Canadian privacy & access decisions

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) improperly withheld information under paragraph 21(1)(a) of the Access to Information Act. The request sought Fee Analysis Reports and fee monitoring dashboards containing cost recovery information for immigration application programs from 2013-2019. During the investigation, IRCC also invoked section 23 for the entire records. The Commissioner found that the information did not constitute advice or recommendations under paragraph 21(1)(a), as it appeared to be purely factual and devoid of specific advice. Furthermore, IRCC failed to demonstrate that the records were prepared or gathered for the dominant purpose of litigation, as required for section 23. Consequently, the Commissioner concluded that neither exemption applied. Although an order to release the records was initially intended, IRCC released the information in full before the order was issued, rendering it unnecessary.

• Whether the Fee Analysis Reports and fee monitoring dashboards constitute "advice or recommendations" under s.21(1)(a) ATIA
• Whether the information was created by or for a government institution or Minister for the purpose of s.21(1)(a) ATIA
• Whether the information is subject to solicitor-client privilege under s.23 ATIA
• Whether the information is subject to litigation privilege under s.23 ATIA
• Whether the information was prepared or gathered for the dominant purpose of litigation for s.23 ATIA

The complainant alleged that Correctional Service Canada (CSC) improperly withheld information from a contract with Presidia Security Consulting Inc. under subsections 19(1), 20(1)(b), 20(1)(c), and 21(1)(a) of the Access to Information Act. During the investigation, CSC agreed to no longer rely on subsection 21(1)(a) and conceded that some information withheld under subsection 19(1) did not meet the exemption criteria. The Information Commissioner found that CSC had properly applied subsection 19(1) to the remaining personal information, as the criteria were met and no circumstances for discretionary disclosure under subsection 19(2) existed. However, the Commissioner determined that information on page 337 was improperly withheld under paragraphs 20(1)(b) and 20(1)(c), as CSC and Presidia failed to demonstrate how it met the requirements for confidentiality, financial/commercial nature, or potential for financial harm/competitive injury. Consequently, the Commissioner ordered CSC to release the information it had agreed to disclose, as well as the specific information on page 337 previously withheld under section 20. CSC subsequently released the additional information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.19(2) discretion to disclose personal information was required
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether s.21(1)(a) advice or recommendations exemption was properly applied

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 15(1) (national security) and 19(1) (personal information) of the Access to Information Act. The request sought information related to "Active Measures – The Soviet Bloc Practice of Deception, Disruption and Defamation." Initially, LAC withheld the entire 33-page record but later dropped its reliance on subsection 19(1) and released some information. The Information Commissioner found that LAC failed to demonstrate that the remaining withheld information met the requirements of subsection 15(1), noting the extensive public domain information on the topic. Despite the Commissioner's recommendation to disclose all remaining information, LAC refused to implement it. Consequently, the complaint was found to be well founded.

• Whether s.15(1) national security exemption was properly applied
• Whether disclosure could reasonably be expected to harm national security
• Whether the institution provided sufficient justification for the s.15(1) claim
• Whether the information was already in the public domain
• Whether s.19(1) personal information exemption was properly applied

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information from a 1989 RCMP Security Service briefing on Hugh George Hambleton under subsections 13(1), 15(1), and 19(1) of the Access to Information Act. During the investigation, LAC dropped its reliance on subsections 13(1) and 19(1). The Information Commissioner focused on LAC's application of subsection 15(1) (national security). The Commissioner found that a significant amount of information about Hambleton, including his espionage activities, conviction, and parliamentary discussions, was already in the public domain. Consequently, the Commissioner determined that LAC failed to demonstrate a reasonable expectation of harm from disclosure, as required by subsection 15(1). The complaint was found to be well founded, and the Commissioner recommended full disclosure of the records. However, the Minister of Canadian Heritage declined to implement the recommendations.

• Whether s.13(1) ATIA (confidential information from government bodies) was properly applied
• Whether s.15(1) ATIA (national security) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether disclosure of the withheld information could reasonably be expected to harm national security interests under s.15(1)
• Whether the public availability of information about Hugh George Hambleton undermines the application of s.15(1)
• Whether the passage of time affects the applicability of s.15(1)
• Whether the institution fulfilled its burden of demonstrating the requirements of the exemption under s.15(1)

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to respond to an access request within the time limits set out in the Access to Information Act. The request sought records pertaining to specific operational reviews concerning co-operation between CSIS and the Royal Canadian Mounted Police (RCMP). CSIS claimed a 240-day extension, which the OIC previously found to be valid, setting the due date for May 31, 2021. However, CSIS failed to respond by this extended deadline. The OIC found that CSIS was in deemed refusal, noting that the delay was partly due to outstanding consultations with the RCMP and operational challenges from the COVID-19 pandemic. Despite CSIS's stated intention to process records without further delay, it proposed an additional month beyond the RCMP's consultation timeline. The Commissioner concluded that CSIS had not adequately addressed the delay and ordered the institution to complete processing and provide a response within 36 business days.

