Federal (Canada) privacy & access decisions

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act to decline to act on a 42-page access request containing 196 items, arguing it was vexatious, made in bad faith, and an abuse of the right of access. The requester objected to the institution unilaterally splitting the request into 196 separate files and argued that the Commissioner could not be impartial due to OIC employees visiting their company website. The Commissioner found that the institution had established that the request was an abuse of the right of access due to its excessive breadth and the burden it placed on the institution, despite the requester's modifications to the request being deemed untimely. The Commissioner also found that the institution had fulfilled its duty to assist the requester. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the access request was an abuse of the right of access under s.6.1(1) ATIA
• Whether the Commissioner had a conflict of interest
• Whether OIC employees visiting the requester's website constituted a breach of procedural fairness
• Whether the institution's employees had a conflict of interest
• Whether the requester's modifications to the request rendered the application moot
• Whether the institution met its duty to assist the requester under s.4(2.1) ATIA

The complainant alleged that Transport Canada improperly withheld information from contracts related to an aggregate extraction operation on land leased to the Ottawa International Airport Authority (OIAA), claiming exemptions under paragraphs 20(1)(b), 20(1)(c), and 20(1)(d) of the Access to Information Act. The Information Commissioner found that while some financial information met the requirements of paragraph 20(1)(c) due to potential harm to competitive position, and certain commercial/technical information met some requirements of paragraph 20(1)(b), the institution and third parties failed to demonstrate that the entirety of the contract was confidential or that its disclosure would interfere with negotiations. Specifically, much of the information was found to be publicly available, negating the confidentiality claim for those portions. The Commissioner concluded that the institution had improperly withheld significant parts of the contract. The complaint was found to be well founded, and Transport Canada was ordered to disclose the content of the contract, with specific redactions for information that met the exemption criteria.

• Whether s.20(1)(c) financial impact on a third party was reasonably expected
• Whether s.20(1)(b) information was financial, commercial, scientific or technical
• Whether s.20(1)(b) information was confidential
• Whether s.20(1)(b) information was supplied by a third party to a government institution
• Whether s.20(1)(b) information was consistently treated as confidential by the third party
• Whether s.20(1)(d) interference with contractual or other negotiations of a third party was reasonably expected

The complainant alleged that Public Safety Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(b.1) of the Access to Information Act, concerning user agreements for the national public alerting system. During the investigation, the complainant narrowed the scope, no longer requiring investigation into subsection 19(1) or information on pages 1-12. The OIC found that neither Public Safety nor the third party, Pelmorex Communications, could demonstrate that the agreements were "supplied" by the third party, a key requirement for exemptions 20(1)(b.1) and 20(1)(b). Public Safety also invoked subsection 16(2) for a DocuSign ID, but the Commissioner found no reasonable expectation of harm. Consequently, the Commissioner ordered Public Safety to disclose the records in their entirety, excluding information previously withheld under subsection 19(1). Public Safety agreed to implement the order, and the complaint was found to be well founded.

• Whether information in negotiated agreements was "supplied" by a third party for the purpose of s.20(1)(b.1) ATIA
• Whether information in negotiated agreements was "supplied" by a third party for the purpose of s.20(1)(b) ATIA
• Whether disclosure of a DocuSign envelope identification number could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA

The complainant requested records concerning noise and vibration studies for the Pitt Meadows Road and Rail Project. The Vancouver Fraser Port Authority (VFPA) withheld information under several exemptions and provided some documents in an illegible format. The Commissioner found that the VFPA improperly withheld information under sections 18(b), 18(d), 20(1)(b), 20(1)(d), 21(1)(a), and 21(1)(d) of the Act, and failed its duty to assist by providing illegible records. While some information was properly withheld under sections 13(1), 18(b), 18(d), 19(1), and 21(1)(a), the institution could not justify the application of other exemptions or the illegibility of records. Specifically, section 20(1)(b) and (d) claims were rejected due to a lack of objective confidentiality and speculative harm. The complaint was found to be well-founded, and the Commissioner ordered the VFPA to disclose specific information and provide legible copies of records. The VFPA notified the Commissioner of its intent to comply with the order.

