Federal (Canada) privacy & access decisions

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under various sections of the Access to Information Act in response to a request for reports and minutes from the Intelligence Advisory Committee (IAC) concerning global warming or climate change from 1988-1989. PCO initially claimed exemptions under subsections 13(1), 14, 15(1), 19(1), and 24(1). During the investigation, the complainant withdrew the 19(1) allegation, and PCO conceded that section 14 was improperly applied, releasing the information. PCO also subsequently released some information initially withheld under 13(1) and 15(1). The Commissioner found that PCO failed to demonstrate that the remaining withheld information met the requirements for exemption under subsections 13(1), 15(1), or 24(1), particularly regarding the confidentiality of foreign government information, the potential harm from disclosing names of CSIS and CSE employees, and the impact of revealing dissemination markings or general assessments of allies. The Commissioner concluded that PCO did not establish a reasonable expectation of probable harm for the claimed exemptions. The complaint was found to be well founded, and PCO was ordered to disclose the records in their entirety.

• Whether information was obtained in confidence from a foreign government under s.13(1) ATIA
• Whether disclosure of CSIS employee names could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of CSE employee names could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of dissemination markings could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of limited information regarding foreign governments could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether the identity of CSIS employees was restricted from disclosure by s.18(1) of the CSIS Act, thereby falling under s.24(1) ATIA

The complainant alleged that Employment and Social Development Canada (ESDC) failed to conduct a reasonable search for records in response to an access request concerning complaints submitted to ESDC's Labour Program. The OIC's investigation found that ESDC's initial search was not reasonable because it overlooked two key components of the access request. Consequently, ESDC conducted an additional search, which identified further responsive records. The OIC concluded that while the initial search was inadequate, the subsequent search was reasonable. The complaint was found to be well-founded, and the OIC ordered ESDC to process the newly identified records and issue a new response to the complainant within 36 business days. ESDC agreed to implement these orders.

• Whether Employment and Social Development Canada conducted a reasonable search for records related to complaints submitted to its Labour Program

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to allegations concerning the ethics of an individual. The request sought all documents from April 1, 2024, to the present, respecting these allegations. Initially, PCO tasked several Offices of Primary Interest (OPIs), all of which provided nil responses, leading PCO to inform the complainant that no records were found. However, the Information Commissioner's investigation revealed that not all relevant OPIs were tasked. Upon further inquiry by the OIC, PCO additionally tasked its Communications and Consultations secretariat, which located 142 pages of responsive records. The Commissioner found that PCO had not conducted a reasonable search initially because not all responsible OPIs were tasked. The complaint was deemed well-founded, and PCO was ordered to complete the retrieval and processing of all responsive records and provide a supplementary response within 36 business days.

• Whether the institution conducted a reasonable search for records under paragraph 30(1)(a) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to the management of the government's parliamentary agenda. Initially, PCO's Offices of Primary Interest (OPIs) provided nil responses, leading PCO to inform the complainant that no relevant records were found. However, the complainant provided detailed reasons why records should exist, prompting the OIC to request further representations from PCO. During the OIC's investigation, PCO conducted additional searches, which located 26 pages of relevant records that were not found in the initial search because they were stored in a PCO-ATIP library rather than directly by the OPI. The Commissioner found that PCO had not conducted a reasonable search initially. Consequently, the complaint was deemed well-founded, and PCO was ordered to process and release the newly found records.

• Whether the institution conducted a reasonable search for records under s.30(1)(a) ATIA

The complainant alleged that Transport Canada improperly withheld information under several provisions of the Access to Information Act related to a vessel-seaplane collision. Transport Canada initially claimed exemptions under paragraphs 16(1)(c), 19(1), 20(1)(b), 20(1)(d), and 21(1)(b). During the investigation, the complainant narrowed the scope, and Transport Canada dropped its reliance on 16(1)(c) and 21(1)(b). The Commissioner found that Transport Canada could not justify most of its claims under 20(1)(b) and 20(1)(d), except for a limited amount of information under 20(1)(b) that met all four requirements. Furthermore, Transport Canada failed to demonstrate that it had considered its obligation to exercise discretion under subsection 20(6) for the information that did meet the 20(1)(b) exemption. The Commissioner ordered Transport Canada to disclose the information for which exemptions were not justified and to properly exercise its discretion for the remaining information. Transport Canada indicated it would likely comply with the order, and the complaint was found to be well founded.

