Canadian privacy & access decisions

The complainant alleged that Indigenous Services Canada (ISC) failed to respond to an access request within the extended due date. The request sought all transactions and communications related to providing safe drinking water to Grassy Narrows First Nation during a 25-year boil water advisory. ISC initially received over 17,000 pages of responsive records, leading to the file being backlogged due to volume and ongoing litigation. Despite the complainant agreeing to significantly narrow the scope of the request to final versions containing scientific analysis and sampling data, reducing the record count to an estimated 6,500 pages, ISC was unable to provide a work plan or an estimated response date. The Information Commissioner found that ISC failed to meet its obligation to respond within the extended period and ordered the institution to provide a complete response within 75 business days. ISC confirmed it would implement the order.

• Whether Indigenous Services Canada responded to the access request within the extended time limit under subsection 9(1) of the Access to Information Act
• Whether Indigenous Services Canada's failure to provide a work plan or estimated response date after the scope was narrowed constituted a contravention of its obligations under the Act

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld At-Sea Observer (ASO) data for black dogfish bycatch from 2000-2021 under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act, and that it applied an unofficial "Rule of 5" policy. During the investigation, DFO also suggested the information could fall under subsection 19(1). The Commissioner found that DFO failed to demonstrate that the information met the requirements for exemption under paragraph 20(1)(b), as it was not shown to be financial, commercial, scientific, or technical, nor objectively confidential, nor consistently treated as confidential by third parties. Similarly, DFO's arguments for withholding under paragraph 20(1)(c) were deemed speculative and lacked evidence of a reasonable expectation of harm without identifiable third parties. The Commissioner also concluded that the information did not meet the requirements of subsection 19(1) because there was no serious possibility of identifying individuals, a finding supported by the Office of the Privacy Commissioner. Finally, the investigation revealed that DFO did not apply the alleged "Rule of 5" policy to this access request. The complaint was found to be well founded, and DFO was ordered to disclose all the information.

• Whether the requested information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA.
• Whether the requested information was confidential under s.20(1)(b) ATIA.
• Whether the requested information was supplied by a third party under s.20(1)(b) ATIA.
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA.
• Whether disclosure of the information could reasonably be expected to cause material financial impact on a third party or injure its competitive position under s.20(1)(c) ATIA.
• Whether the information constituted personal information under s.19(1) ATIA.
• Whether DFO applied an unofficial internal policy ("Rule of 5") to refuse access to the information.
• Whether DFO adequately identified third parties for notification under s.33 and s.35(2)(c) ATIA.

The complainant alleged that Global Affairs Canada (Global Affairs) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act concerning consultations on military operations. During the investigation, Global Affairs made a supplementary disclosure but continued to withhold certain portions. The OIC found that Global Affairs failed to demonstrate that all requirements for the claimed exemptions were met and did not reasonably exercise its discretion regarding disclosure. Specifically, the OIC determined that much of the information was not foreign-sourced as required by s.13(1) and that Global Affairs did not adequately justify the harm required for s.15(1), especially given prior disclosures of similar information. The Commissioner informed Global Affairs of her intention to order disclosure and re-exercise of discretion. Global Affairs subsequently released all previously withheld information, rendering a formal order unnecessary. The complaint was found to be well founded.

• Whether the information was obtained in confidence from a specified government body under s.13(1)
• Whether Global Affairs reasonably exercised its discretion to disclose information under s.13(2)
• Whether disclosure could reasonably be expected to harm international affairs, national security, or defence under s.15(1)
• Whether Global Affairs reasonably exercised its discretion to disclose information under s.15(2)

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld information under several provisions of the Access to Information Act and failed to conduct a reasonable search for records related to a marine water incident. The OIC investigation found that VFPA did not demonstrate that some withheld information qualified as personal information or advice/recommendations. Specifically, information related to an employee's functions was not personal information, and certain reports and factual information did not constitute advice or recommendations. However, the OIC found that VFPA's application of solicitor-client privilege and its exercise of discretion for other exemptions were reasonable. The OIC also concluded that VFPA conducted a reasonable search for records. The complaint was found to be well-founded because VFPA improperly withheld some information under subsection 19(1) and paragraph 21(1)(a). VFPA was ordered to disclose specific information, and the institution agreed to implement the order.

