Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against the Treasury Board of Canada Secretariat (TBS) regarding its personal information practices for monitoring employee on-site presence under the federal government's hybrid work model. The complainant alleged invasive collection, use, and disclosure of personal information, questioning TBS's compliance with sections 4, 6, 7, and 8 of the Privacy Act, as well as transparency, necessity, proportionality, and Privacy Impact Assessment (PIA) requirements. The OPC found that TBS's collection of aggregated data for organizational compliance was for non-administrative purposes, authorized by existing statutes, and appropriately de-identified to fall outside the scope of the Act for disclosure. For individual compliance, managers primarily relied on observation and self-reporting, supported by internal guidance. While TBS's practices were largely compliant, the OPC encouraged TBS to update its Personal Information Bank (PIB) description for Physical Access Controls (PSU 907) to explicitly reflect the potential use of access logs in formal investigations and to clearly communicate this to employees. Overall, the OPC concluded that TBS's personal information handling practices were compliant with the Privacy Act.

• Whether the collection of employees' personal information for on-site presence monitoring was related directly to TBS's operating programs or activities under section 4 of the Privacy Act.
• Whether TBS's retention and disposal practices for personal information collected for on-site presence monitoring complied with section 6 of the Privacy Act, specifically subsections 6(1) and 6(3).
• Whether TBS's use of personal information for on-site presence monitoring was a 'consistent use' authorized under section 7(a) of the Privacy Act.
• Whether TBS's disclosure of aggregated on-site presence data to senior management constituted personal information under section 3 of the Privacy Act and complied with section 8.
• Whether TBS's transparency and openness related to its hybrid compliance monitoring approach, including standard Personal Information Banks (PIBs), was adequate under sections 10 and 11 of the Privacy Act.
• Whether TBS's personal information practices for on-site presence monitoring complied with the necessity and proportionality data principles.
• Whether TBS was required to complete a Privacy Impact Assessment (PIA) for its verification regime.
• Whether managers' practices for monitoring individual compliance with the hybrid work model contravened the Privacy Act.

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the 30-day period stipulated by section 7 of the Access to Information Act. The request sought extensive information related to the Métis Nation, treaties, and the Native Women's Association of Canada, covering a broad historical period. LAC argued that the request was too broad and vague, lacking sufficient detail for experienced employees to identify specific records with reasonable effort, and that responding would require extensive historical and legal research beyond its mandate. The OIC determined that the request did not meet the requirements of section 6 of the Act, which mandates that requests provide enough detail for records to be identified with reasonable effort. Despite LAC's attempts to seek clarification and offer assistance through its reference services, the complainant did not provide further specifics. Consequently, the OIC concluded that LAC was not obligated to process the request and was not in deemed refusal. The complaint was found to be not well founded.

• Whether Library and Archives Canada responded to the access request within the 30-day period
• Whether the access request provided enough detail for experienced institutional employees to identify relevant records with a reasonable effort under section 6 of the ATIA
• Whether the institution's efforts to seek clarification from the requester were reasonable
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the ATIA

The complainant alleged that the Privy Council Office's (PCO) record-keeping practices for appointment processes did not comply with the Access to Information Act (ATIA), specifically regarding the disposal of interview notes. PCO stated that selection members take notes during interviews to aid deliberations, but these are considered transitory records and are disposed of after the final advice letter to the Minister is prepared, which constitutes the official record. The complainant also suggested PCO's practices might constitute an offense under the ATIA. The investigation found no evidence that records were destroyed with the intent to deny a right of access. Instead, the interview notes were deemed transitory records used in preparing advice letters. The Commissioner concluded that there was no obligation under the ATIA for PCO to retain these notes, nor did their destruction violate the Act. The complaint was therefore not well founded.

• Whether PCO's record-keeping practices for appointment processes comply with the ATIA
• Whether interview notes taken by selection members are transitory records
• Whether there was an obligation under the ATIA for PCO to retain interview notes
• Whether the destruction of interview notes constituted an offense under s.67.1 of the ATIA (destruction with intent to deny access)

The complainant alleged that National Defence (DND) improperly refused to issue a new response letter after providing contextual information in its initial response to an access request. The request sought policy records, regulations, directives, orders, and instructions concerning the authority to generate Branch Standing Orders within the Canadian Armed Forces. DND's initial response stated that no responsive records were found but included additional information, such as hyperlinks to publicly available documents and an explanation using cautious language like "might," to assist the requester. The complainant argued this contextual information was speculative and not based on documented records, thus contravening DND's duty to assist under subsection 4(2.1) of the Access to Information Act. The OIC found that DND's inclusion of supplementary information, clearly distinguished from the official response, was an attempt to assist the requester in good faith and did not misrepresent the existence of records or create new ones. Therefore, DND was not obligated to issue a new response letter.

