Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding a privacy breach. IRCC inadvertently disclosed the personal information of 497 individuals when sending mass email notifications for a work permit extension program. An employee failed to apply a filter to the email address column in an Excel spreadsheet, causing email addresses to misalign with other personal data, leading to notifications being sent to incorrect recipients. The OPC found that IRCC contravened section 8 of the Privacy Act by disclosing personal information without a permissible purpose and that its prevention measures were insufficient. While IRCC's mitigation efforts, including notifying affected individuals, were deemed adequate, the OPC recommended implementing robust procedural and administrative controls. IRCC accepted these recommendations, committing to measures such as a 'two pairs of eyes' rule, updated operating procedures, and data quality assurance checks. Consequently, the OPC considered the matter resolved.

• Whether IRCC's disclosure of personal information to unintended recipients contravened section 8 of the Privacy Act.
• Whether IRCC had sufficient measures in place to prevent unauthorized disclosures of personal information of this nature.
• Whether IRCC's response to mitigate the impact of the breach on affected individuals was adequate.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records related to the Wood Mountain (Lakota) First Nation's land claim from 2000 to 2020. Initially, CIRNAC provided records only from 2017 onwards, claiming no earlier records could be located. The OIC's investigation highlighted the absence of records from key periods, specifically 2009-2012 when the claim was first submitted and rejected, and 2014-2016 when the First Nation filed with the Specific Claims Tribunal. After the OIC's persistent questioning and research, CIRNAC conducted subsequent searches and located additional responsive records. The Information Commissioner concluded that CIRNAC had not conducted a reasonable search and ordered the institution to retrieve and process all newly identified records and issue a new response to the complainant.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records

An applicant complained that the Vancouver Fraser Port Authority (VFPA) improperly withheld an agreement with the Musqueam Indian Band under sections 18(b) and 20(1)(b) of the Access to Information Act. The Commissioner found that while some parts of the agreement could reasonably be expected to interfere with the VFPA's negotiations under s.18(b), other parts were publicly known or deducible and did not meet the exemption criteria. Furthermore, the VFPA failed to reasonably exercise its discretion by not considering factors in favour of disclosure. Regarding s.20(1)(b), the Commissioner determined that the agreement, in its entirety, did not meet the criteria for confidential financial, commercial, scientific, or technical information, particularly because it consisted of negotiated terms rather than information supplied by a third party. The Commissioner ordered the VFPA to disclose information not meeting s.20(1)(b) criteria and to re-exercise discretion for information meeting s.18(b). The VFPA agreed to release some information but did not address the re-exercise of discretion.

• Whether s.18(b) competitive position harm was reasonably expected
• Whether s.18(b) interference with negotiations was reasonably expected
• Whether the VFPA reasonably exercised its discretion under s.18(b)
• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information related to the Laval River slope stabilization project under several sections of the Access to Information Act. Specifically, DFO claimed exemptions under paragraphs 13(1)(c) (confidential information from government bodies), 16(2) (security), 16(2)(c) (facilitating an offence), 19(1) (personal information), and 20(1)(c) (financial impact on a third party). During the investigation, the complainant narrowed the scope, removing the application of subsections 16(2) and 19(1) to signatures where the signing authority's name was present. The Information Commissioner found that DFO failed to demonstrate that the information withheld under paragraph 13(1)(c) was obtained in confidence, and neither DFO nor the third party justified the application of paragraph 20(1)(c). However, the Commissioner upheld the application of subsection 19(1) for personal information. Consequently, the Commissioner ordered DFO to release all information previously withheld under paragraphs 13(1)(c) and 20(1)(c), with the exception of the personal information properly withheld under subsection 19(1). DFO notified the Commissioner that it would implement the order.

