Canadian privacy & access decisions

The complainant alleged that Transport Canada's 510-day time extension to respond to an access request was unreasonable. The request sought records related to the implementation of new testing and quarantine measures for non-essential international air travel. Transport Canada justified the extension under paragraphs 9(1)(a) for a large volume of records, 9(1)(b) for necessary consultations with five other government institutions, and 9(1)(c) for third-party consultations. The Commissioner found that the request involved a large volume of records (over 3,000 pages) and that responding within 30 days would unreasonably interfere with Transport Canada's operations, particularly due to COVID-19 restrictions limiting on-site access to classified documents. The Commissioner also determined that consultations with other government bodies and third parties were necessary and could not be completed within 30 days. The Commissioner concluded that the total 510-day extension was reasonable given the circumstances, including the pandemic's impact on operations and the complexity of consultations. Therefore, the complaint was not well founded.

• Whether the time extension taken by Transport Canada was unreasonable
• Whether the request was for a large number of records or required searching through a large number of records (s.9(1)(a))
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations (s.9(1)(a))
• Whether the extension of time was for a reasonable period, given the circumstances (s.9(1)(a))
• Whether consultations on the requested records were necessary (s.9(1)(b))
• Whether consultations could reasonably be completed within 30 days (s.9(1)(b))
• Whether the extension of time for consultations was for a reasonable period, given the circumstances (s.9(1)(b))
• Whether consultations with third parties were necessary (s.9(1)(c))
• Whether the extension of time for third-party consultations was for a reasonable period, given the circumstances (s.9(1)(c))
• Whether Transport Canada met the requirements to claim an extension of time by notifying the requester within 30 days

The complainant alleged that National Defence (DND) conducted an incomplete search for records related to the Official Radio Log Book of the HMCS Shawinigan for a specific period in 2016. During the investigation, the Office of the Information Commissioner (OIC) found that DND had tasked the Royal Canadian Navy (RCN) to retrieve the records, but the RCN reported them as "lost." DND conducted a Summary Investigation into the disappearance of the log pages, which revealed that the log book had been transferred and used by another vessel, and the relevant pages had been removed. Despite extensive efforts, including interviews with crew members, DND's investigation could not definitively determine when or how the pages went missing. The OIC concluded that DND conducted a reasonable search, tasking appropriate sectors and making reasonable efforts, but the records could not be found. The OIC noted the implications of deficiencies in records management but found no basis to conclude that DND failed its search obligations or that records could reasonably be found.

• Whether National Defence conducted a reasonable search for the requested records

The complainant alleged that Library and Archives Canada (LAC) failed to conduct a reasonable search for an index containing information about all military personnel who served in World War II. The investigation revealed that LAC does not possess such a comprehensive index. While LAC holds paper-based World War II personnel records, these also include personnel from other conflicts and do not contain information on reservists. Furthermore, these records have not been digitized or used to create an electronic database from which a complete list could be generated. Although LAC can respond to requests for specific individuals, the Commissioner found that the institution does not have the requested index. Therefore, the Commissioner concluded that LAC's search was reasonable given the non-existence of the requested record.

• Whether Library and Archives Canada conducted a reasonable search for an index of all military personnel who served in World War II

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to conduct a reasonable search for a recording of a specific Microsoft Teams meeting and related communications. PSPC confirmed that while Microsoft Teams has recording capabilities, this function was not used for the meeting in question, and therefore no recording existed. The institution also stated that the meeting was informal and did not involve activities or decisions requiring record creation under its policies. The OIC's investigation found that PSPC tasked the appropriate program area and IT branch to search for the records, and re-tasked meeting attendees, but no responsive records were identified. The OIC concluded that PSPC took reasonable steps to identify and locate responsive records, even though none were found. Consequently, the complaint was deemed not well founded.

• Whether Public Services and Procurement Canada conducted a reasonable search for a recording of a Microsoft Teams meeting
• Whether Public Services and Procurement Canada conducted a reasonable search for communications regarding a Microsoft Teams meeting
• Whether there was an obligation for Public Services and Procurement Canada to create a record of the informal meeting

The complainant alleged that Employment and Social Development Canada (ESDC) improperly stated it could not process an access request for emails to and from a named employee, containing specific keywords. ESDC argued the emails were not under its control, despite being on its servers, because they were personal and lacked business value. The Office of the Information Commissioner (OIC) investigated whether the records were "under the control" of ESDC, considering factors such as institutional purpose, relation to ESDC's mandate, and integration with other records. The OIC found the emails were entirely personal, had no institutional purpose, and ESDC had no authority to regulate their use or disposition. Therefore, the OIC concluded the emails were not under ESDC's control and not subject to the Access to Information Act. The complaint was deemed not well founded.