• Whether s.16(1)(c) ATIA (conduct of investigations) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether Transport Canada reasonably exercised its discretion under s.20(6) ATIA for information meeting s.20(1)(b)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act, concerning Joint Intelligence Committee Intelligence for NORAD records from 1958-63. During the investigation, LAC provided two supplementary releases of previously withheld information. The Office of the Information Commissioner (OIC) determined that NORAD qualifies as an international organization of states for the purposes of paragraph 13(1)(b). The OIC found that not all information initially exempted by LAC met the requirements of subsections 13(1) and 15(1), leading to a well-founded complaint. However, an order was deemed unnecessary because LAC had already released some information, and the remaining withheld information was found to properly meet the requirements of subsection 13(1).

• Whether information was properly withheld under s.13(1) ATIA
• Whether NORAD constitutes an international organization of states or an institution thereof for the purposes of s.13(1)(b) ATIA
• Whether information was obtained in confidence from a foreign state under s.13(1)(a) ATIA
• Whether information was obtained in confidence from an international organization of states under s.13(1)(b) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the circumstances in s.13(2) ATIA existed (consent or public availability)
• Whether information was properly withheld under s.15(1) ATIA

A former employee complained that Staples Canada ULC (Staples) failed to adequately protect and remove personal information from returned laptops before reselling them through its Openbox program. The complainant alleged that Staples lacked adequate internal policies, processes, and training for staff to wipe data from these devices. The OPC's investigation found deficiencies in Staples' policies, procedures, and training, and that employees did not consistently follow manufacturer guidelines for data wiping, leading to residual personal information on 23% of sampled devices. Staples agreed to implement recommendations to improve its data wiping procedures, training, and to arrange for independent third-party spot checks. The OPC concluded that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3.

• Whether Staples had adequate security safeguards to protect personal information on returned laptops under Principle 4.7.1 PIPEDA
• Whether Staples' methods of protection included adequate physical, organizational, and technological measures under Principle 4.7.3 PIPEDA
• Whether Staples' internal policies and procedures for data wiping were clear and consistent
• Whether Staples provided adequate training to employees responsible for wiping data from returned devices
• Whether Staples consistently performed full data wipes according to manufacturer instructions on returned laptops

An individual complained that a private swimming pool required parents to consent to the use of their children's photos and videos for promotional purposes as a condition of service for swimming lessons. The complainant argued this violated PIPEDA's consent requirements, specifically Principle 4.3.3, which prohibits requiring consent for information beyond what is necessary for the service. The swimming pool contended that the photo policy was a reasonable business need for promotion and staff training, and that tracking individual consent would be burdensome. The OPC found that images of children in swim attire are sensitive personal information and that requiring consent for promotional photos and staff training videos was not strictly necessary for providing swimming lessons. The OPC concluded that this practice contravened PIPEDA Principles 4.3.3 and 4.3.6. The complaint was found to be well-founded and resolved after the swimming pool agreed to implement an opt-in photo policy.

• Whether requiring consent for promotional photos and videos of children as a condition of service for swimming lessons contravenes Principle 4.3.3 of PIPEDA
• Whether images of children in swim attire constitute sensitive personal information
• Whether the collection, use, or disclosure of images for promotional or staff training purposes is strictly necessary for the provision of swimming lessons
• Whether the organization offered individuals a choice regarding the collection, use, or disclosure of images for promotional or staff training purposes
• Whether the organization should have sought express consent for the collection, use, or disclosure of images of children