• Whether s.19(1) ATIA (personal information) was properly applied to information about an individual's functions as an employee
• Whether s.19(1) ATIA (personal information) was properly applied to other personal information
• Whether VFPA reasonably exercised discretion under s.19(2) ATIA for personal information
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to information in a report prepared for the institution
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to factual information
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to exchanges of advice or recommendations
• Whether VFPA reasonably exercised discretion under s.21(1)(a) ATIA for advice or recommendations
• Whether s.23 ATIA (solicitor-client privilege) was properly applied to information related to legal advice
• Whether VFPA reasonably exercised discretion under s.23 ATIA for solicitor-client privilege
• Whether VFPA conducted a reasonable search for records

An anonymous applicant complained that the Privy Council Office (PCO) improperly withheld information under multiple sections of the Access to Information Act (ATIA) in response to a request for records concerning the "Intelligence Advisory Committee (IAC) Mandate and Membership." During the investigation, PCO failed to provide any representations to justify its application of exemptions, despite multiple requests from the Office of the Information Commissioner (OIC). The Commissioner found that PCO did not meet the burden of proof for exemptions under subsections 13(1), 15(1), 16(1), 16(2), 18, and 24(1), citing reasons such as the Canadian origin of information, prior disclosures, inconsistent redactions, the age of the records, and the absence of justification. While subsection 19(1) was upheld for certain personal information, the Commissioner found no basis for PCO to exercise discretion to release it. Consequently, the Commissioner concluded the complaint was well founded and ordered PCO to fully disclose all responsive records improperly withheld. PCO subsequently gave notice that it would not fully implement the order and attempted to provide late submissions, but the Commissioner rejected these new arguments and maintained the original order.

• Whether s.13(1) applied to Canadian-authored analysis concerning foreign governments or international events
• Whether s.13(1) applied given the absence of representations from PCO
• Whether s.15(1) applied given prior disclosures of identical information by other federal institutions
• Whether s.15(1) applied to distribution markings given prior disclosures by PCO and other departments
• Whether s.15(1) applied given inconsistent redactions of the same document within the records
• Whether s.15(1) applied given the absence of representations from PCO explaining the nature of harm
• Whether s.16(1)(a) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(b) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(c) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(d) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(2) applied given the decades-old nature of the information and the absence of representations explaining how it could facilitate an offence today
• Whether s.18(a) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(b) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(c) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(d) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.19(1) applied to personal information of other individuals
• Whether PCO properly exercised discretion under s.19(2) to release personal information
• Whether s.24(1) applied to the acronym "CSIS" given its public nature and prior disclosures
• Whether s.24(1) applied to names of CSIS employees without representations explaining covert status or continued protection
• Whether PCO's submissions made after the initial report should be considered

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records in response to an access request for weightlifting-related communication records from two specific Sport Canada employees. Initially, the complaint also included allegations of improper withholding under s.19(1) and s.20(1)(b), but these were later withdrawn by the complainant, narrowing the investigation to the reasonable search aspect. Canadian Heritage released five pages of records but did not provide sufficient representations to the OIC regarding the keywords used, the search for call logs and text messages, or the timing of decisions on appeals. The Commissioner found that the institution's search was likely not broad enough and that it failed to demonstrate the reasonableness of its search efforts. Consequently, the complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether Canadian Heritage provided sufficient representations to explain its search methodology

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency's (CBSA) handling of access to information requests related to the ArriveCAN application. The investigation focused on the completeness and timeliness of responses. While allegations of permanent destruction of emails were not substantiated, the investigation revealed that the ArriveCAN project team used the communication platform Slack, which was permanently deleted in May 2023 without consultation with the ATIP unit or content review. This led to a finding that the CBSA failed to conduct reasonable searches for six ArriveCAN-related access requests, as Slack was not searched despite likely containing responsive records. The investigation also identified broader weaknesses in information management, including the use of non-government email accounts and insufficient governance over third-party tools. Although the CBSA failed to meet legislated timelines for some ArriveCAN requests, no unique timeliness concerns specific to the initiative were identified. The complaint was found to be well-founded, and the CBSA accepted the Commissioner's recommendations for corrective measures.