• Whether s.13(1)(c) ATIA (confidential information from government bodies) was properly applied
• Whether the information was obtained in confidence for s.13(1)(c) ATIA
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether the information is about an individual for s.19(1) ATIA
• Whether there is a serious possibility of identification for s.19(1) ATIA
• Whether the information falls under exceptions to the definition of personal information for s.19(1) ATIA
• Whether DFO reasonably exercised discretion under s.19(2) ATIA
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether disclosure could result in material financial loss or gain to the third party for s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm for s.20(1)(c) ATIA
• Whether disclosure could injure the competitive position of the third party for s.20(1)(c) ATIA

The complainant alleged that Global Affairs Canada (Global Affairs) failed to conduct a reasonable search for records related to 2010 roundtable discussions on international education and the "London Statement." The initial search yielded few records, prompting the Office of the Information Commissioner (OIC) to question the institution. Global Affairs admitted that additional responsive records should have existed but were not preserved due to inadvertence, including improper filing, destruction of IT accounts, and a malfunctioning USB drive. Following further inquiries from the OIC, Global Affairs conducted additional searches, including tasking former employees, which led to the discovery of additional responsive records on an internal drive and a CD-ROM. The Commissioner found that Global Affairs did not conduct a reasonable search initially and raised concerns about its information management practices. The complaint was found to be well founded, and Global Affairs was ordered to provide the newly found records and implement information management recommendations.

• Whether Global Affairs Canada conducted a reasonable search for records
• Whether additional responsive records ought to have existed
• Whether the institution's information management practices were adequate

The complainant alleged that Health Canada improperly withheld information under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act. The request sought records related to an Abbreviated New Drug Submission (ANDS) for the medicinal ingredient "tacrolimus." Specifically, the complaint focused on the dates of correspondence between a third party and Health Canada, which were withheld concurrently under both exemptions. The Commissioner found that the dates did not constitute "commercial" information as required by paragraph 20(1)(b), citing Supreme Court jurisprudence that administrative details like dates are not typically commercial. Regarding paragraph 20(1)(c), the Commissioner determined that neither Health Canada nor the third party provided convincing evidence that disclosing these specific dates would lead to a reasonable expectation of material financial harm or competitive prejudice. The evidence presented was deemed too speculative. Consequently, the Commissioner concluded that neither exemption applied and ordered Health Canada to disclose the dates.

• Whether the dates of correspondence constitute "financial, commercial, scientific or technical information" under s.20(1)(b) ATIA
• Whether the information is confidential under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether disclosure of the dates could reasonably be expected to result in material financial loss or gain to the third party under s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm occurring under s.20(1)(c) ATIA

The complainant alleged that Fisheries and Oceans Canada (DFO) failed to conduct a reasonable search for records related to the Old Fort Band, Fort Babine Band, and Lake Babine Nation in British Columbia between 1871 and 1960. During the investigation, the Office of the Information Commissioner (OIC) requested additional information from DFO regarding its search parameters and program areas tasked. In response, DFO conducted a second search, including an additional program area not originally tasked, which resulted in the retrieval of approximately 7000 additional responsive pages. The OIC concluded that DFO's initial search was not reasonable, but the subsequent search satisfied the requirement for a reasonable search. The Information Commissioner ordered DFO to complete the retrieval of the identified records and provide a new response to the complainant within 60 days. DFO agreed to implement the order.

• Whether Fisheries and Oceans Canada conducted a reasonable search for records

The complainant alleged that Transport Canada improperly withheld portions of a Hazardous Occurrence Investigation Report concerning a Canadian National Railway (CN) employee's death, citing subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The Information Commissioner found that certain information, such as train numbers, track numbers, and locations, did not meet the requirements for exemption under subsection 19(1) as their disclosure would not create a serious possibility of identifying individuals. While some information did qualify as personal information, Transport Canada failed to demonstrate it had properly exercised its discretion under paragraph 19(2)(c) regarding public interest disclosure. Furthermore, the Commissioner concluded that the institution and CN did not prove that the information withheld under paragraph 20(1)(b) met all four requirements of that exemption, particularly regarding confidentiality and public interest. Consequently, the complaint was found to be well founded, and Transport Canada was ordered to disclose the information not properly exempted.

