Federal (Canada) privacy & access decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee timesheet information under subsection 19(1) of the Access to Information Act. The request was for timesheets from April 19 to May 3, 2023, a period coinciding with a labour strike. The OIC accepted that User ID and PRI, if disclosed, would reveal an employee's choice to participate in or cross a picket line, thus constituting personal information not related to their position or function. However, for the remaining timesheet data (Date, Att/Abs type, Att/Abs text, Company, Status, Hours), the OIC found CRA's argument for withholding to be speculative and lacking concrete evidence that disclosure would lead to identification, especially given the large number of employees and various reasons for absence. The OIC concluded that this remaining information did not meet the requirements of subsection 19(1). The Commissioner ordered CRA to disclose the information that did not meet the requirements of subsection 19(1). CRA gave notice that it would partially implement the order, intending to withhold information associated with leave codes used by fewer than 10 employees.

• Whether User ID and PRI on timesheets constitute personal information under s.19(1) ATIA
• Whether the release of User ID and PRI would reveal an employee's personal choice regarding strike participation, thus not falling under the s.3(j) Privacy Act exception
• Whether the remaining timesheet information (Date, Att/Abs type, Att/Abs text, Company, Status, Hours) constitutes personal information under s.19(1) ATIA
• Whether there is a serious possibility that disclosing the remaining timesheet information would lead to the identification of individuals
• Whether CRA's evidence for identification was speculative or concrete
• Whether CRA reasonably exercised its discretion under s.19(2) ATIA for information meeting s.19(1) requirements

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information under several exemptions of the Access to Information Act, specifically paragraphs 18(a), 18(b), 20(1)(b), 20(1)(c), and subsection 19(1), related to the lease of equipment. The complainant also alleged that PAPA failed to conduct a reasonable search for records. The investigation focused on the application of paragraph 20(1)(c) to specific rental rate amounts on two pages and the reasonable search allegation. The Commissioner found that PAPA could not demonstrate that the disclosure of the rental rates would reasonably be expected to cause material financial impact or harm the competitive position of the third party. However, the Commissioner was satisfied that PAPA conducted a reasonable search for records. Consequently, the complaint was found to be well founded regarding the exemption claim, and PAPA was ordered to disclose the redacted information.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to rental rate amounts on pages 54 and 55
• Whether disclosure of rental rates could result in material financial loss or gain to the third party
• Whether there is a reasonable expectation of harm to the third party's financial impact or competitive position
• Whether Port Alberni Port Authority conducted a reasonable search for records

The complainant alleged that the National Research Council Canada (NRC) improperly withheld information under sections 20(1)(d), 21(1)(a), 21(1)(c), and 23 of the Access to Information Act. The request concerned records related to negotiations with the Professional Institute of the Public Service of Canada (PIPSC) regarding overtime conversion. The OIC found that the NRC failed to demonstrate that the requirements for exemptions under paragraphs 20(1)(d), 21(1)(a), and 21(1)(c) were met for all the withheld information. Specifically, the OIC determined that the NRC could not establish a reasonable expectation of interference with negotiations for the information withheld under 20(1)(d), and that the NRC did not reasonably exercise its discretion for some information under 21(1)(a). However, the OIC upheld the application of section 23 for solicitor-client privilege. The Commissioner ordered the NRC to disclose certain information originally withheld under paragraphs 20(1)(d), 21(1)(a), and 21(1)(c). The NRC agreed to implement the order, and the complaint was found to be well founded.

• Whether s.20(1)(d) contractual or other negotiations exemption was properly applied
• Whether disclosure of information could reasonably be expected to interfere with third-party negotiations under s.20(1)(d)
• Whether the institution met the requirements for s.20(1)(d)
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether the information constituted advice or recommendations developed by or for a government institution or minister under s.21(1)(a)
• Whether the institution reasonably exercised its discretion to disclose information under s.21(1)(a)
• Whether s.21(1)(c) positions or plans developed for negotiations exemption was properly applied
• Whether the information consisted of positions or plans developed for negotiations by or on behalf of the Government of Canada under s.21(1)(c)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the information constituted confidential legal advice under s.23
• Whether the institution reasonably exercised its discretion to disclose information under s.23

An unnamed federal institution sought the Information Commissioner's approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The request, received in November 2020, was exceptionally broad, seeking all tenders, solicitations, and related communications specifying OEM brand names from 2011 to 2020, with an estimated 8 million pages of records. The institution argued that processing such a volume would constitute an abuse of the right of access, overburden its operational units and ATIP office, and severely impact other requesters' rights. Despite the institution's efforts to assist the requester in narrowing the scope, the requester refused, citing a desire to protect their identity and ensure comprehensive coverage. The Commissioner found that the institution plausibly established the request as an abuse of the right of access due to the immense burden it would impose, estimating 30 to 230 years for processing. The Commissioner also concluded that the institution had met its duty to assist the requester. Consequently, the Commissioner granted the institution's application to decline to act on the request, emphasizing that while the application was delayed, the abuse of the right of access was too significant to deny it on timeliness grounds.