• Whether the Canada Border Services Agency conducted reasonable searches for records related to ArriveCAN access requests
• Whether the deletion of the ArriveCAN Slack workspace impacted the completeness of responses to access requests
• Whether the Canada Border Services Agency's information management practices were adequate for access to information purposes
• Whether the Canada Border Services Agency responded to ArriveCAN-related access requests within legislated timelines

The Office of the Privacy Commissioner of Canada (OPC) initiated complaints against X Corp. and X.AI LLC following reports that their AI chatbot, Grok, generated millions of sexualized deepfakes of identifiable individuals. The investigation focused on whether valid consent was obtained for the collection, use, and disclosure of personal information for this purpose, and if such practices were appropriate under PIPEDA. The OPC found that neither company obtained valid consent, noting the sensitive nature of the information, the unreasonableness of individuals' expectations, and the significant risk of harm. Furthermore, the OPC concluded that the generation of sexualized deepfakes was inappropriate, as the loss of privacy and harm far outweighed any benefits, and less privacy-invasive means were available. While the companies implemented some safeguards, the OPC deemed their initial response insufficient and their current measures unproven. Consequently, the matter was found well-founded, with the OPC making several recommendations for improved safeguards, proactive monitoring, and annual third-party audits, while committing to ongoing monitoring.

• Whether PIPEDA applies to X Corp. and X.AI LLC, specifically regarding the existence of a "real and substantial connection" to Canada.
• Whether deepfakes of identifiable individuals, including sexualized deepfakes, constitute "personal information" under PIPEDA.
• Whether X Corp. and X.AI LLC obtained valid consent for the collection, use, and disclosure of personal information to generate sexualized deepfakes, as required by Principle 4.3 of PIPEDA.
• Whether express consent was required for the generation of sexualized deepfakes, considering the sensitivity of the information, individuals' reasonable expectations, and the risk of significant harm (Principle 4.3.4, 4.3.5, and s.6.1 of PIPEDA).
• Whether X Corp. and X.AI LLC are accountable for ensuring valid consent for content generated by their tools in the course of commercial activity.
• Whether a reasonable person would consider the collection, use, and disclosure of personal information for the purpose of an image generation service capable of producing sexualized deepfakes to be appropriate in the circumstances, as per subsection 5(3) of PIPEDA.
• Whether the organizations had a legitimate need or bona fide business interest that extended to providing an image generation tool capable of producing non-consensual sexualized deepfakes.
• Whether less privacy-invasive means were available to achieve the organizations' purposes at comparable cost and benefits.
• Whether the loss of privacy and risk of harm associated with sexualized deepfakes were proportionate to the benefits of the practice.
• Whether X Corp. and X.AI LLC's initial response and implemented safeguards were sufficient and effective in preventing the generation of sexualized deepfakes.

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (solicitor-client privilege) of the Access to Information Act. The request sought documents related to the appointment of an administrator for a Lieutenant Governor. While the Commissioner found that the information met the requirements for solicitor-client privilege, LAC's initial exercise of discretion not to release the 93-year-old record was deemed unreasonable. LAC had a policy to release such records if over 100 years old, but failed to consider other relevant factors like the content, context, and the fact that involved individuals were long deceased. During the investigation, LAC re-exercised its discretion, considering these factors, and subsequently released all the information. The complaint was found to be well-founded due to the initial unreasonable exercise of discretion, but no order was necessary as the information was ultimately disclosed.

• Whether the information met the requirements of s.23 ATIA (solicitor-client privilege)
• Whether the institution reasonably exercised its discretion not to disclose information subject to s.23 ATIA

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly withheld personal information under subsection 19(1) of the Access to Information Act. The request sought records related to weightlifting in 2023 and 2024, specifically confirmation letters, athlete rationale forms, and appeals. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The investigation found that Canadian Heritage's search was too narrow, as it only used one athlete's name despite the request not being limited to a specific individual. While the institution provided explanations for the non-existence of some specific records, the Commissioner concluded that the overall search was not reasonable and additional records might exist. The Information Commissioner ordered Canadian Heritage to conduct a new, broader search and provide a new response to the complainant.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether s.19(1) personal information exemption was properly applied