• Whether information such as train numbers, track numbers, and locations constitutes personal information under s.19(1) ATIA
• Whether disclosure of portions of witness statements would create a serious possibility of identification under s.19(1) ATIA
• Whether Transport Canada reasonably exercised its discretion under s.19(2)(c) ATIA regarding public interest disclosure
• Whether the withheld information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the withheld information is confidential by an objective standard under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

The complainant alleged that Natural Resources Canada (NRCan) improperly withheld information under various sections of the Access to Information Act in response to a request for records related to a specific contract. During the investigation, the Office of the Information Commissioner (OIC) narrowed the scope to NRCan's application of paragraphs 20(1)(b) and 20(1)(c). NRCan and the third party, Welund North America, failed to demonstrate that all requirements for these exemptions were met for most of the withheld information. The OIC found that only a void cheque and unit prices/quantities qualified for exemption. The Commissioner recommended that NRCan disclose all other information previously withheld under these paragraphs. NRCan made an additional disclosure but did not fully implement the recommendation. The complaint was found to be well founded.

• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information is confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether disclosure could result in material financial loss or gain to the third party under s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm under s.20(1)(c) ATIA
• Whether disclosure could injure the competitive position of the third party under s.20(1)(c) ATIA

The complainant alleged that National Defence (DND) failed to conduct reasonable searches for records related to specific contracts under the Access to Information Act. The OIC investigation found that DND had not attempted to retrieve records from a third-party contractor, despite being entitled to them under the contract, nor had it searched paper records or a cloud-based platform. While DND initially argued the records were not under its control, it later conceded this point. As a result of the OIC's investigation, DND contacted the contractor and retrieved additional documents from the cloud platform. The Information Commissioner concluded that DND's initial searches were not reasonable. The complaints were found to be well founded, and DND was ordered to process the newly located records and provide new responses to the complainant.

• Whether National Defence conducted reasonable searches for records related to contracts W6369-21-X008 and W6369-19-X033/A
• Whether records held by a third-party contractor, which National Defence was entitled to obtain, were under the control of National Defence
• Whether National Defence adequately searched paper records
• Whether National Defence adequately searched cloud-based platforms

The complainant alleged that Parks Canada improperly withheld information under various sections of the Access to Information Act in response to a request for records related to Benga Mining or the Grassy Mountain Coal Project. The institution withheld information under subsection 19(1) (personal information), paragraphs 21(1)(a), (b), (c) (advice, consultations, plans), and section 23 (litigation privilege). During the investigation, Parks Canada disclosed a portion of the record initially withheld under paragraph 21(1)(a) due to the passage of time. The Commissioner found that the remaining information withheld under subsection 19(1), paragraph 21(1)(a), and section 23 met the criteria for exemption and that the institution had reasonably exercised its discretion. The Commissioner also addressed the complainant's concern about records marked as "not relevant," finding that Parks Canada was justified in not processing these records given the complainant's prior agreement to narrow the scope of the request. Despite upholding the institution's application of most exemptions, the complaint was found to be well-founded because the institution initially improperly withheld information under paragraph 21(1)(a) that was later released.

• Whether s.19(1) personal information exemption was properly applied
• Whether discretion under s.19(2) was reasonably exercised
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether discretion under s.21(1)(a) was reasonably exercised
• Whether s.21(1)(b) accounts of consultations or deliberations exemption was properly applied
• Whether s.21(1)(c) positions or plans developed for negotiations exemption was properly applied
• Whether s.23 litigation privilege exemption was properly applied
• Whether discretion under s.23 was reasonably exercised
• Whether Parks Canada was justified in not processing records deemed 'not relevant' based on complainant's prior agreement

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all information sought under the Privacy Act, specifically regarding the cancellation and reissuing of visas for the complainant and her children. The investigation found that IRCC initially narrowed the scope of the request without the complainant's approval and did not conduct a sufficiently broad search for records. The OPC determined that IRCC did not initially conduct a reasonable search for records. However, during the investigation, IRCC expanded its search to include additional offices and a specific former employee's correspondence. Although no additional records were found, IRCC's subsequent efforts satisfied the OPC that it had met its obligations under the Act.