• Whether National Defence improperly refused to issue a new response letter
• Whether the inclusion of contextual information in a 'no records' response contravenes the duty to assist under subsection 4(2.1) ATIA
• Whether the contextual information was speculative and not grounded in documented records
• Whether the institution's response was complete and appropriate under subsection 10(1) ATIA

The complainant alleged that Correctional Service Canada (CSC) improperly withheld information from the institutional file of a named inmate, claiming numerous exemptions under the Access to Information Act. CSC withheld over 11,000 pages, disclosing only 149 in full, primarily citing subsection 19(1) for personal information. The Commissioner found that the records contained detailed, intimate, and sensitive personal information about the inmate and other individuals, satisfying the requirements of subsection 19(1). CSC demonstrated that it made reasonable efforts to seek consent from the named inmate but not from others, providing valid reasons for the latter. The Commissioner also found that CSC was not obligated to undertake extensive searches to determine if the information was publicly available given its nature and volume. Furthermore, CSC's delegated authority considered the public interest in disclosure but concluded it did not clearly outweigh the invasion of privacy, providing a transparent explanation. The Commissioner concluded that none of the circumstances under subsection 19(2) for discretionary disclosure were met, and therefore, CSC was not required to exercise discretion. Consequently, the complaint was not well founded.

• Whether the information withheld by CSC constitutes personal information under subsection 19(1) ATIA
• Whether the information is about an individual
• Whether disclosing the information would identify that individual
• Whether the information falls under an exception to the definition of 'personal information' in the Privacy Act
• Whether CSC made reasonable efforts to seek consent for disclosure under paragraph 19(2)(a) ATIA
• Whether the information was publicly available under paragraph 19(2)(b) ATIA
• Whether the public interest in disclosure clearly outweighed the invasion of privacy under paragraph 19(2)(c) ATIA, as per section 8 of the Privacy Act
• Whether the open court principle applies to CSC or the Parole Board
• Whether the complainant was deprived of their section 2(b) Charter rights

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act, concerning investigation reports into the deaths of two individuals. The RCMP demonstrated that the records met the requirements for exemption under s.16(1)(a), as they were created less than 20 years prior, obtained by an investigative body during a lawful investigation into crime detection/suppression and law enforcement. The Commissioner found that the RCMP reasonably exercised its discretion not to disclose the information, having considered relevant factors including investigative integrity and privacy. While acknowledging the RCMP's correct application of the Act, the Commissioner noted a gap in the legislation regarding the disclosure of deceased individuals' personal information for compassionate reasons. The complaint was ultimately found not well founded.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the information concerned an investigation related to the detection, prevention or suppression of crime or the enforcement of any law of Canada or a province
• Whether the records were created less than 20 years before the access request was made
• Whether the institution reasonably exercised its discretion to decide whether to disclose the information

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request for emails, text messages, and briefing notes related to companies working on the ArriveCAN application. The complainant specifically questioned the absence of text messages in the records provided. The Office of the Information Commissioner (OIC) investigated CBSA's search efforts, including the program areas involved, search parameters, and policies regarding text message management. CBSA explained that text messages are often considered transitory, especially if followed by an email, and that employees are responsible for saving non-transitory messages to a corporate repository. The OIC found that the Offices of Primary Interest conducted searches in appropriate repositories and that it was reasonable to believe that relevant text messages either did not exist or were not considered relevant at the time of the request, in line with CBSA and Treasury Board Secretariat policies. Consequently, the Information Commissioner concluded that CBSA conducted a reasonable search.

• Whether the Canada Border Services Agency conducted a reasonable search for records
• Whether text messages related to the ArriveCAN application existed and should have been provided
• Whether CBSA's information management policies regarding text messages were appropriately applied

The complainant, a father involved in a custody dispute, submitted an ATIP request to Immigration, Refugees and Citizenship Canada (IRCC) for his minor child's passport application, which had been submitted by his former spouse. He provided a court order authorizing him to obtain his children's information from third parties. IRCC denied the request, stating that the child's consent was required. The complainant alleged that IRCC improperly denied access despite the court order. The OPC investigated whether the complainant had a right of access under paragraph 10(a) of the Privacy Regulations, which allows access on behalf of a minor under certain conditions. The OPC found that while the child was a minor and the complainant had legal authorization to administer the child's affairs, the request was not made on the child's behalf, but rather for the complainant's own interests. Therefore, the third condition of paragraph 10(a) was not met, and IRCC's denial was deemed reasonable.