• Whether the requested emails were "under the control" of Employment and Social Development Canada (ESDC) as per the Access to Information Act
• Whether the contents of the emails related to an institutional matter and involved ESDC's mandate, obligations, functions, and operations
• Whether the emails were created to fulfill any ESDC officer's or employee's duties or functions and/or were intended for any employment-related purpose
• Whether the emails were created to fulfill a statutory requirement imposed on ESDC
• Whether ESDC relied on the emails when preparing government records
• Whether ESDC had any authority with regard to the use or disposition of the emails
• Whether communicating the contents of the emails required the authorization of an ESDC officer or employee
• Whether the emails were integrated with other ESDC records

The complainant alleged that the Privy Council Office (PCO) improperly withheld the names of employees within the Prime Minister's Office under subsection 19(1) of the Access to Information Act. The request sought records related to the Minister of Revenue's announcement regarding audits of registered charities for political activities. The OIC's investigation focused on the application of subsection 19(1) to the names of exempt staff appearing in email chains. PCO argued that the information was personal information, citing a Supreme Court decision that clarified information about exempt staff is personal information. The OIC agreed that the names, in context, revealed more than just their identity and title, thus meeting the requirements for personal information and not falling under the exceptions in the Privacy Act. Furthermore, the OIC found that none of the circumstances under subsection 19(2) for discretionary disclosure existed, as consent was not given, and the specific context of their involvement was not publicly available. Therefore, the OIC concluded that the complaint was not well founded.

• Whether the names of employees within the Prime Minister's Office constitute 'personal information' under s.19(1) ATIA
• Whether the information falls under exceptions to the definition of 'personal information' in paragraphs 3(j) to 3(m) of the Privacy Act
• Whether the information falls under the exception in paragraph 3(j.1) of the Privacy Act for ministerial advisers or staff members
• Whether the individuals consented to the release of their personal information under s.19(2)(a) ATIA
• Whether the information was publicly available under s.19(2)(b) ATIA
• Whether disclosure would be consistent with section 8 of the Privacy Act under s.19(2)(c) ATIA
• Whether the institution reasonably exercised its discretion to disclose the information under s.19(2) ATIA

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request related to the Competition Bureau’s bread price-fixing investigation. ISED claimed a 1,460-day extension under paragraph 9(1)(a) of the Access to Information Act, citing the large volume of records (over 75 million pages) and the need to search 100 terabytes of information. The OIC found that the request involved a large number of records and that meeting the 30-day deadline would unreasonably interfere with ISED's operations. The OIC also determined that ISED applied sufficient rigour in calculating the extension, considering the time needed by the program area and the Access to Information and Privacy Office, and the complexity of the records. Consequently, the OIC concluded that the 1,460-day extension was reasonable and justified. The complaint was not well founded, and the OIC invited ISED to consider disclosing completed packages of records as they become available.

• Whether the request was for a large number of records or required searching through a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period, given the circumstances, under paragraph 9(1)(a)
• Whether the institution validly claimed the extension of time by notifying the requester within 30 days

The complainant alleged that the Canadian Security Intelligence Service (CSIS) took an unreasonable time extension under paragraph 9(1)(b) of the Access to Information Act for consultations. CSIS justified a 240-day extension, citing the necessity of consulting with two other government institutions, the high classification and sensitivity of the records, the need for on-site review, and limited workplace access due to the pandemic. The Office of the Information Commissioner (OIC) found that CSIS made a serious effort to determine the extension's length based on the pandemic's realities. The OIC concluded that the time extension was reasonable given the circumstances and that CSIS met the three requirements for claiming such an extension. Therefore, the complaint was not well founded.

• Whether the time extension taken under paragraph 9(1)(b) for consultations was reasonable
• Whether CSIS met the three requirements to claim the time extension

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act. The requested information pertained to a complaint investigated by the RCMP. The OIC's investigation determined that the withheld information was obtained by the RCMP, an investigative body specified in the regulations, during a lawful investigation related to the detection, prevention, or suppression of crime. Furthermore, the information was created less than twenty years before the request. The OIC also found that the RCMP reasonably exercised its discretion by considering relevant factors for and against disclosure, including the purpose of the Act and the private interests of other individuals. Consequently, the OIC concluded that the information met the requirements for exemption under paragraph 16(1)(a) and that the institution's decision to withhold it was appropriate.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the investigation concerned the detection, prevention, or suppression of crime, enforcement of law, or threats to security of Canada
• Whether the information was created less than 20 years before the access request
• Whether the institution reasonably exercised its discretion to decide whether to release the information under s.16(1)(a)

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information under subsection 24(1) of the Access to Information Act. The request sought income-related information regarding business ownership for a specific individual. The CRA claimed that the information was exempt from disclosure because section 241 of the Income Tax Act (ITA) restricts its release. The Office of the Information Commissioner (OIC) found that the requested information constituted "taxpayer information" as defined in subsection 241(10) of the ITA, meaning it related to an identifiable taxpayer (not the complainant) and was obtained by the CRA for administering the ITA. Consequently, the OIC concluded that the information met the requirements for exemption under subsection 24(1) of the ATIA. The complaint was therefore deemed not well founded.