• Whether s.13(1) confidential information from government bodies applied to pages 396-397 of Part 2.
• Whether s.13(1) confidential information from government bodies applied to page 398 of Part 2 (VFPA's own email signature/COVID message).
• Whether the VFPA reasonably exercised discretion under s.13(2) for information meeting s.13(1).
• Whether s.18(b) competitive position or negotiations applied to specific estimated costs, specifics of the draft partnership agreement, and details of selected/preferred options.
• Whether s.18(b) competitive position or negotiations applied to peripheral details (e.g., where funding was requested from).
• Whether s.18(b) competitive position or negotiations applied to information showing no clear preference or options not seriously considered.
• Whether the VFPA reasonably exercised discretion under s.18(b) for information meeting the exemption.
• Whether s.18(d) government financial interests or undue benefit applied to specific costing information.
• Whether s.18(d) government financial interests or undue benefit applied to potential measures or number of mitigation options.
• Whether s.19(1) personal information applied to names of third-party employees.
• Whether the VFPA reasonably exercised discretion under s.19(2) for information meeting s.19(1).
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was financial, commercial, scientific or technical.
• Whether s.20(1)(b) information was objectively confidential (not publicly available, reasonable expectation of confidence, fostered public benefit).
• Whether s.20(1)(b) information was supplied by a third party (specifically, negotiated terms).
• Whether s.20(1)(b) information was consistently treated as confidential by the third party.
• Whether s.20(1)(d) negotiations by a third party applied to information withheld by CP.
• Whether s.21(1)(a) advice or recommendations applied to information on pages 428-429 of Part 2.
• Whether s.21(1)(a) advice or recommendations applied to objective, factual, or statistical information.
• Whether s.21(1)(a) advice or recommendations applied to data relating to the number of receivers exceeding criteria.
• Whether the VFPA reasonably exercised discretion under s.21(1)(a) for information meeting the exemption.
• Whether s.21(1)(d) plans related to personnel management or administration applied to plans for future growth.
• Whether s.21(1)(d) was contravened by applying it to a consultant's slide deck (s.21(2)(b)).
• Whether the VFPA met its obligations under s.4(2.1) to make every reasonable effort to assist the complainant by providing legible copies.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to respond to an access request within the extended timeframe, constituting a deemed refusal under subsection 10(3) of the Access to Information Act. The request sought "Activity Progress Reports" related to the Tk'emlups Indian Residential School Survivor Project or "missing children" programs from April 1, 2021. CIRNAC attributed the delay to "resource limitations" and stated that the review of records had not yet begun, despite identifying 576 relevant pages. The Information Commissioner found CIRNAC's reason for delay unacceptable, emphasizing that the Act does not permit delays due to staffing issues or competing priorities. The Commissioner concluded that CIRNAC contravened its obligations and ordered the institution to provide a complete response within 36 business days. CIRNAC subsequently agreed to implement the order, and the complaint was found to be well founded.

• Whether the institution responded within the extended time limits under subsection 9(1) of the Access to Information Act
• Whether 'resource limitations' constitute a valid reason for delay in responding to an access request

The complainant alleged that Bell Canada contravened PIPEDA by failing to respond to an access request within 30 days and by denying access to his cellphone logs. The OPC found that Bell contravened subsection 8(3) of PIPEDA for the delayed response and Principle 4.9 for denying access, as the phone logs constituted the complainant's personal information. The OPC determined that the complainant's privacy interest in his phone logs outweighed the ex-spouse's interest, and there was a public interest in disclosure. Bell agreed to provide the requested logs to the complainant, resolving that aspect of the complaint. Bell also committed to implementing recommendations to improve its access request procedures and enhance openness regarding data access on shared accounts, leading to a conditionally resolved outcome for these issues.

• Whether Bell responded to the Complainant’s access request within thirty days as per subsection 8(3) of PIPEDA
• Whether Bell adequately responded to the Complainant’s request to access his personal information under Principle 4.9 of PIPEDA
• Whether phone logs relating to a specific phoneline constitute the personal information of the phoneline's user, even if they are not the account holder
• Whether the Complainant's interest in accessing the phone logs is greater than the ex-spouse's interest in non-disclosure of the phone logs
• Whether Bell was sufficiently open with individuals about account holders' access to phone usage details on shared accounts, contrary to PIPEDA's Openness principle (Principle 4.8.1)