• Whether CSIS failed to respond to an access request within the time limits
• Whether CSIS was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld GPS tracking records for a specific RCMP vehicle for a 30-minute period on February 19, 2017, under paragraphs 16(1)(c) and 16(2) of the Access to Information Act. The RCMP argued that releasing the GPS coordinates could reveal patrol patterns, facilitate illegal activities, and endanger officers. The Information Commissioner found that the RCMP did not demonstrate how this specific, limited, and four-year-old information could reasonably be expected to cause the alleged harms. The Commissioner also noted that the RCMP failed to explain its exercise of discretion regarding disclosure. Consequently, the complaint was found to be well-founded, and the Commissioner recommended the release of the withheld GPS information.

• Whether s.16(1)(c) law enforcement harm was reasonably expected from the disclosure of specific GPS coordinates
• Whether s.16(2) facilitation of an offence was reasonably expected from the disclosure of specific GPS coordinates
• Whether the institution reasonably exercised its discretion to withhold information under s.16(1)(c)
• Whether the institution reasonably exercised its discretion to withhold information under s.16(2)

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to two access to information requests within the statutory deadlines. The requests sought records related to the procurement of animals for the Prison Farm program run by CORCAN at Collins Bay and Joyceville institutions. PSPC claimed extensions for both requests, citing the volume of records and resource limitations, exacerbated by the COVID-19 pandemic. However, PSPC missed the extended deadlines, leading to a deemed refusal under subsection 10(3) of the Act. The Commissioner found that PSPC had not adequately addressed the unreasonable delay, noting that the complainant had been waiting over two years for a response. The Commissioner concluded that the complaints were well founded and ordered PSPC to provide a final response to both requests forthwith.

• Whether Public Services and Procurement Canada failed to respond to access requests within statutory deadlines
• Whether Public Services and Procurement Canada was in deemed refusal under subsection 10(3) ATIA
• Whether the extensions claimed by Public Services and Procurement Canada were valid
• Whether the delay in processing the requests was unreasonable

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) improperly withheld information under paragraph 16(2)(c) of the Access to Information Act in response to 64 separate access requests. The withheld information was located in the "History" field of IRCC's GCMS Information Request: Application, which IRCC initially claimed would facilitate the commission of an offence if disclosed. IRCC argued that releasing this audit trail could allow individuals to manipulate immigration programs. The OIC investigated, finding that IRCC had not established a reasonable expectation of harm beyond a mere possibility, and the causal link between disclosure and facilitating an offence was too remote. After extensive discussions, IRCC ultimately agreed to release the information in its entirety. Although the information was released, the Commissioner found the complaints to be well founded because IRCC was not justified in its initial withholding.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to information in the "History" field of GCMS records
• Whether there was a reasonable expectation of harm beyond a mere possibility if the information was disclosed
• Whether a causal link existed between the disclosure of information and the facilitation of an offence

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information related to piscine reovirus, heart and skeletal muscle inflammation, the Creative Salmon Company Ltd., or jaundice syndrome, claiming exemptions under paragraphs 18(c), 20(1)(b), and 20(1)(c) of the Access to Information Act. The OIC found that DFO failed to demonstrate that disclosure of the information would threaten the exclusive rights of government researchers to publish their findings first, as required by paragraph 18(c). Furthermore, neither DFO nor the third party, Creative Salmon Ltd., established that the information was confidential, supplied by the third party, or consistently treated as confidential, as required by paragraph 20(1)(b). The OIC also concluded that DFO and Creative Salmon Ltd. did not show a reasonable expectation of substantial financial loss or harm to competitive position from disclosure, as claimed under paragraph 20(1)(c). The Information Commissioner recommended full disclosure of the information, with the exception of personal information. DFO agreed to implement the recommendations, and the complaint was found to be well founded.

• Whether the information was scientific or technical
• Whether the information was obtained through research by a government employee or officer
• Whether disclosing the information could threaten the exclusive rights of government researchers to publish the results of their research first
• Whether there was a reasonable expectation of harm under s.18(c)
• Whether DFO reasonably exercised its discretion under s.18(c)
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether DFO reasonably exercised its discretion under s.20(1)(b)
• Whether disclosing the information could result in substantial financial loss or gain to the third party under s.20(1)(c)
• Whether there is a reasonable expectation of substantial financial loss or gain under s.20(1)(c)
• Whether disclosing the information could injure the competitive position of the third party under s.20(1)(c)
• Whether there is a reasonable expectation of injury to competitive position under s.20(1)(c)
• Whether DFO reasonably exercised its discretion under s.20(1)(c)
• Whether DFO should have considered disclosure under subsection 20(6) for public health, safety, or environmental protection reasons

The complainant alleged that Environment and Climate Change Canada (ECCC) failed to conduct a reasonable search for records related to reports and assessments by the Northgate Group. The investigation revealed that ECCC had overwritten an original draft report from the contractor by saving edits directly onto it, effectively destroying a contract deliverable that should have been preserved in a corporate repository. This action meant the original draft report no longer existed and could not be retrieved, irreversibly undermining the right of access. Although ECCC identified an additional 122 pages of records during the investigation, the destruction of the key draft report was a significant issue. The Commissioner found the complaint to be well founded due to ECCC's failure to preserve a record of business value, impacting the complainant's right of access. ECCC committed to implementing the Commissioner's recommendation for improved training and record-keeping practices.

