Federal (Canada) Privacy Decisions

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld records related to the loan of objects for an exhibit under several exemptions in the Access to Information Act. The exemptions claimed included those related to competitive advantage, government financial interests, personal information, and third-party financial interests and negotiations. The institution failed to provide sufficient representations to support the application of these exemptions. The OIC found that photographs of human remains could not be withheld under the personal information exemption, as the individuals were either not identifiable or had been deceased for over 20 years. The OIC ordered the disclosure of all information at issue, and the institution agreed to comply.

• Burden of proof for exemptions
• Definition of personal information for deceased individuals
• Adequacy of representations to support exemptions
• Status of the Coroner's office as a third party

Following a data breach involving the Starwood hotel database, the Office of the Privacy Commissioner of Canada (OPC) investigated Marriott International, Inc. The investigation found that Marriott's security safeguards, accountability measures, and information retention practices were inadequate at the time of the breach, leading to unauthorized access to personal information. While Marriott has taken remedial actions and the complaint is conditionally resolved, the OPC highlighted failures in access controls, antivirus software, logging and monitoring, and information storage. The OPC also found Marriott contravened accountability principles by not adequately assessing security risks during its acquisition of Starwood and retaining personal information longer than necessary.

• Adequacy of security safeguards for personal information
• Marriott's accountability and due diligence during the acquisition of Starwood
• Timeliness of information retention and deletion practices
• Adequacy of notification and mitigation measures for affected individuals

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information regarding the total remuneration of its highest-paid unionized employees. The CBC claimed exemptions under paragraph 18(b) (competitive position) for specific salary figures. The Information Commissioner found that disclosing these exact salaries could indeed harm the CBC's competitive position in a limited market, and that the CBC reasonably exercised its discretion in withholding the information. Therefore, the complaint was found not well founded.

• Proper application of paragraph 18(b) of the Access to Information Act
• Reasonable expectation of harm to the institution's competitive position
• Reasonable exercise of discretion by the institution to withhold information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Access to Information consultant. ESDC claimed exemptions for personal information, financial impact on third parties, consultations or deliberations, solicitor-client privilege, and restrictions by other laws. The Information Commissioner found that ESDC improperly withheld information concerning the consultant's job duties and experience, some third-party financial details, and certain accounts of deliberations. The Commissioner ordered ESDC to disclose this information and to re-evaluate consent for some personal information.

• Proper application of subsection 19(1) (personal information)
• Proper application of paragraph 20(1)(c) (financial impact on third party)
• Proper application of paragraph 21(1)(b) (accounts of consultations or deliberations)
• Reasonable exercise of discretion for exemptions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 12 third parties under paragraph 20(1)(c) of the Access to Information Act. The institution and several third parties argued that disclosure could harm competitive positions or financial interests. The Information Commissioner found that neither ISED nor the third parties met the burden of proving that disclosure would cause harm beyond the merely possible. The Commissioner ordered ISED to disclose the information.

• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(c) of the ATIA regarding financial impact on a third party.
• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(d) of the ATIA regarding interference with third-party negotiations.
• Whether the third parties or the institution met their burden of proof to demonstrate that disclosure would cause harm beyond the merely possible.
• Whether the disclosure of the information was in the public interest.

The institution applied to the Information Commissioner to decline to act on an access request, arguing it was vexatious and an abuse of the right to access information. The requester had made multiple, repetitive requests for similar information, much of which had already been provided to them. The Commissioner found the request to be an abuse of the access right due to this pattern of behaviour and the fact that the requester was not seeking new information. The Commissioner also found that the institution had fulfilled its duty to assist the requester.

• Whether the access request constituted an abuse of the right of access.
• Whether the institution met its duty to assist obligations.
• Whether the access request was vexatious.

The Information Commissioner of Canada gave notice that she ceased to investigate a complaint. The Commissioner determined the complaint was trivial, as the complainant wished to pursue the matter as a point of principle, despite the issue having already been settled and showing a seeming lack of interest in obtaining the records.

• Whether the complaint was trivial, frivolous, or vexatious under subsection 30(4)(a) of the ATIA.

The complainant requested the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations from the Canada Revenue Agency (CRA). The CRA withheld the total amount of CEWS received by each company, citing exemptions under the Access to Information Act (ATIA), including subsection 24(1) (disclosure restricted by another law). The OIC found that the withheld information was about identifiable taxpayers and was prepared for the purposes of administering the Income Tax Act, and therefore properly withheld under subsection 24(1). Consequently, the complaint was found not well founded.

• Whether the CEWS database information was properly withheld under subsection 24(1) of the ATIA, citing section 241 of the Income Tax Act.
• Whether the information was properly withheld under paragraph 16(1)(c) (conduct of investigations) and subsection 19(1) (personal information) of the ATIA.