Federal (Canada) Privacy Decisions

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day timeframe. DND refused to process the request, believing it did not meet the clarity requirements of section 6 of the Access to Information Act. The Information Commissioner found that the request did meet the requirements and that DND should have processed it without clarification. DND was therefore deemed to have refused access. The Commissioner ordered DND to provide a complete response to the request, and DND indicated it would comply.

• Whether the access request met the requirements of section 6 of the Access to Information Act.
• Whether National Defence properly refused to process the access request.
• Whether National Defence failed to respond within the time limits set out in the Act.

The complainant alleged that CSIS failed to sufficiently identify which portions of the requested records were redacted and on what basis. CSIS used negative redactions and did not specify exemptions on the records themselves, claiming it could cause harm. The Information Commissioner found this insufficient, recommending CSIS provide a new response clearly identifying withheld portions and citing specific exemptions, cease using negative redactions, and cite exemptions on the records themselves. CSIS agreed to implement these recommendations.

• Adequacy of identification of redacted portions and grounds for withholding.
• Propriety of using negative redactions.
• Requirement to cite exemptions on the records themselves versus in response letters.
• CSIS's obligation to assist the requester.

The complainant alleged that National Defence did not conduct a reasonable search for records related to unidentified aerial phenomena (UAP). The investigation found that the institution misinterpreted the request and relied too heavily on a keyword search. An additional search was ordered, which located 11 pages of previously unreleased records. National Defence has stated it will comply with the order to release these records.

• Reasonableness of search
• Interpretation of access request
• Use of keyword search

An individual complained that Transport Canada failed to publish a description of the Personal Information Bank (PIB) for its Incentives for Zero-Emission Vehicles Program. The investigation found that Transport Canada did not submit the PIB description for approval until 19 months after the program launched, and it was still not approved by the Treasury Board Secretariat (TBS) by the time the OPC's report was issued. Transport Canada has since confirmed the PIB has been approved and published.

• Failure to publish a Personal Information Bank (PIB) description for a program
• Timeliness of PIB approval and publication by government institutions and TBS
• Adequate notification to individuals about the collection and use of their personal information

Twenty federal employees complained after the Treasury Board of Canada Secretariat (TBS) mistakenly disclosed their email addresses and the fact they had filed claims for damages related to the Severe Phoenix Impacts program. The OPC found that TBS contravened the Privacy Act by improperly disclosing personal information. While TBS argued the breach was not material, the OPC disagreed, emphasizing the importance of contextual factors and the potential for harm, even if not all individuals experienced severe injury.

• Was the disclosure of personal information authorized under the Privacy Act?
• Was the privacy breach considered "material" by TBS?
• Did TBS conduct a holistic and context-informed assessment of the breach's materiality and potential harm?