Federal (Canada) Privacy Decisions

The complainant alleged that Indigenous Services Canada (ISC) did not conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit, including a "detailed review" and related proposals and reviews. ISC initially claimed the "detailed review" was verbal and no records existed. However, further investigation revealed ISC had not conducted an adequate search, and a subsequent search located at least 170 pages of responsive documents. The Information Commissioner found the complaint well-founded and ordered ISC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Existence of records for "detailed review" mentioned in an internal briefing note
• Scope and completeness of the search efforts

The complainant alleged that Health Canada improperly withheld records related to Dukoral under various ATIA exemptions, including personal information, third-party commercial information, and solicitor-client privilege. While some exemptions like solicitor-client privilege were upheld, the Commissioner found that Health Canada did not sufficiently demonstrate that information withheld under commercial and advice/recommendations exemptions met the required criteria. The Commissioner ordered Health Canada to disclose specific information previously withheld.

• Confidential third-party commercial, financial, scientific or technical information (s. 20(1)(b))
• Financial impact on a third party (s. 20(1)(c))
• Advice or recommendations (s. 21(1)(a))
• Solicitor-client privilege (s. 23)

Immigration, Refugees and Citizenship Canada (IRCC) contravened the Privacy Act when an employee inadvertently sent 497 emails containing personal information to the wrong email addresses. The investigation found that IRCC had insufficient administrative and procedural controls to prevent such errors. While IRCC took steps to notify affected individuals and mitigate harm, the Office of the Privacy Commissioner recommended improvements to prevent future breaches. IRCC accepted these recommendations and implemented enhanced measures, leading the OPC to consider the matter resolved.

• Whether IRCC contravened section 8 of the Privacy Act by disclosing personal information to unintended recipients.
• Adequacy of IRCC's administrative and procedural controls to prevent accidental disclosures.
• Effectiveness of IRCC's measures to mitigate the impact of the breach on affected individuals.
• Sufficiency of IRCC's actions to reduce the risk of recurrence.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) did not conduct a reasonable search for records related to the Wood Mountain (Lakota) First Nation land claim. While CIRNAC initially provided records from 2017 onwards, OIC investigation and research revealed potential missing records from 2009 to 2016. Following further searches prompted by the OIC, CIRNAC located additional records. The Information Commissioner found the complaint well-founded and ordered CIRNAC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Identification and location of all records responsive to the access request
• Completeness of the records provided to the complainant