The complainant alleged that the Canadian Food Inspection Agency (CFIA) failed to respond to an access request within the 30-day statutory period. The request sought records related to the cull of ostriches at Universal Ostrich Farms. The CFIA was deemed to have refused access due to the delay, which it attributed to ongoing RCMP investigations, safety and security concerns, and the volume of records. The Information Commissioner found the CFIA's delay in searching and gathering records to be irresponsible and a blatant disregard for the Act. The Commissioner noted that the Act does not permit an institution to 'pause' a request due to sensitivity or a strategic plan for multiple requests. The Commissioner ordered the CFIA to provide a complete response within 36 business days of the final report. The CFIA confirmed it would implement the order and had already begun retrieving and reviewing records.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (ongoing RCMP investigations, safety/security concerns, volume of records) justified the failure to respond within statutory timelines
• Whether the Access to Information Act authorizes an institution to 'pause' a response to an access request

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly claimed that some records did not exist in response to an access request for communications between Canadian Olympic Committee staff and Sport Canada staff related to weightlifting. The investigation found that the institution's search scope was too narrow, as it only used one athlete's name for keywords and did not adequately explain why certain repositories like Outlook were not searched. Furthermore, the OIC identified specific responsive records that were not provided by Canadian Heritage. The Commissioner concluded that Canadian Heritage did not conduct a reasonable search and that additional records likely exist. The complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether Canadian Heritage improperly responded that some or all requested records do not exist

The complainant alleged that the Department of Justice Canada improperly withheld a "Final report: Mandatory Minimum Penalties. Recommendations to the Minister of Justice and Attorney General of Canada. Expert Panel on Sentencing Reform" under sections 14 and 21(1)(a) of the Access to Information Act. The Department argued that disclosure would harm federal-provincial affairs and that the report constituted advice or recommendations from internal-like advisors. The Commissioner found no reasonable expectation of harm to federal-provincial affairs, noting the report was six years old, drafted by volunteers, and did not detail active negotiations or provincial positions. Furthermore, the Commissioner determined that the report was prepared by external consultants, not employees or ministerial staff, thus falling under an exception to the advice and recommendations exemption. Consequently, the Commissioner ordered the Department to disclose the records in their entirety, and the Department agreed to comply.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to the records
• Whether disclosure of the report could reasonably be expected to harm the conduct of federal-provincial affairs
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the records
• Whether the report was prepared by consultants or advisers who were not directors, officers, or employees of an institution or members of a minister's staff, as per s.21(2)(b) ATIA

The complainant alleged that the Business Development Bank of Canada (BDC) improperly refused to process an access request for records related to three companies. BDC argued that the requester had not confirmed their right of access and that any responsive records would ultimately be withheld due to statutory confidentiality obligations. The Information Commissioner found that the request met the requirements of section 6 of the Access to Information Act, as it was in writing, made to the correct institution, and provided sufficient detail. The Commissioner also determined that the complainant, a corporation located in Canada, had met the right of access under section 4 of the Act. BDC's demand for proof of identification and board resolutions was deemed an improper prerequisite to processing the request. The Commissioner concluded that BDC was obligated to process the request and issue a proper response under sections 7 and 10 of the Act. The complaint was found to be well founded, and BDC was ordered to accept and process the request.

• Whether the access request met the requirements of section 6 of the ATIA
• Whether the complainant, a corporation, met the right of access under section 4 of the ATIA
• Whether BDC's demand for proof of identification and board resolutions was a valid prerequisite to processing the request
• Whether BDC's refusal to process the request based on anticipated exemptions was appropriate

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee telephone numbers under paragraph 16(2)(c) of the Access to Information Act, claiming disclosure could facilitate the commission of an offence. The request was for a telephone list for the CRA Headquarters International and Large Business Directorate. The complainant also initially alleged an unreasonable search, but later withdrew this aspect of the complaint. The CRA argued that disclosing cell phone numbers, now widely used by employees, could lead to hacking, interception of communications, identity theft, fraud, and harassment, citing vulnerabilities like SS7 attacks. However, the OIC found that the CRA failed to provide clear and convincing evidence of a reasonable expectation of harm, noting that government devices are encrypted and employees are trained on security risks. The OIC also pointed out that some of the numbers were already publicly available, undermining the CRA's claim of harm. The Information Commissioner concluded that the CRA did not meet the requirements for applying paragraph 16(2)(c). The complaint was deemed well founded, and the CRA subsequently released the withheld phone numbers.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to withhold employee telephone numbers
• Whether there was a reasonable expectation of harm from disclosing employee telephone numbers
• Whether the institution's security measures for government devices mitigated the risk of harm
• Whether the public availability of some employee telephone numbers undermined the claim of harm
• Whether the institution conducted a reasonable search for records