Federal (Canada) Privacy Decisions

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information related to the lease or sale of its assets, citing exemptions under paragraphs 18(a), 18(b), 18(c), subsection 19(1), and paragraphs 20(1)(b), 20(1)(c) of the Access to Information Act. The request was specifically for company names and amounts. PAPA failed to demonstrate that the withheld information met the requirements of these exemptions. Consequently, the Information Commissioner ordered PAPA to disclose the requested information concerning company names and amounts.

• Whether PAPA improperly withheld information regarding company names and amounts under various sections of the Access to Information Act.
• Whether the withheld information met the criteria for exemptions under paragraphs 18(a), 18(b), 18(c), subsection 19(1), and paragraphs 20(1)(b), 20(1)(c) of the ATIA.
• Whether PAPA discharged its burden to prove that the exemptions applied to the withheld information.
• The confidentiality and commercial value of the leased premises information.

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld records related to the recovery strategy for the whitebark pine under several sections of the Access to Information Act. The Information Commissioner found that ECCC failed to demonstrate that certain exemptions were met, particularly regarding third-party information and the severing of factual information from exempt advice or deliberations. The Commissioner ordered ECCC to disclose specific records and re-exercise discretion on others, and ECCC agreed to comply with the order.

• Application of exemptions for personal information (s. 19)
• Application of exemptions for third-party information (s. 20(1)(b))
• Application of exemptions for advice/deliberations (s. 21(1)(a) and (b))
• Application of exemptions for federal-provincial affairs (s. 14)

This investigation concerned the loss of an unencrypted USB storage device by the Royal Canadian Mounted Police (RCMP), which contained sensitive personal information of 1,741 individuals. The OPC found that the RCMP contravened section 8 of the Privacy Act by disclosing personal information without consent. The investigation also revealed failures in timely breach reporting and inadequate safeguards for personal information on USB devices, leading to the complaint being well-founded and unresolved.

• Contravention of section 8 of the Privacy Act regarding unauthorized disclosure of personal information
• Timeliness and appropriateness of the RCMP's response to the breach
• Sufficiency of RCMP measures to safeguard personal information on USB storage devices
• Adequacy of policies and enforcement regarding USB device usage

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld records concerning cybersecurity and data breach risks associated with the ArriveCAN application, citing exemptions related to facilitating offences and third-party negotiations. During the investigation, CBSA disclosed some records but continued to withhold others under subsection 16(2) and claimed subsection 19(1) for personal information. The Information Commissioner found that while some information properly fell under subsection 16(2), other withheld information did not. Furthermore, CBSA failed to properly consider the disclosure of personal information under subsection 19(1). Although the complaint was found well-founded, the issue was resolved as CBSA released additional information and the complainant was satisfied.

• Applicability of subsection 16(2) (facilitating the commission of an offence)
• Applicability of paragraph 20(1)(d) (negotiations by a third party)
• Proper application of subsection 19(1) (personal information) and the discretion required under subsection 19(2)
• Procedural fairness regarding the submission of representations after an initial report

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld records containing communications between CBC and Twitter employees, citing exemptions related to the safety of individuals and personal information. The OIC found that the CBC failed to demonstrate that disclosing the requested information would reasonably be expected to threaten an individual's safety or facilitate the commission of an offence. The Commissioner ordered the CBC to disclose the withheld information.

• Whether the CBC properly applied section 17 (safety of individuals) to withhold records.
• Whether the CBC properly applied subsection 16(2) (facilitating the commission of an offence) to withhold records.
• Whether the CBC properly applied subsection 19(1) (personal information) to withhold records.
• The standard of proof for demonstrating a reasonable expectation of harm under sections 16(2) and 17.