Canadian privacy & access decisions

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency's (CBSA) handling of access to information requests related to the ArriveCAN application. The investigation focused on the completeness and timeliness of responses. While allegations of permanent destruction of emails were not substantiated, the investigation revealed that the ArriveCAN project team used the communication platform Slack, which was permanently deleted in May 2023 without consultation with the ATIP unit or content review. This led to a finding that the CBSA failed to conduct reasonable searches for six ArriveCAN-related access requests, as Slack was not searched despite likely containing responsive records. The investigation also identified broader weaknesses in information management, including the use of non-government email accounts and insufficient governance over third-party tools. Although the CBSA failed to meet legislated timelines for some ArriveCAN requests, no unique timeliness concerns specific to the initiative were identified. The complaint was found to be well-founded, and the CBSA accepted the Commissioner's recommendations for corrective measures.

• Whether the Canada Border Services Agency conducted reasonable searches for records related to ArriveCAN access requests
• Whether the deletion of the ArriveCAN Slack workspace impacted the completeness of responses to access requests
• Whether the Canada Border Services Agency's information management practices were adequate for access to information purposes
• Whether the Canada Border Services Agency responded to ArriveCAN-related access requests within legislated timelines

The Office of the Privacy Commissioner of Canada (OPC) initiated complaints against X Corp. and X.AI LLC following reports that their AI chatbot, Grok, generated millions of sexualized deepfakes of identifiable individuals. The investigation focused on whether valid consent was obtained for the collection, use, and disclosure of personal information for this purpose, and if such practices were appropriate under PIPEDA. The OPC found that neither company obtained valid consent, noting the sensitive nature of the information, the unreasonableness of individuals' expectations, and the significant risk of harm. Furthermore, the OPC concluded that the generation of sexualized deepfakes was inappropriate, as the loss of privacy and harm far outweighed any benefits, and less privacy-invasive means were available. While the companies implemented some safeguards, the OPC deemed their initial response insufficient and their current measures unproven. Consequently, the matter was found well-founded, with the OPC making several recommendations for improved safeguards, proactive monitoring, and annual third-party audits, while committing to ongoing monitoring.

• Whether PIPEDA applies to X Corp. and X.AI LLC, specifically regarding the existence of a "real and substantial connection" to Canada.
• Whether deepfakes of identifiable individuals, including sexualized deepfakes, constitute "personal information" under PIPEDA.
• Whether X Corp. and X.AI LLC obtained valid consent for the collection, use, and disclosure of personal information to generate sexualized deepfakes, as required by Principle 4.3 of PIPEDA.
• Whether express consent was required for the generation of sexualized deepfakes, considering the sensitivity of the information, individuals' reasonable expectations, and the risk of significant harm (Principle 4.3.4, 4.3.5, and s.6.1 of PIPEDA).
• Whether X Corp. and X.AI LLC are accountable for ensuring valid consent for content generated by their tools in the course of commercial activity.
• Whether a reasonable person would consider the collection, use, and disclosure of personal information for the purpose of an image generation service capable of producing sexualized deepfakes to be appropriate in the circumstances, as per subsection 5(3) of PIPEDA.
• Whether the organizations had a legitimate need or bona fide business interest that extended to providing an image generation tool capable of producing non-consensual sexualized deepfakes.
• Whether less privacy-invasive means were available to achieve the organizations' purposes at comparable cost and benefits.
• Whether the loss of privacy and risk of harm associated with sexualized deepfakes were proportionate to the benefits of the practice.
• Whether X Corp. and X.AI LLC's initial response and implemented safeguards were sufficient and effective in preventing the generation of sexualized deepfakes.

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (solicitor-client privilege) of the Access to Information Act. The request sought documents related to the appointment of an administrator for a Lieutenant Governor. While the Commissioner found that the information met the requirements for solicitor-client privilege, LAC's initial exercise of discretion not to release the 93-year-old record was deemed unreasonable. LAC had a policy to release such records if over 100 years old, but failed to consider other relevant factors like the content, context, and the fact that involved individuals were long deceased. During the investigation, LAC re-exercised its discretion, considering these factors, and subsequently released all the information. The complaint was found to be well-founded due to the initial unreasonable exercise of discretion, but no order was necessary as the information was ultimately disclosed.

• Whether the information met the requirements of s.23 ATIA (solicitor-client privilege)
• Whether the institution reasonably exercised its discretion not to disclose information subject to s.23 ATIA

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly withheld personal information under subsection 19(1) of the Access to Information Act. The request sought records related to weightlifting in 2023 and 2024, specifically confirmation letters, athlete rationale forms, and appeals. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The investigation found that Canadian Heritage's search was too narrow, as it only used one athlete's name despite the request not being limited to a specific individual. While the institution provided explanations for the non-existence of some specific records, the Commissioner concluded that the overall search was not reasonable and additional records might exist. The Information Commissioner ordered Canadian Heritage to conduct a new, broader search and provide a new response to the complainant.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether s.19(1) personal information exemption was properly applied