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the 30-day period stipulated by section 7 of the Access to Information Act. The request sought extensive information related to the Métis Nation, treaties, and the Native Women's Association of Canada, covering a broad historical period. LAC argued that the request was too broad and vague, lacking sufficient detail for experienced employees to identify specific records with reasonable effort, and that responding would require extensive historical and legal research beyond its mandate. The OIC determined that the request did not meet the requirements of section 6 of the Act, which mandates that requests provide enough detail for records to be identified with reasonable effort. Despite LAC's attempts to seek clarification and offer assistance through its reference services, the complainant did not provide further specifics. Consequently, the OIC concluded that LAC was not obligated to process the request and was not in deemed refusal. The complaint was found to be not well founded.

• Whether Library and Archives Canada responded to the access request within the 30-day period
• Whether the access request provided enough detail for experienced institutional employees to identify relevant records with a reasonable effort under section 6 of the ATIA
• Whether the institution's efforts to seek clarification from the requester were reasonable
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the ATIA

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) took an unreasonable time extension under subsection 9(1) of the Access to Information Act and improperly processed two requests as one. The request sought an updated Consultation Agreement between Canada and the MNA and related documents. The Information Commissioner found that CIRNAC's 180-day extension for volume and 90-day extension for consultations were unreasonable, particularly noting that a 90-day consultation period for 12 pages with the Department of Justice was not justified. Consequently, CIRNAC was deemed to have refused access. However, the Commissioner found it reasonable for CIRNAC to treat the request as a single one, given the way it was submitted. The complaint was deemed well-founded, and CIRNAC was ordered to provide a complete response within 36 business days.

• Whether the 180-day extension under s.9(1)(a) ATIA for volume was reasonable
• Whether the 90-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether the 30-day extension under s.9(1)(c) ATIA was reasonable
• Whether CIRNAC improperly processed two requests as one
• Whether CIRNAC was deemed to have refused access under s.10(3) ATIA

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under various sections of the Access to Information Act in response to a request for reports and minutes from the Intelligence Advisory Committee (IAC) concerning global warming or climate change from 1988-1989. PCO initially claimed exemptions under subsections 13(1), 14, 15(1), 19(1), and 24(1). During the investigation, the complainant withdrew the 19(1) allegation, and PCO conceded that section 14 was improperly applied, releasing the information. PCO also subsequently released some information initially withheld under 13(1) and 15(1). The Commissioner found that PCO failed to demonstrate that the remaining withheld information met the requirements for exemption under subsections 13(1), 15(1), or 24(1), particularly regarding the confidentiality of foreign government information, the potential harm from disclosing names of CSIS and CSE employees, and the impact of revealing dissemination markings or general assessments of allies. The Commissioner concluded that PCO did not establish a reasonable expectation of probable harm for the claimed exemptions. The complaint was found to be well founded, and PCO was ordered to disclose the records in their entirety.

• Whether information was obtained in confidence from a foreign government under s.13(1) ATIA
• Whether disclosure of CSIS employee names could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of CSE employee names could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of dissemination markings could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether disclosure of limited information regarding foreign governments could reasonably be expected to harm international affairs, defence, or national security under s.15(1) ATIA
• Whether the identity of CSIS employees was restricted from disclosure by s.18(1) of the CSIS Act, thereby falling under s.24(1) ATIA

The complainant alleged that Employment and Social Development Canada (ESDC) failed to conduct a reasonable search for records in response to an access request concerning complaints submitted to ESDC's Labour Program. The OIC's investigation found that ESDC's initial search was not reasonable because it overlooked two key components of the access request. Consequently, ESDC conducted an additional search, which identified further responsive records. The OIC concluded that while the initial search was inadequate, the subsequent search was reasonable. The complaint was found to be well-founded, and the OIC ordered ESDC to process the newly identified records and issue a new response to the complainant within 36 business days. ESDC agreed to implement these orders.

• Whether Employment and Social Development Canada conducted a reasonable search for records related to complaints submitted to its Labour Program

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to allegations concerning the ethics of an individual. The request sought all documents from April 1, 2024, to the present, respecting these allegations. Initially, PCO tasked several Offices of Primary Interest (OPIs), all of which provided nil responses, leading PCO to inform the complainant that no records were found. However, the Information Commissioner's investigation revealed that not all relevant OPIs were tasked. Upon further inquiry by the OIC, PCO additionally tasked its Communications and Consultations secretariat, which located 142 pages of responsive records. The Commissioner found that PCO had not conducted a reasonable search initially because not all responsible OPIs were tasked. The complaint was deemed well-founded, and PCO was ordered to complete the retrieval and processing of all responsive records and provide a supplementary response within 36 business days.