• Whether IRCC conducted a reasonable search for records responsive to the access request
• Whether IRCC improperly reduced the scope of the request without the complainant's approval
• Whether IRCC tasked all appropriate Offices of Primary Interest (OPIs) in its initial search

An individual complained that Canada Post (CPC) was using personal information gathered from the outside of delivered envelopes and parcels to create mail marketing lists, which it then rented to the private sector. The Office of the Privacy Commissioner (OPC) investigated whether CPC's Smartmail Marketing Program (SMM Program) complied with the Privacy Act. The OPC found that CPC's collection of personal information for the SMM Program was directly related to an operating program (s.4) and that its use and disclosure were for an original purpose of collection (s.7 and s.8), thus compliant with these sections. However, the OPC determined that the SMM Program constituted an "administrative purpose" under the Act, and CPC had failed to obtain individuals' authorization for the indirect collection of their personal information, contravening section 5. CPC disagreed with this finding and refused to implement the OPC's recommendation to cease the practice without authorization, proposing only enhanced transparency measures which the OPC deemed insufficient. Consequently, the complaint was found to be well-founded and not resolved.

• Whether Canada Post's collection of personal information for marketing mail list services complies with section 4 of the Privacy Act (related directly to an operating program or activity).
• Whether Canada Post's use and disclosure of personal information for marketing mail list services complies with sections 7 and 8 of the Privacy Act (for the purpose obtained or consistent use, or with consent).
• Whether Canada Post's collection of personal information for marketing mail list services complies with section 5 of the Privacy Act (direct collection for administrative purpose, or with authorization).
• Whether the use of an individual's information to provide mail marketing services constitutes an "administrative purpose" under section 3 of the Privacy Act.
• Whether individuals implicitly authorized Canada Post to indirectly collect their personal information for the SMM Program by accepting mail delivery or through the availability of an opt-out mechanism.
• Whether the exceptions under subsection 5(3) of the Privacy Act apply.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsections 19(1), 20(1)(a), 20(1)(b), and 20(1)(c) of the Access to Information Act in response to a request for correspondence between DFO and Deep Water Recovery. During the investigation, the application of subsection 19(1) was removed from the scope of the complaint, and both DFO and the third party conceded that paragraphs 20(1)(a) and 20(1)(c) should not have been applied. The investigation therefore focused on paragraph 20(1)(b). The Commissioner found that neither DFO nor Deep Water Recovery demonstrated that the information met all the requirements for confidentiality under paragraph 20(1)(b), specifically that the information was not publicly available and that there was a reasonable expectation of confidentiality. Consequently, the Commissioner concluded that the information did not meet the requirements of paragraph 20(1)(b). The complaint was found to be well founded, and DFO was ordered to disclose the information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.20(1)(a) third-party trade secrets exemption was properly applied
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether the information was available from sources otherwise accessible by the public (confidentiality criterion)
• Whether the information was communicated with a reasonable expectation that it would not be disclosed (confidentiality criterion)
• Whether the information was communicated in a relationship fostered for public benefit by its confidentiality (confidentiality criterion)
• Whether the OIC's notice to third parties under s.36.3 breached natural justice and procedural fairness

The complainant alleged that the Public Health Agency of Canada (PHAC) failed to conduct a reasonable search for records related to the fee schedule or dispersal of payments to provinces and territories under the Budget Implementation Act, 2021. During the investigation, the OIC requested information from PHAC regarding its search parameters and program areas involved. In response, PHAC re-tasked its program areas, which led to the retrieval of approximately 104 additional responsive pages. Although PHAC initially failed to conduct a reasonable search, the subsequent efforts satisfied the Commissioner that a reasonable search had ultimately been performed. The Commissioner ordered PHAC to complete the retrieval and processing of these newly identified records and issue a new response to the complainant within 60 days. PHAC agreed to implement the order.

• Whether the institution conducted a reasonable search for records