by section 31 of the Access to Information Act. The complainant argued that the time limit should start from when they recovered a deleted email from the institution, but the Commissioner found that the period for submitting the complaint began the day after the institution's response was received. The Act does not grant the Commissioner the power to extend this mandatory time limit.

• Timeliness of complaint submission under section 31 of the ATIA
• Interpretation of 'in any other case' in section 31
• Commencement date for the 60-day complaint period

The Office of the Privacy Commissioner investigated a complaint where the Canada Border Services Agency (CBSA) disclosed a workplace review report containing an individual's personal information to the Information Commissioner. The OPC found that while disclosing information related to the complainant's access to information requests was a consistent use, disclosing the workplace review report was not. The CBSA contravened the Privacy Act by disclosing this report without consent and for a purpose inconsistent with its original collection.

• Whether disclosing a workplace review report to the Information Commissioner constituted a 'consistent use' under paragraph 8(2)(a) of the Privacy Act.
• The distinction between information collected for managing workplace conflict versus information collected for responding to access to information requests.
• Whether the CBSA reasonably expected the disclosure of the workplace review report.