Federal (Canada) privacy & access decisions

The complainant alleged that Health Canada improperly withheld information related to a COVID-19 Vaccine Periodic Safety Update Report under sections 13(1), 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that Health Canada correctly applied section 13(1) and 19(1) to some information, but failed to reasonably exercise its discretion under section 13(2) for publicly available information. The Commissioner also found that Health Canada and the third party (Pfizer) did not establish that sections 20(1)(b) or 20(1)(c) applied. Consequently, the Commissioner ordered Health Canada to disclose information not covered by sections 13(1) or 19(1), and to re-evaluate the disclosure of section 13(1) information that is publicly available. Health Canada agreed to comply with the order.

• Whether s.13(1) ATIA applied to information obtained from the European Medical Agency (EMA)
• Whether Health Canada reasonably exercised its discretion under s.13(2) ATIA regarding publicly available information
• Whether s.19(1) ATIA applied to personal information that could identify individuals
• Whether Health Canada reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA applied to confidential third-party financial, commercial, scientific or technical information
• Whether s.20(1)(c) ATIA applied to information that could cause financial impact or harm competitive position to a third party

The OPC investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding its systematic practice of withholding access to certain personal information in its Global Case Management System (GCMS). IRCC's policy was to retrieve and process only a "Short Form" GCMS Report in response to access requests, even when individuals requested their entire file or specific content found in the "Long Form." The OPC found that the "History Section" of the GCMS file, which is part of the Long Form, contained the complainant's personal information and that IRCC's practice contravened Section 12 of the Privacy Act. While IRCC eventually provided the complainant with the requested Long Form, it did not agree to update its procedures to systematically retrieve and process the Long Form for all future requests. Consequently, the OPC found the complaint well-founded but not resolved, as IRCC had not committed to addressing the systemic issue.

• Whether IRCC's practice of providing only a "Short Form" GCMS Report in response to access requests contravenes Section 12 of the Privacy Act
• Whether the "History Section" of the GCMS file contains personal information
• Whether information in the "Long Form" GCMS Report is always exempt from disclosure
• Whether IRCC has an obligation to retrieve and process all records responsive to a Privacy Act request