The complainant alleged that the Canadian Food Inspection Agency (CFIA) failed to respond to an access request within the 30-day statutory period. The request sought records related to the cull of ostriches at Universal Ostrich Farms. The CFIA was deemed to have refused access due to the delay, which it attributed to ongoing RCMP investigations, safety and security concerns, and the volume of records. The Information Commissioner found the CFIA's delay in searching and gathering records to be irresponsible and a blatant disregard for the Act. The Commissioner noted that the Act does not permit an institution to 'pause' a request due to sensitivity or a strategic plan for multiple requests. The Commissioner ordered the CFIA to provide a complete response within 36 business days of the final report. The CFIA confirmed it would implement the order and had already begun retrieving and reviewing records.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (ongoing RCMP investigations, safety/security concerns, volume of records) justified the failure to respond within statutory timelines
• Whether the Access to Information Act authorizes an institution to 'pause' a response to an access request

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly claimed that some records did not exist in response to an access request for communications between Canadian Olympic Committee staff and Sport Canada staff related to weightlifting. The investigation found that the institution's search scope was too narrow, as it only used one athlete's name for keywords and did not adequately explain why certain repositories like Outlook were not searched. Furthermore, the OIC identified specific responsive records that were not provided by Canadian Heritage. The Commissioner concluded that Canadian Heritage did not conduct a reasonable search and that additional records likely exist. The complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether Canadian Heritage improperly responded that some or all requested records do not exist

The complainant alleged that the Department of Justice Canada improperly withheld a "Final report: Mandatory Minimum Penalties. Recommendations to the Minister of Justice and Attorney General of Canada. Expert Panel on Sentencing Reform" under sections 14 and 21(1)(a) of the Access to Information Act. The Department argued that disclosure would harm federal-provincial affairs and that the report constituted advice or recommendations from internal-like advisors. The Commissioner found no reasonable expectation of harm to federal-provincial affairs, noting the report was six years old, drafted by volunteers, and did not detail active negotiations or provincial positions. Furthermore, the Commissioner determined that the report was prepared by external consultants, not employees or ministerial staff, thus falling under an exception to the advice and recommendations exemption. Consequently, the Commissioner ordered the Department to disclose the records in their entirety, and the Department agreed to comply.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to the records
• Whether disclosure of the report could reasonably be expected to harm the conduct of federal-provincial affairs
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the records
• Whether the report was prepared by consultants or advisers who were not directors, officers, or employees of an institution or members of a minister's staff, as per s.21(2)(b) ATIA

The complainant alleged that the Business Development Bank of Canada (BDC) improperly refused to process an access request for records related to three companies. BDC argued that the requester had not confirmed their right of access and that any responsive records would ultimately be withheld due to statutory confidentiality obligations. The Information Commissioner found that the request met the requirements of section 6 of the Access to Information Act, as it was in writing, made to the correct institution, and provided sufficient detail. The Commissioner also determined that the complainant, a corporation located in Canada, had met the right of access under section 4 of the Act. BDC's demand for proof of identification and board resolutions was deemed an improper prerequisite to processing the request. The Commissioner concluded that BDC was obligated to process the request and issue a proper response under sections 7 and 10 of the Act. The complaint was found to be well founded, and BDC was ordered to accept and process the request.

• Whether the access request met the requirements of section 6 of the ATIA
• Whether the complainant, a corporation, met the right of access under section 4 of the ATIA
• Whether BDC's demand for proof of identification and board resolutions was a valid prerequisite to processing the request
• Whether BDC's refusal to process the request based on anticipated exemptions was appropriate

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee telephone numbers under paragraph 16(2)(c) of the Access to Information Act, claiming disclosure could facilitate the commission of an offence. The request was for a telephone list for the CRA Headquarters International and Large Business Directorate. The complainant also initially alleged an unreasonable search, but later withdrew this aspect of the complaint. The CRA argued that disclosing cell phone numbers, now widely used by employees, could lead to hacking, interception of communications, identity theft, fraud, and harassment, citing vulnerabilities like SS7 attacks. However, the OIC found that the CRA failed to provide clear and convincing evidence of a reasonable expectation of harm, noting that government devices are encrypted and employees are trained on security risks. The OIC also pointed out that some of the numbers were already publicly available, undermining the CRA's claim of harm. The Information Commissioner concluded that the CRA did not meet the requirements for applying paragraph 16(2)(c). The complaint was deemed well founded, and the CRA subsequently released the withheld phone numbers.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to withhold employee telephone numbers
• Whether there was a reasonable expectation of harm from disclosing employee telephone numbers
• Whether the institution's security measures for government devices mitigated the risk of harm
• Whether the public availability of some employee telephone numbers undermined the claim of harm
• Whether the institution conducted a reasonable search for records

The complainant alleged that Health Canada improperly withheld information related to a COVID-19 Vaccine Periodic Safety Update Report under sections 13(1), 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that Health Canada correctly applied section 13(1) and 19(1) to some information, but failed to reasonably exercise its discretion under section 13(2) for publicly available information. The Commissioner also found that Health Canada and the third party (Pfizer) did not establish that sections 20(1)(b) or 20(1)(c) applied. Consequently, the Commissioner ordered Health Canada to disclose information not covered by sections 13(1) or 19(1), and to re-evaluate the disclosure of section 13(1) information that is publicly available. Health Canada agreed to comply with the order.