• Whether the access request constitutes an abuse of the right to make a request under subsection 6.1(1) of the Access to Information Act
• Whether the volume and complexity of the requested records would overburden the institution's Offices of Primary Interest (OPIs)
• Whether the volume and complexity of the requested records would overburden the institution's Access to Information and Privacy (ATIP) office
• Whether processing the access request would negatively impact the right of access of other requesters
• Whether the institution made every reasonable effort to assist the requester in connection with their request, as required by subsection 4(2.1) of the Access to Information Act
• Whether the requester's stated reasons for the broad scope of the request (to protect identity and ensure comprehensive coverage) were justified
• Whether the delay in the institution's submission of the application to decline to act should lead to its refusal

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought data analyzed in the Sea Lice Science Response Report (2022/045) from January to June 2022. DFO initially withheld the information, citing confidentiality, but later conceded that much of the data, including temperature and salinity data, could be disclosed. The Information Commissioner found that neither DFO nor the third parties demonstrated that the information met all the requirements of paragraph 20(1)(b), specifically regarding objective confidentiality and whether all information was supplied by a third party. One third party also raised section 26, but the Commissioner found it did not apply as the 90-day publication timeline had passed. The Commissioner ordered DFO to fully disclose the records, and DFO agreed to comply.

• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was objectively confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether the information would be published by a government institution within 90 days under s.26 ATIA

The Office of the Privacy Commissioner (OPC) investigated complaints against the NSIRA Secretariat regarding its access to sensitive polygraph records during a review of the Communications Security Establishment's (CSE) Internal Security Program. Complainants questioned whether the collection of personal information complied with section 4 of the Privacy Act and if the Secretariat met its Personal Information Bank (PIB) obligations under section 10. The OPC found that while some un-redacted elements in security screening files posed a re-identification risk, the polygraph recordings themselves were sufficiently anonymized. Given NSIRA's broad mandate and right of access, the OPC concluded the collection issue was not well-founded. However, the Secretariat's delay in requesting approval for PIB changes was found well-founded, though resolved by subsequent submission. The OPC recommended the Secretariat prioritize PIB approvals and publish its Info Source page for transparency. The Secretariat committed to these actions.

• Whether the NSIRA Secretariat's collection of personal information (polygraph records) complied with section 4 of the Privacy Act.
• Whether the anonymization measures applied to polygraph records were sufficient to prevent re-identification.
• Whether the NSIRA Secretariat's viewing of personal information, even if not recorded, constituted a 'collection' under section 4.
• Whether the NSIRA Secretariat met its obligations under section 10 of the Privacy Act regarding Personal Information Banks (PIBs).
• Whether the NSIRA Secretariat's request for PIB approval was timely.
• Whether the NSIRA Secretariat published its Info Source page as required by TBS policy.

The complainant alleged that Correctional Service Canada (CSC) improperly withheld information from the institutional file of a named inmate, claiming numerous exemptions under the Access to Information Act. CSC withheld over 11,000 pages, disclosing only 149 in full, primarily citing subsection 19(1) for personal information. The Commissioner found that the records contained detailed, intimate, and sensitive personal information about the inmate and other individuals, satisfying the requirements of subsection 19(1). CSC demonstrated that it made reasonable efforts to seek consent from the named inmate but not from others, providing valid reasons for the latter. The Commissioner also found that CSC was not obligated to undertake extensive searches to determine if the information was publicly available given its nature and volume. Furthermore, CSC's delegated authority considered the public interest in disclosure but concluded it did not clearly outweigh the invasion of privacy, providing a transparent explanation. The Commissioner concluded that none of the circumstances under subsection 19(2) for discretionary disclosure were met, and therefore, CSC was not required to exercise discretion. Consequently, the complaint was not well founded.

• Whether the information withheld by CSC constitutes personal information under subsection 19(1) ATIA
• Whether the information is about an individual
• Whether disclosing the information would identify that individual
• Whether the information falls under an exception to the definition of 'personal information' in the Privacy Act
• Whether CSC made reasonable efforts to seek consent for disclosure under paragraph 19(2)(a) ATIA
• Whether the information was publicly available under paragraph 19(2)(b) ATIA
• Whether the public interest in disclosure clearly outweighed the invasion of privacy under paragraph 19(2)(c) ATIA, as per section 8 of the Privacy Act
• Whether the open court principle applies to CSC or the Parole Board
• Whether the complainant was deprived of their section 2(b) Charter rights