The complainant requested a full Issue Detail Report for a food complaint from the Canadian Food Inspection Agency (CFIA). The CFIA withheld information under subsections 19(1) (personal information), 20(1)(b) (confidential third-party information), and 20(1)(c) (financial impact on a third party) of the Access to Information Act. The complainant also alleged that the CFIA improperly used 'negative' (white) redactions, making it difficult to identify withheld portions. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The Commissioner found that the CFIA failed to meet its duty to assist by using negative redactions and recommended they cease this practice. For the third-party exemptions, the Commissioner determined that most of the information did not meet the requirements of paragraphs 20(1)(b) or 20(1)(c), as the institution and third party did not sufficiently establish confidentiality or reasonable expectation of harm. The Commissioner ordered the CFIA to disclose most of the withheld third-party information, with specific exceptions for supplier names, procedural details, and product weighing processes. The CFIA agreed to implement the order and recommendation.

• Whether the CFIA improperly withheld information under s.19(1) ATIA
• Whether the CFIA improperly withheld information under s.20(1)(b) ATIA
• Whether the CFIA improperly withheld information under s.20(1)(c) ATIA
• Whether the CFIA's use of negative (white) redactions was appropriate under s.4(2.1) ATIA (duty to assist)
• Whether the information is financial, commercial, scientific or technical for s.20(1)(b) ATIA
• Whether the information is confidential by an objective standard for s.20(1)(b) ATIA
• Whether the third party supplied the information to a government institution for s.20(1)(b) ATIA
• Whether the third party has consistently treated the information as confidential for s.20(1)(b) ATIA
• Whether disclosure could result in material financial loss or gain to the third party for s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm for s.20(1)(c) ATIA
• Whether disclosure could injure the competitive position of the third party for s.20(1)(c) ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records concerning expenses incurred for providing security to internationally protected persons visiting Canada. The request sought all records, including breakdowns by visitor, from January 1, 2015, to January 24, 2020. In response, the RCMP provided only a two-page summary of costs, arguing that most records would likely be exempt or excluded under the Act, and that generating a summary was more expedient than reviewing an estimated 150,000 pages. The Information Commissioner found that the RCMP did not demonstrate how the summary fulfilled its responsibility to retrieve and process all responsive records, nor did it adequately justify not identifying and locating the full records based on potential exemptions. Consequently, the Commissioner concluded that the RCMP did not conduct a reasonable search. The complaint was found to be well founded, and the RCMP was ordered to conduct a new search and provide a new response.

• Whether the institution conducted a reasonable search for records
• Whether providing a summary of records fulfills the obligation to search for 'all records'
• Whether the potential for exemptions justifies not identifying and locating all responsive records

The complainant requested records related to CSL Group Inc., specifically policy and workplace health and safety committee reports from 2012 to 2022. Employment and Social Development Canada (ESDC) withheld information under several provisions of the Access to Information Act and was also alleged to have conducted an unreasonable search for records. The Commissioner found that ESDC failed to justify most of its exemption claims, including those under s.16(1)(c), s.16(2), s.20(1)(b), s.20(1)(c), s.21(1)(b), and s.23. While some personal information and specific recommendations were properly withheld under s.19(1) and s.21(1)(a) respectively, ESDC's exercise of discretion for other s.21(1)(a) information was deemed unreasonable. Furthermore, ESDC failed to demonstrate that it conducted a reasonable search for responsive records. Consequently, the complaint was found to be well-founded. The Commissioner ordered ESDC to disclose most of the withheld information, re-exercise discretion for certain records, and conduct a new, reasonable search for responsive records. ESDC notified the Commissioner of its intent to comply with the order.

