Federal (Canada) privacy & access decisions

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records in response to an access request for Canada's School Narratives and supporting documents related to the Independent Assessment Process. CIRNAC officials acknowledged the existence of responsive records but refused to process them, citing confidentiality, the extensive time required (12 months), and existing priorities. They also expressed concerns about potential privacy violations and breaches of undertakings if the records were processed. The Information Commissioner found CIRNAC's refusal to process the records unacceptable, concluding that the institution denied the complainant's right of access. The Commissioner ordered CIRNAC to retrieve all responsive records, process them, and provide a complete response to the request within 60 business days. CIRNAC subsequently agreed to implement the order.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records
• Whether the institution's refusal to process identified records constitutes a denial of the right of access

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into the Royal Canadian Mounted Police's (RCMP) collection of open-source information under Project Wide Awake (PWA), triggered by a complaint from MP Charlie Angus. The investigation focused on the RCMP's use of third-party services, specifically Babel Street's Babel X, for collecting personal information from various online sources. The OPC found that the RCMP failed to conduct adequate due diligence to ensure that the personal information collected via Babel X and its data providers complied with Canadian privacy laws, particularly PIPEDA. Furthermore, the OPC determined that the RCMP did not meet its transparency obligations under Section 11 of the Privacy Act, as its Personal Information Bank (PIB) descriptions were inadequate in detailing the types and purposes of open-source information collected. The RCMP did not agree to implement the OPC's recommendations, including ceasing collection from problematic Babel X sources until a thorough review was completed and updating its PIB descriptions with sufficient granularity. Consequently, both issues were found to be well-founded and unresolved.

• Whether the RCMP's collection of personal information via Social Studio complied with Section 4 of the Privacy Act.
• Whether the RCMP's collection of personal information via Babel X complied with Section 4 of the Privacy Act.
• Whether the RCMP conducted adequate due diligence on the lawfulness of collection practices of Babel X and its data providers.
• Whether Section 4 of the Privacy Act permits the collection of personal information from a third-party agent that collected, used, or disclosed the information in contravention of a law that third party is subject to.
• Whether the RCMP's publicly available descriptions of its open-source information gathering are granular enough to meet transparency obligations under Section 11 of the Privacy Act.
• Whether the RCMP's published descriptions clarify limits on purposes for collection under Section 11 of the Privacy Act.
• Whether the RCMP's descriptions of open-source information collection and related purposes are adequate under Section 11 of the Privacy Act.

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into cyber attacks that led to unauthorized disclosures and modifications of personal information held by the Canada Revenue Agency (CRA) and Employment and Social Development Canada (ESDC). Attackers used credential stuffing and identity theft to access and alter sensitive financial, banking, and employment information of tens of thousands of Canadians through the CRA's sign-in portal and ESDC's GC Key service. The OPC found that both CRA and ESDC contravened sections 6(2) and 8 of the Privacy Act due to inadequate safeguards. Key deficiencies included under-assessment of identity authentication levels, inadequately informed and accountable security decision-making, and a lack of effective monitoring. The OPC issued six recommendations to CRA and ESDC, covering improved authentication practices, coordinated security decision-making, and enhanced monitoring. Both departments accepted the recommendations, with ESDC's acceptance of one recommendation conditional on funding. The OPC concluded the matters for CRA and ESDC as well-founded and conditionally resolved, while other departments using GC Key had varying outcomes.

• Whether Canada Revenue Agency (CRA) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether Employment and Social Development Canada (ESDC) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether CRA contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether ESDC contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether CRA and ESDC adequately assessed the level of identity authentication warranted for their online services.
• Whether CRA and ESDC's identity assurance practices adequately protected against identity theft.
• Whether CRA and ESDC's credential assurance practices adequately protected against credential stuffing.
• Whether CRA and ESDC had adequately informed and accountable security decision-making processes.
• Whether interdepartmental information sharing and accountability systems were adequate to protect personal information.
• Whether CRA and ESDC conducted comprehensive vulnerability assessments and penetration testing.
• Whether CRA and ESDC had effective monitoring to detect and promptly contain the ongoing breach.
• Whether other federal departments using the GC Key service experienced fraudulent access or modification of personal information.