• Whether the complainant had a right of access to his child’s personal information under section 10 of the Privacy Regulations
• Whether the child was a minor at the time of the ATIP request
• Whether the complainant had legal authorization to administer the child's affairs
• Whether the complainant exercised the right of access on the minor’s behalf
• Whether the child had the decision-making capacity to provide consent for the release of their personal information

The complainant alleged that Health Canada's 1,000-day extension of time to respond to an access request was unreasonable. The request sought information regarding an application for religious exemption to serve ayahuasca. Health Canada claimed the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, citing a large volume of records (over 14,000 pages) and the need for extensive consultations, particularly with its Legal Services Unit, due to the sensitive and precedent-setting nature of the subject matter. The institution argued that processing the request within a shorter timeframe would unreasonably interfere with its operations and that consultations could not be completed within 30 days. The Information Commissioner found that Health Canada met all the requirements for both paragraphs 9(1)(a) and 9(1)(b), concluding that the calculation of the extension was logical and supportable, and that the extension was reasonable. Consequently, the complaint was deemed not well founded, and the due date for the response remains December 19, 2025.

• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under s.9(1)(a)
• Whether the extension of time was for a reasonable period under s.9(1)(a)
• Whether consultations were necessary under s.9(1)(b)
• Whether consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to named companies and expenses. The Office of the Information Commissioner (OIC) investigated by reviewing CBSA's search efforts, including the program areas tasked and the search parameters. The OIC found that the Office of Primary Interest (OPI) most likely to hold relevant records, the Information, Science and Technology Branch, had searched appropriate repositories and provided 896 pages of documents for processing. Based on this, the Commissioner concluded that CBSA conducted a reasonable search. The complaint was therefore deemed not well founded.

• Whether the institution conducted a reasonable search for records

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for records related to social distancing guidance. PHAC claimed a 1,380-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, setting the response due date to February 11, 2027. The OIC investigated whether PHAC met the requirements for such an extension. PHAC demonstrated that its calculation was logical and supportable, and that processing the request in a shorter timeframe would unreasonably interfere with its operations. The OIC concluded that PHAC had met all the requirements of the Act for the extension. Consequently, the complaint was found to be not well founded, and the extension was deemed reasonable.

• Whether the 1,380-day extension of time claimed by PHAC under s.9(1)(a) and s.9(1)(b) was reasonable
• Whether PHAC's calculation of the time extension was sufficiently logical and supportable
• Whether providing access within a materially lesser period would unreasonably interfere with PHAC's operations
• Whether consultations could reasonably be completed within 30 days

A representative, on behalf of a deceased member's estate executor, requested personal information from the Department of National Defence (DND) related to an investigation into allegations against the deceased. DND processed the request informally and disclosed some information under subparagraph 8(2)(m)(i) of the Privacy Act, but did not explicitly state its refusal to process the request formally under paragraph 10(b) of the Privacy Regulations. The OPC investigated whether the representative was entitled to make the request for the purpose of administering the estate. The OPC found that while the representative was authorized to administer the estate, they did not sufficiently demonstrate a connection between the requested information and the administration of the estate. Therefore, the complaint was not well-founded, as the representative failed to meet the requirements of paragraph 10(b) of the Regulations.

• Whether the representative was authorized to make a request on behalf of the deceased under paragraph 10(b) of the Regulations
• Whether the request related only to the administration of the deceased's estate under paragraph 10(b) of the Regulations
• Whether DND complied with section 16 of the Privacy Act regarding refusal notifications
• Whether DND properly processed the request informally without explicit written consent and notification of rights

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) inappropriately disclosed his Permanent Resident Card (PRC) renewal paperwork to the Canada Border Services Agency (CBSA), which was then used in a cessation application, contrary to the purpose for which it was collected. The OPC investigated whether IRCC was authorized to disclose this personal information to the CBSA under paragraph 8(2)(a) of the Privacy Act, which permits disclosure for a consistent use. IRCC and CBSA argued that their information sharing for the administration and enforcement of the Immigration and Refugee Protection Act (IRPA) constitutes a consistent use. The OPC found that the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB) explicitly stated that information might be shared with CBSA for investigations related to immigration legislation. Therefore, the OPC concluded that the disclosure was for a consistent use, and the complaints against both departments were not well-founded.

• Whether IRCC's disclosure of the complainant's personal information to CBSA was authorized under paragraph 8(2)(a) of the Privacy Act
• Whether the use of the personal information by CBSA in a cessation application was consistent with the purpose for which it was collected by IRCC
• Whether the complainant could reasonably expect the disclosure of his PRC renewal application to CBSA for immigration investigations