• Whether ESDC improperly withheld information under s.16(1)(c) ATIA (law enforcement, conduct of investigations)
• Whether ESDC improperly withheld information under s.16(2) ATIA (facilitating the commission of an offence)
• Whether ESDC improperly withheld information under s.19(1) ATIA (personal information)
• Whether the corporate address on page 136 constitutes personal information under s.19(1) ATIA
• Whether non-personal information on business cards on page 138 constitutes personal information under s.19(1) ATIA
• Whether ESDC reasonably exercised its discretion under s.19(2) ATIA regarding personal information
• Whether ESDC improperly withheld information under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether ESDC improperly withheld information under s.20(1)(c) ATIA (financial impact on a third party)
• Whether disclosure could reasonably be expected to have a material financial impact or injure competitive position under s.20(1)(c) ATIA
• Whether ESDC improperly withheld information under s.21(1)(a) ATIA (advice or recommendations)
• Whether the information constitutes advice or recommendations under s.21(1)(a) ATIA
• Whether ESDC reasonably exercised its discretion under s.21(1)(a) ATIA regarding advice or recommendations
• Whether ESDC improperly withheld information under s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information constitutes accounts of consultations or deliberations under s.21(1)(b) ATIA
• Whether ESDC improperly withheld information under s.23 ATIA (solicitor-client and litigation privilege)
• Whether the information is subject to solicitor-client privilege under s.23 ATIA
• Whether the information is subject to litigation privilege under s.23 ATIA
• Whether ESDC conducted a reasonable search for records

The complainant alleged that the Privy Council Office's (PCO) record-keeping practices for appointment processes did not comply with the Access to Information Act (ATIA), specifically regarding the disposal of interview notes. PCO stated that selection members take notes during interviews to aid deliberations, but these are considered transitory records and are disposed of after the final advice letter to the Minister is prepared, which constitutes the official record. The complainant also suggested PCO's practices might constitute an offense under the ATIA. The investigation found no evidence that records were destroyed with the intent to deny a right of access. Instead, the interview notes were deemed transitory records used in preparing advice letters. The Commissioner concluded that there was no obligation under the ATIA for PCO to retain these notes, nor did their destruction violate the Act. The complaint was therefore not well founded.

• Whether PCO's record-keeping practices for appointment processes comply with the ATIA
• Whether interview notes taken by selection members are transitory records
• Whether there was an obligation under the ATIA for PCO to retain interview notes
• Whether the destruction of interview notes constituted an offense under s.67.1 of the ATIA (destruction with intent to deny access)

The complainant alleged that Health Canada improperly withheld information under paragraph 20(1)(b) of the Access to Information Act and failed to conduct a reasonable search for records. The request sought documents related to stakeholder consultations on amendments to the Food and Drug Regulations concerning COVID-19 drugs. The OIC found that neither Health Canada nor the third parties established that the names of the third parties met the requirements of paragraph 20(1)(b), specifically regarding whether the information was financial, commercial, scientific, or technical, and whether it was confidential. The OIC also concluded that Health Canada did not conduct a reasonable search, noting issues with search parameters, lack of documentation, and failure to locate expected records. Consequently, the Information Commissioner ordered Health Canada to disclose the names of the third parties and conduct a new, comprehensive search for records. Health Canada agreed to comply with the order.

• Whether the names of third parties constitute financial, commercial, scientific or technical information under s.20(1)(b) ATIA
• Whether the names of third parties were confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third parties consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether Health Canada conducted a reasonable search for records

A federal institution applied to the Information Commissioner for approval to decline to act on an access request, citing subsection 6.1(1) of the Access to Information Act. The institution argued that the request was vexatious and constituted an abuse of the right of access. The Commissioner reviewed the institution's submission and found that the institution successfully demonstrated that the access request in question was indeed an abuse of the right of access. Consequently, the Commissioner determined that the circumstances justified granting the institution's request to decline to process the access request. The application was therefore granted, allowing the institution to refuse to act on the request.

• Whether the access request was vexatious
• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to IAC reports concerning the USSR and former Warsaw Pact and Yugoslavia from 1990. Initially, PCO provided only minutes, leading to the complaint. During the investigation, PCO conducted an additional search, releasing 1,352 pages, but the complainant maintained that several specific reports were still missing. The OIC was not satisfied with the initial search efforts and requested further representations from PCO. PCO subsequently identified that some of the missing reports had been previously withheld in their entirety, some were not in their holdings, and 100 additional pages covering other requested documents were located. The Commissioner found that PCO had now conducted a reasonable search and ordered PCO to process and release the newly identified records by January 22, 2026. PCO agreed to implement the order.

• Whether the institution conducted a reasonable search for records responsive to the access request