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to a selection process for a Steward/Command Master Sailor to the Commander of the Royal Canadian Navy. Initially, DND tasked two program areas, which reported no relevant records. The OIC, based on complainant representations, requested DND re-task these areas with specific keywords and task five named individuals. DND's subsequent search was incomplete, failing to task all individuals and use the correct date range, though it did yield seven pages of emails. Despite DND's claims of having provided all records, the OIC found that more records existed and DND had not provided a supplementary disclosure. The Commissioner concluded that DND had not conducted a reasonable search and ordered it to complete the retrieval of all responsive records, including tasking specified individuals, and to provide a new response within 36 business days.

• Whether National Defence conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest were tasked
• Whether taskings included all pertinent keywords
• Whether all specified individuals were tasked
• Whether the correct date range was used in searches

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit. Specifically, the request sought information on a "detailed review" of service delivery, proposals for community mental wellness projects, and a "risk-based review" for financial controls, all referenced in an ISC briefing note. ISC initially claimed the "detailed review" was verbal and found no records for parts 2 and 3 of the request. The Office of the Information Commissioner (OIC) found this response unreasonable, noting that the reference in an official briefing note implied the existence of responsive documentation. Following the OIC's intervention, ISC conducted additional searches, which yielded at least 170 pages of previously unlocated documents. The Commissioner concluded that ISC had not conducted a reasonable search and ordered the institution to complete the retrieval and processing of all responsive records and issue a new response to the complainant. ISC agreed to implement the order.

• Whether Indigenous Services Canada conducted a reasonable search for records related to the "detailed review" of Non-Insured Health Benefits Mental Health Counselling benefit service delivery
• Whether Indigenous Services Canada conducted a reasonable search for records related to proposals to fund community mental wellness projects outside of Benefits Program authorities
• Whether Indigenous Services Canada conducted a reasonable search for records related to the "risk-based review to improve financial controls and management practices across all regions" for the mental health benefit

The complainant alleged that Health Canada improperly withheld information under various sections of the Access to Information Act concerning records related to Dukoral. During the investigation, the complainant narrowed the scope, no longer requiring investigation into personal information or information about the production process or composition of Dukoral. The Commissioner found that Health Canada and the third party (Valneva) did not adequately demonstrate that all information withheld under paragraphs 20(1)(b) and 20(1)(c) met the exemption requirements, particularly regarding confidentiality and reasonable expectation of harm. Similarly, certain information withheld under paragraph 21(1)(a) was found not to constitute advice or recommendations. However, the institution successfully demonstrated that information withheld under section 23 (solicitor-client privilege) was properly exempted. The Commissioner ordered Health Canada to disclose specific information previously withheld under paragraphs 20(1)(b), 20(1)(c), and 21(1)(a). Health Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information exemption was properly applied (withdrawn by complainant)
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential (not publicly available, reasonable expectation of confidence, relationship fostered for public benefit)
• Whether the information was supplied by a third party
• Whether the information was consistently treated as confidential by the third party
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether disclosure could result in material financial loss or gain to the third party
• Whether there is a reasonable expectation of harm (well beyond a mere possibility)
• Whether disclosure could injure the competitive position of the third party
• Whether Health Canada reasonably exercised its discretion under s.20(5) and s.20(6)
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether the information constitutes advice or recommendations
• Whether the information was created by or for a government institution or minister
• Whether Health Canada reasonably exercised its discretion under s.21(1)(a)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the information consists of communication between a lawyer/notary and client for legal advice
• Whether the parties intended the communication to remain confidential
• Whether Health Canada reasonably exercised its discretion under s.23

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding a privacy breach. IRCC inadvertently disclosed the personal information of 497 individuals when sending mass email notifications for a work permit extension program. An employee failed to apply a filter to the email address column in an Excel spreadsheet, causing email addresses to misalign with other personal data, leading to notifications being sent to incorrect recipients. The OPC found that IRCC contravened section 8 of the Privacy Act by disclosing personal information without a permissible purpose and that its prevention measures were insufficient. While IRCC's mitigation efforts, including notifying affected individuals, were deemed adequate, the OPC recommended implementing robust procedural and administrative controls. IRCC accepted these recommendations, committing to measures such as a 'two pairs of eyes' rule, updated operating procedures, and data quality assurance checks. Consequently, the OPC considered the matter resolved.

• Whether IRCC's disclosure of personal information to unintended recipients contravened section 8 of the Privacy Act.
• Whether IRCC had sufficient measures in place to prevent unauthorized disclosures of personal information of this nature.
• Whether IRCC's response to mitigate the impact of the breach on affected individuals was adequate.