• Whether s.13(1) ATIA applied to information obtained from the European Medical Agency (EMA)
• Whether Health Canada reasonably exercised its discretion under s.13(2) ATIA regarding publicly available information
• Whether s.19(1) ATIA applied to personal information that could identify individuals
• Whether Health Canada reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA applied to confidential third-party financial, commercial, scientific or technical information
• Whether s.20(1)(c) ATIA applied to information that could cause financial impact or harm competitive position to a third party

The OPC investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding its systematic practice of withholding access to certain personal information in its Global Case Management System (GCMS). IRCC's policy was to retrieve and process only a "Short Form" GCMS Report in response to access requests, even when individuals requested their entire file or specific content found in the "Long Form." The OPC found that the "History Section" of the GCMS file, which is part of the Long Form, contained the complainant's personal information and that IRCC's practice contravened Section 12 of the Privacy Act. While IRCC eventually provided the complainant with the requested Long Form, it did not agree to update its procedures to systematically retrieve and process the Long Form for all future requests. Consequently, the OPC found the complaint well-founded but not resolved, as IRCC had not committed to addressing the systemic issue.

• Whether IRCC's practice of providing only a "Short Form" GCMS Report in response to access requests contravenes Section 12 of the Privacy Act
• Whether the "History Section" of the GCMS file contains personal information
• Whether information in the "Long Form" GCMS Report is always exempt from disclosure
• Whether IRCC has an obligation to retrieve and process all records responsive to a Privacy Act request

An employee of the Canada Border Services Agency (CBSA) filed a complaint after their personal information, including sensitive details about an accommodation request, was inadvertently made accessible to other CBSA employees through the Apollo information management system. The issue stemmed from improperly set permissions on an old ATIP file folder, which allowed document titles and sometimes the first line of emails containing personal information to be visible via Apollo's search function. The OPC found that the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority. While the CBSA corrected the specific permissions and committed to broader reviews and improved naming conventions, it did not agree to implement mandatory and trackable training for employees on Apollo permissions management. Consequently, the OPC found the complaint well-founded but unresolved, as it was not satisfied that sufficient safeguards were in place to prevent recurrence.

• Whether the CBSA contravened section 8 of the Privacy Act by disclosing personal information without consent or legal authority
• Whether the CBSA appropriately responded to the unauthorized disclosure
• Whether the CBSA's proposed measures, without mandatory and trackable training, are sufficient to prevent future unauthorized disclosures

The complainant alleged that Transport Canada failed to respond to an access request within the statutory 30-day period and improperly handled the request before opening the file. The request sought correspondence related to the Greater Toronto Airports Authority (GTAA) concerning noise, flight path changes, passenger-based formulas, and airspace redesign. The investigation found that Transport Canada did not respond within the 30-day timeframe, largely due to delays from a primary Office of Primary Interest (OPI) in retrieving records, exacerbated by a building fire that prevented access to paper records. Electronic records were also not processed while waiting for paper records. However, the Commissioner found that Transport Canada did not improperly handle the request initially, as it reasonably sought clarification when the request did not explicitly name the institution. The complaint regarding the delay was found to be well-founded, and Transport Canada was ordered to provide a complete response within 120 business days. Transport Canada indicated it would not fully implement the order, stating it would provide an interim response instead.

• Whether Transport Canada responded to the access request within the 30-day period as per section 7 of the Access to Information Act
• Whether Transport Canada improperly handled the request before opening the file
• Whether Transport Canada met its duty to assist the complainant under subsection 4(2.1)

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to a previous access request (A-2012-00683) and a 10-page "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate that a reasonable search had been conducted, particularly regarding a second search by its Records Operations unit for which details were lacking. The Commissioner concluded that PCO did not conduct a reasonable search. Consequently, the complaint was deemed well founded, and PCO was ordered to conduct a new search, process any additional records found, and provide a supplementary response to the complainant within 36 business days. PCO did not indicate whether it would comply with the order.

• Whether the institution conducted a reasonable search for records

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for Microsoft Teams messages and related policies. ISED claimed a 390-day extension, citing the volume of records, complexity, and the need for senior-level review, as well as internal and external consultations. The Commissioner found that ISED failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to determine the necessary length. Specifically, the 240-day extension for volume and interference was deemed excessive, and the 150-day extension for consultations lacked sufficient justification. The Commissioner concluded that the extension was invalid, leading to a deemed refusal of access. The complaint was found to be well-founded, and ISED was ordered to provide a complete response within 60 business days.

• Whether the 240-day extension under s.9(1)(a) ATIA for volume and interference was reasonable
• Whether the 150-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether ISED made a serious effort to assess the necessary length of the extension of time
• Whether there was a link between the reasons for the extension and its length
• Whether the calculation of the length of the extension was sufficiently rigorous, logical, and supportable
• Whether ISED was in deemed refusal under s.10(3) ATIA