Federal (Canada) privacy & access decisions

This document is a compliance letter from Nova Scotia Power to the OPC, outlining actions taken and commitments made following a significant data breach that occurred in March 2025. The breach, caused by malware, led to the exfiltration of personal information belonging to approximately 375,000 current and 540,000 former customers. The compromised data included names, contact information, financial details, driver's license numbers, and SINs. The OPC received numerous complaints regarding the breach, including concerns about the collection and retention of SINs and the timeliness and method of notification to affected individuals. Nova Scotia Power has committed to deleting customer SINs (subject to legal requirements) and undergoing an external security assessment by October 2026. Upon satisfactory fulfillment of these commitments, the OPC's investigation will be discontinued.

• Whether Nova Scotia Power's security safeguards were adequate to protect personal information
• Whether Nova Scotia Power's collection and retention of Social Insurance Numbers (SINs) was appropriate
• Whether Nova Scotia Power's notification of affected individuals was timely and appropriate
• Whether Nova Scotia Power has taken sufficient corrective measures to address the breach and prevent future incidents

An employee of the Canada Border Services Agency (CBSA) filed a complaint after their personal information, including sensitive details about an accommodation request, was inadvertently made accessible to other CBSA employees through the Apollo information management system. The issue stemmed from improperly set permissions on an old ATIP file folder, which allowed document titles and sometimes the first line of emails containing personal information to be visible via Apollo's search function. The OPC found that the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority. While the CBSA corrected the specific permissions and committed to broader reviews and improved naming conventions, it did not agree to implement mandatory and trackable training for employees on Apollo permissions management. Consequently, the OPC found the complaint well-founded but unresolved, as it was not satisfied that sufficient safeguards were in place to prevent recurrence.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority
• Whether the CBSA appropriately responded to the unauthorized disclosure
• Whether the CBSA's proposed measures, without mandatory and trackable training, are sufficient to prevent future unauthorized disclosures

The complainant alleged that Transport Canada failed to respond to an access request within the statutory 30-day period and improperly handled the request before opening the file. The request sought correspondence related to the Greater Toronto Airports Authority (GTAA) concerning noise, flight path changes, passenger-based formulas, and airspace redesign. The investigation found that Transport Canada did not respond within the 30-day timeframe, largely due to delays from a primary Office of Primary Interest (OPI) in retrieving records, exacerbated by a building fire that prevented access to paper records. Electronic records were also not processed while waiting for paper records. However, the Commissioner found that Transport Canada did not improperly handle the request initially, as it reasonably sought clarification when the request did not explicitly name the institution. The complaint regarding the delay was found to be well-founded, and Transport Canada was ordered to provide a complete response within 120 business days. Transport Canada indicated it would not fully implement the order, stating it would provide an interim response instead.

• Whether Transport Canada responded to the access request within the 30-day period as per section 7 of the Access to Information Act
• Whether Transport Canada improperly handled the request before opening the file
• Whether Transport Canada met its duty to assist the complainant under subsection 4(2.1)

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to a previous access request (A-2012-00683) and a 10-page "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate that a reasonable search had been conducted, particularly regarding a second search by its Records Operations unit for which details were lacking. The Commissioner concluded that PCO did not conduct a reasonable search. Consequently, the complaint was deemed well founded, and PCO was ordered to conduct a new search, process any additional records found, and provide a supplementary response to the complainant within 36 business days. PCO did not indicate whether it would comply with the order.

• Whether the institution conducted a reasonable search for records