Federal (Canada) Privacy Decisions

An inmate alleged that Correctional Service Canada (CSC) failed to retain video footage of use of force incidents involving them, violating the Privacy Act's retention obligations. The OPC found that CSC did dispose of footage that it was obligated to retain for at least two years under the Act. CSC agreed to implement enhanced oversight, including monthly attestations and quarterly audits of use of force footage retention in its Pacific Region.

• Obligation to retain personal information used for administrative purposes under the Privacy Act
• Adequacy of institutional policies for video retention
• Ensuring reasonable access to personal information
• Effectiveness of oversight measures for compliance

The complainant alleged that the Privy Council Office (PCO) improperly withheld information related to a meeting, citing exemptions under subsection 16(2) (facilitating the commission of an offence) and subsection 19(1) (personal information) of the Access to Information Act. The OIC found that PCO failed to demonstrate that a signature and two initials, withheld under subsection 19(1), met the requirements of the exemption, particularly considering they related to official duties and transparency. Although PCO initially applied subsection 16(2) to a phone number, the OIC concluded this exemption was met. However, the OIC ordered PCO to disclose the information withheld under subsection 19(1).

• Application of subsection 16(2) to a phone number
• Application of subsection 19(1) to signatures and initials
• Whether signatures/initials used for official duties are excluded from the definition of personal information under paragraph 3(j) of the Privacy Act
• Reasonableness of the institution's exercise of discretion to withhold information

The complainant alleged that Transport Canada improperly withheld information related to a workplace fatality under several exemptions, including personal information and third-party commercial/technical information. The complainant also alleged that Transport Canada had not conducted a reasonable search. The OIC found that while the initial search was not reasonable, it was resolved during the investigation. The Commissioner ordered Transport Canada to disclose certain information that did not meet the criteria for third-party exemptions, and re-exercise discretion on other withheld information.

• Proper application of the personal information exemption (s.19(1) ATIA).
• Proper application of third-party information exemptions (s.20(1)(b) and (c) ATIA).
• Proper application of investigation conduct exemption (s.16(1)(c) ATIA).
• Reasonableness of the search for records.

This report details an investigation into the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees due to improperly shared spreadsheets. While the CBSA contravened section 8 of the Privacy Act by disclosing information beyond what was necessary for the stated purposes, the agency took appropriate steps to notify affected individuals, contain the breaches, and implement measures to prevent recurrence. These measures included new data request procedures and the development of a new information management system.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information.
• Whether the CBSA took adequate steps to notify affected individuals.
• Whether the CBSA took adequate steps to contain the impact of the breaches.
• Whether the CBSA took adequate steps to reduce the risk of future breaches.

The complainant alleged that the Privy Council Office (PCO) improperly withheld information concerning intelligence committee meetings from 1972, citing exemptions related to confidential government information, international affairs, national security, investigative bodies, and personal information. PCO released some information during the investigation but continued to withhold other records. The Information Commissioner found that PCO had not met the requirements for most of the claimed exemptions, particularly given the age of the records and the fact that similar information had been previously disclosed publicly. Consequently, the Commissioner ordered PCO to release most of the remaining withheld information and to re-exercise discretion on a few specific pages.

• Timeliness of exemption claims for historical records
• Demonstration of reasonable expectation of harm
• Public domain status of information
• Proper exercise of discretion

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request regarding government communications about the recognition of Yaroslav Hunka in September 2023 by the extended deadline. The OIC found that PCO did not respond by the April 7, 2025, extended due date and was deemed to have refused access. Despite the ongoing processing and consultations, the OIC found the delay unacceptable and ordered PCO to provide a complete response within 36 business days.

• Timeliness of response to access request
• Definition of a 'response' under the ATIA
• Effect of deemed refusal under subsection 10(3)
• Timeliness of implementing OIC order

An institution applied to the Information Commissioner for approval to decline an access request, arguing it was an abuse of the right to access information due to the large volume of Microsoft Teams messages requested. The Commissioner denied the application, finding the institution failed to provide sufficient evidence. The institution's calculations for the volume of messages were unreliable, and the Commissioner noted it is the institution's responsibility to build adequate capacity to process requests.

• Whether the access request is an abuse of the right of access under subsection 6.1(1) of the ATIA
• Whether the institution provided sufficient evidence to demonstrate the request would overburden its operations
• The institution's responsibility to ensure it has the operational capacity to process access requests

The complainant alleged that Parks Canada failed to respond to an access request within the extended deadline. The request concerned data on human activity and coastal erosion impacts in the Gulf Islands National Park Reserve, and records related to a park closure decision. Parks Canada cited technical issues, staffing shortages, and third-party consultations as reasons for the delay. The Information Commissioner found the complaint well-founded, ordering Parks Canada to provide a complete response by April 30, 2026.

• Failure to respond within statutory time limits.
• Justification for delays due to technical issues and staffing shortages.
• Balancing third-party consultation requirements with the right to timely access.

The complainant alleged that Shared Services Canada (SSC) improperly withheld information requested under the Access to Information Act. The request was for a report from Gartner, Inc. The complainant argued the information was wrongly withheld under exemptions related to personal information, third-party financial/commercial/scientific/technical information, financial impact on a third party, and negotiations by a third party. The Information Commissioner found that while some information met the criteria for exemption under paragraph 20(1)(b), SSC failed to demonstrate that other withheld information met exemption requirements or that reasonable severance was not possible. The Commissioner ordered SSC to re-exercise its discretion on certain information and disclose specific parts of the report.

• Improper withholding of information under exemptions 19(1), 20(1)(b), 20(1)(c), and 20(1)(d) of the ATIA.
• Whether information qualified as confidential third-party financial, commercial, scientific, or technical information under paragraph 20(1)(b).
• Whether reasonable severance was possible under section 25 of the ATIA.
• Whether SSC reasonably exercised its discretion to withhold information under subsection 16(2).