• Whether the requested information falls under the definition of "taxpayer information" in subsection 241(10) of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts the disclosure of the requested information
• Whether subsection 24(1) of the Access to Information Act applies to exempt the information from disclosure

The complainant alleged that Health Canada failed to conduct a reasonable search for records in response to two access requests concerning personal or designated producers and users of medical cannabis. Health Canada provided records from one database but argued that retrieving additional potentially relevant information from a second database would be unreasonable due to the extensive manual labour required. The Office of the Information Commissioner (OIC) agreed with Health Canada's position. The OIC found that the institution's search was reasonable, considering the burden of retrieving records from the second database. Consequently, the complaint was not well-founded.

• Whether Health Canada conducted a reasonable search for records under s.4 of the ATIA

The complainant alleged that Transport Canada improperly withheld annual statistics related to processing access to information and privacy requests, citing section 26 of the Access to Information Act. Transport Canada argued that the information was intended for future publication. The Office of the Information Commissioner (OIC) investigated whether the institution met the criteria for applying section 26 and properly exercised its discretion. The OIC found that Transport Canada had satisfied the requirements for section 26 and had considered all relevant factors for and against disclosure. Consequently, the OIC concluded that the institution's decision to withhold the records was appropriate.

• Whether s.26 ATIA (information to be published) was properly applied
• Whether Transport Canada appropriately exercised its discretion under s.26 ATIA

An applicant complained that Health Canada failed to identify all records responsive to an access request and improperly refused to provide an index of all responsive records. The investigation by the Office of the Information Commissioner (OIC) found that Health Canada had conducted a reasonable search for records and there was no evidence that any records were missing. The OIC also determined that Health Canada's refusal to create an index of records did not violate its duty to assist obligations under subsection 4(2.1) of the Access to Information Act. The Commissioner concluded that creating such an index for this specific request would have been unreasonable. Therefore, the complaint was deemed not well-founded.

• Whether Health Canada conducted a reasonable search for responsive records
• Whether Health Canada's refusal to provide an index of responsive records contravened its duty to assist under subsection 4(2.1) ATIA
• Whether creating an index of records for this request would have been unreasonable

The OPC investigated a complaint regarding the unauthorized disclosure of personal information about Supreme Court candidate Chief Justice Glenn Joyal. Media reports claimed an anonymous source revealed a disagreement between the Prime Minister's Office (PMO) and the former Attorney General over Joyal's nomination. The complainant alleged breaches of the Privacy Act by the Privy Council Office (PCO), Department of Justice (DOJ), Office of the Commissioner of Federal Judicial Affairs (CFJA), and the PMO. The OPC determined it lacked jurisdiction over the CFJA and PMO, focusing its investigation on the PCO and DOJ. The investigation found no evidence that either the PCO or the DOJ had access to the specific information that was leaked, nor that the disclosure originated from these institutions. While no contravention was found, the OPC highlighted that Chief Justice Joyal's privacy was compromised and called for legislative reform to extend the Privacy Act's coverage to all government institutions, including Ministers' Offices and the PMO.

• Whether the Office of the Commissioner of Federal Judicial Affairs (CFJA) is a 'government institution' under the Privacy Act
• Whether the Prime Minister's Office (PMO) is a 'government institution' under the Privacy Act
• Whether the Privy Council Office (PCO) was responsible for the unauthorized disclosure of Chief Justice Joyal's personal information under section 8 of the Privacy Act
• Whether the Department of Justice (DOJ) was responsible for the unauthorized disclosure of Chief Justice Joyal's personal information under section 8 of the Privacy Act

A former employee of TD Canada Trust complained that TD outsourced fraud claims processing to a third-party service provider in India without obtaining customer consent or offering an opt-out. The complainant also alleged that TD was not sufficiently open about this practice. The Office of the Privacy Commissioner (OPC) also investigated whether TD maintained accountability by ensuring a comparable level of protection for personal information transferred to the third party. The OPC found that TD was not required to obtain additional consent, as the information was used for the original purpose of fraud claims management for which consent was already obtained. Furthermore, TD was deemed sufficiently open, providing clear information about transfers to foreign jurisdictions in its account agreements and privacy resources. The OPC concluded that TD ensured a comparable level of protection through a robust contract, comprehensive risk assessments, employee controls, cybersecurity measures, and proactive monitoring. Consequently, all aspects of the complaint were found to be not well-founded.

• Whether TD was required to obtain additional consent for transferring personal information to a third-party service provider in India for fraud claims processing (Principle 4.3 PIPEDA)
• Whether TD was required to offer customers an opt-out for the transfer of personal information to a third-party service provider in India for fraud claims processing
• Whether TD was sufficiently open about its practice of transferring personal information to a third-party service provider in a foreign jurisdiction for processing (Principle 4.8 PIPEDA)
• Whether TD ensured a comparable level of protection for personal information processed by the third-party service provider in India (Principle 4.1.3 PIPEDA)