• Whether the institution conducted a reasonable search for records under paragraph 30(1)(a) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to the management of the government's parliamentary agenda. Initially, PCO's Offices of Primary Interest (OPIs) provided nil responses, leading PCO to inform the complainant that no relevant records were found. However, the complainant provided detailed reasons why records should exist, prompting the OIC to request further representations from PCO. During the OIC's investigation, PCO conducted additional searches, which located 26 pages of relevant records that were not found in the initial search because they were stored in a PCO-ATIP library rather than directly by the OPI. The Commissioner found that PCO had not conducted a reasonable search initially. Consequently, the complaint was deemed well-founded, and PCO was ordered to process and release the newly found records.

• Whether the institution conducted a reasonable search for records under s.30(1)(a) ATIA

The complainant alleged that Transport Canada improperly withheld information under several provisions of the Access to Information Act related to a vessel-seaplane collision. Transport Canada initially claimed exemptions under paragraphs 16(1)(c), 19(1), 20(1)(b), 20(1)(d), and 21(1)(b). During the investigation, the complainant narrowed the scope, and Transport Canada dropped its reliance on 16(1)(c) and 21(1)(b). The Commissioner found that Transport Canada could not justify most of its claims under 20(1)(b) and 20(1)(d), except for a limited amount of information under 20(1)(b) that met all four requirements. Furthermore, Transport Canada failed to demonstrate that it had considered its obligation to exercise discretion under subsection 20(6) for the information that did meet the 20(1)(b) exemption. The Commissioner ordered Transport Canada to disclose the information for which exemptions were not justified and to properly exercise its discretion for the remaining information. Transport Canada indicated it would likely comply with the order, and the complaint was found to be well founded.

• Whether s.16(1)(c) ATIA (conduct of investigations) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether Transport Canada reasonably exercised its discretion under s.20(6) ATIA for information meeting s.20(1)(b)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act, concerning Joint Intelligence Committee Intelligence for NORAD records from 1958-63. During the investigation, LAC provided two supplementary releases of previously withheld information. The Office of the Information Commissioner (OIC) determined that NORAD qualifies as an international organization of states for the purposes of paragraph 13(1)(b). The OIC found that not all information initially exempted by LAC met the requirements of subsections 13(1) and 15(1), leading to a well-founded complaint. However, an order was deemed unnecessary because LAC had already released some information, and the remaining withheld information was found to properly meet the requirements of subsection 13(1).

• Whether information was properly withheld under s.13(1) ATIA
• Whether NORAD constitutes an international organization of states or an institution thereof for the purposes of s.13(1)(b) ATIA
• Whether information was obtained in confidence from a foreign state under s.13(1)(a) ATIA
• Whether information was obtained in confidence from an international organization of states under s.13(1)(b) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the circumstances in s.13(2) ATIA existed (consent or public availability)
• Whether information was properly withheld under s.15(1) ATIA

A former employee complained that Staples Canada ULC (Staples) failed to adequately protect and remove personal information from returned laptops before reselling them through its Openbox program. The complainant alleged that Staples lacked adequate internal policies, processes, and training for staff to wipe data from these devices. The OPC's investigation found deficiencies in Staples' policies, procedures, and training, and that employees did not consistently follow manufacturer guidelines for data wiping, leading to residual personal information on 23% of sampled devices. Staples agreed to implement recommendations to improve its data wiping procedures, training, and to arrange for independent third-party spot checks. The OPC concluded that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3.

• Whether Staples had adequate security safeguards to protect personal information on returned laptops under Principle 4.7.1 PIPEDA
• Whether Staples' methods of protection included adequate physical, organizational, and technological measures under Principle 4.7.3 PIPEDA
• Whether Staples' internal policies and procedures for data wiping were clear and consistent
• Whether Staples provided adequate training to employees responsible for wiping data from returned devices
• Whether Staples consistently performed full data wipes according to manufacturer instructions on returned laptops