Federal (Canada) Privacy Decisions

The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search for records related to a previous access request and a "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate a reasonable search was conducted. The Information Commissioner ordered PCO to conduct a new search and provide a supplementary response to the complainant.

• Reasonableness of the search conducted by the institution
• Sufficiency of documentation provided by the institution regarding its search efforts
• Burden of proof on institutions to demonstrate a reasonable search

This investigation examined the Treasury Board of Canada Secretariat's (TBS) handling of employee personal information related to the administration of the Direction on Prescribed Presence in the Workplace, which mandates minimum on-site workdays. The Office of the Privacy Commissioner of Canada (OPC) found that TBS's practices for both organizational compliance reporting (using aggregated data like turnstile and HR data) and individual compliance monitoring (relying on manager observation and self-reporting) were compliant with the Privacy Act. The OPC concluded that the complaint was not well-founded, noting TBS's effective balance between operational needs and employee privacy.

• Collection of employee personal information for hybrid work model compliance
• Retention and disposal of personal information
• Use and disclosure of personal information
• Transparency and adequacy of Personal Information Banks (PIBs)

This case involves a compliance agreement between the Privacy Commissioner of Canada and the World Anti-Doping Agency (WADA) concerning WADA's collection, use, and disclosure of athletes' personal information through its Anti-Doping Administration and Management System (ADAMS). Following a complaint and an investigation, WADA agreed to implement remedial measures to ensure personal information in ADAMS is used solely for anti-doping purposes. The agreement resolves the Commissioner's investigation, with the understanding that WADA does not admit contravention of PIPEDA and preserves its jurisdictional defenses. The investigation will be discontinued upon WADA's satisfactory completion of the agreed-upon measures.

• WADA's jurisdiction under PIPEDA for its interprovincial or international activities
• WADA's practices regarding the collection, use, and disclosure of athletes' personal information in ADAMS
• Ensuring ADOs use personal information in ADAMS strictly for anti-doping purposes
• Compliance with privacy obligations concerning sensitive personal information

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) unreasonably extended the time to respond to an access request for Microsoft Teams messages and related policies. The investigation found that ISED's justification for a 390-day extension was inadequate, as it failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to assess this length. The OIC also noted significant delays in processing. The Commissioner ordered ISED to provide a complete response within 60 business days.

• Reasonableness of time extension under subsection 9(1)
• Justification for length of extension for record volume and operational interference
• Justification for length of extension for consultations
• Deemed refusal under subsection 10(3) due to invalid time extension

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld records related to the Canada Student Service Grant. The complainant also alleged that ESDC did not conduct a reasonable search. The Information Commissioner found that ESDC improperly withheld information under exemptions related to third-party commercial information, advice and deliberations, and solicitor-client privilege. The Commissioner also found that ESDC did not reasonably exercise its discretion for some of these exemptions. The Commissioner ordered ESDC to disclose certain information and re-exercise its discretion on others. The complaint was found to be well founded.

• Improperly withheld third-party commercial information
• Improperly withheld advice or recommendations and accounts of deliberations
• Improperly withheld information under solicitor-client privilege
• Failure to reasonably exercise discretion

The Office of the Privacy Commissioner of Canada (OPC) investigated the Canada Border Services Agency's (CBSA) contracting practices related to the ArriveCAN application following a complaint and a request from a parliamentary committee. The investigation examined whether contractors had inappropriate access to travellers' personal information. While the OPC found no contravention of the Privacy Act, it identified shortcomings in the CBSA's contracting processes, such as issues with the timeliness and accuracy of security assessments and broad task descriptions in contracts. The OPC made recommendations to improve the CBSA's practices, which the agency accepted.

• Whether CBSA authorized contractors to access personal information without required security clearances.
• Accuracy and timeliness of security requirement assessments for contracts.
• Clarity and specificity of task descriptions in contracts and task authorizations.
• CBSA's compliance with security requirements for personnel and organizations involved in ArriveCAN contracts.

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information regarding leases valued over $500,000 annually. The complainant sought records for leases signed between 2018-2022 in specific cities. PSPC invoked exemptions under paragraphs 18(b) and 20(1)(b) of the Access to Information Act, claiming harm to its competitive position and the confidentiality of third-party financial information. The Information Commissioner found that neither PSPC nor the third parties established the requirements for these exemptions, noting that rent amounts were negotiated terms and the claims of harm were speculative. The Commissioner ordered PSPC to disclose the records in full.

• Whether the annual rent figures for leases were properly withheld under paragraph 18(b) (competitive position of government institutions).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(b) (confidential third-party financial or commercial information).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(c) (material financial impact on a third party).
• Whether the annual rent figures were properly withheld under paragraph 20(1)(d) (interference with third-party negotiations).

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records concerning a specific video posted on Facebook. During the investigation, it was found that ISC had initially excluded records interpreted as drafts, leading to the retrieval of 1,087 additional pages. The Information Commissioner found the original search unreasonable but concluded that ISC had since conducted a reasonable search. The Commissioner ordered ISC to process and respond to the additional records within 36 business days.

• Reasonableness of the search conducted by the institution
• Interpretation and application of exclusion criteria for records

The OPC investigated Loblaw Companies Ltd. regarding complaints about the deletion of PC Optimum Loyalty Program accounts. The investigation found Loblaw contravened PIPEDA by taking an unreasonable amount of time to address deletion requests and by failing to ensure that retained purchase history data was sufficiently anonymized after account closures. Loblaw has agreed to take corrective actions, including a third-party assessment of its anonymization processes.

• Adequacy of Loblaw's processes for addressing individual privacy challenges regarding account deletion.
• Compliance with PIPEDA's retention principle regarding anonymization of purchase history data.
• Timeliness of Loblaw's response to customer deletion requests.
• Sufficiency of Loblaw's anonymization techniques for retained data.