• Whether Environment and Climate Change Canada conducted a reasonable search for records
• Whether a draft report from a contractor constituted a record of business value
• Whether the destruction of the original draft report by overwriting undermined the right of access

The complainant alleged that Natural Resources Canada (NRCan) failed to conduct a reasonable search for driving data, including GPS data and driver logbook entries from its fleet vehicles, for three specific time periods. The OIC's investigation found that while NRCan's Office of Primary Interest conducted a search of corporate repositories, NRCan also had a responsibility to retrieve GPS data stored with a third-party data storage company. NRCan conceded that this data, though not in its physical possession, was under its control according to the Access to Information Act. Consequently, NRCan retrieved the GPS records and located additional logbook entries, which were subsequently provided to the complainant during the investigation. The Commissioner concluded that NRCan's initial search was not reasonable as it failed to include records under its control held by a third party. The complaint was found to be well founded.

• Whether Natural Resources Canada conducted a reasonable search for records
• Whether GPS data held by a third-party data storage company was under the control of Natural Resources Canada for the purposes of the Access to Information Act

The complainant alleged that the Department of Justice Canada (Justice) failed to conduct a reasonable search for records related to the Asia-Pacific Economic Cooperation (APEC) conference and the Hughes Inquiry. Initially, Justice stated it could not locate any responsive records. However, during the OIC's investigation, it was discovered that Justice had not tasked the National Litigation Sector (NLS), which was identified as the most appropriate Office of Primary Interest. After being tasked, the NLS located over 40,000 pages of responsive records. The Commissioner concluded that Justice did not conduct a reasonable search and found the complaint to be well founded. The Commissioner also found Justice's estimated processing time of 55 months to be unreasonable and recommended a final response by September 4, 2023.

• Whether the Department of Justice Canada conducted a reasonable search for records
• Whether the National Litigation Sector (NLS) was appropriately tasked for the search
• Whether the institution's estimated processing time for the records was reasonable

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the time limits stipulated by the Access to Information Act. LAC received a request for records concerning the LGBTQ community in the military and initially claimed a 565-day extension, which the OIC previously found to be valid. However, LAC missed this extended deadline, leading to the current complaint. The OIC found that LAC was in deemed refusal under subsection 10(3) of the Act, as it had not fully responded to the request by the extended due date. Despite having located over 9,000 pages of responsive material and providing an interim release, LAC had not completed its review or provided a final disclosure date, citing human resource issues and the COVID-19 pandemic. The Commissioner concluded that LAC had not adequately addressed the delay and ordered the institution to complete processing and respond forthwith.

• Whether Library and Archives Canada responded to the access request within the time limits set out in the Access to Information Act
• Whether Library and Archives Canada is in deemed refusal pursuant to subsection 10(3) of the Access to Information Act

The complainant alleged that the Department of National Defence (DND) improperly refused to process an access request for records of misconduct by an identified individual. DND argued that the request did not meet the requirements of section 6 of the Access to Information Act, claiming it lacked sufficient detail and that processing it would violate privacy principles. The Office of the Information Commissioner (OIC) found DND's arguments unconvincing, noting that the request clearly identified the subject and specified search parameters. The OIC clarified that the potential applicability of privacy exemptions (s.19) does not invalidate a request under s.6, and that the Access to Information Act takes precedence over the Privacy Act in this context. DND subsequently conceded that the request was valid and agreed to process it as worded. The OIC concluded that the complaint was well founded.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with reasonable effort under s.6 ATIA
• Whether the request for information about another individual invalidates a request under s.6 ATIA
• Whether the potential for s.19 ATIA exemption (personal information) affects the validity of a request under s.6 ATIA
• Whether the Privacy Act's restrictions on use and disclosure of personal information authorize refusal to process a request under the Access to Information Act

The complainant alleged that Veterans Affairs Canada (VAC) improperly withheld the names and service numbers of individuals awarded the Arctic Star under section 19(1) of the Access to Information Act. During the investigation, VAC initially released some information, acknowledging it did not meet the criteria for personal information, but continued to withhold other names and service numbers. The Information Commissioner determined that the names and service numbers fell under the exception to the definition of "personal information" in paragraph 3(j) of the Privacy Act, as they relate to an individual's position or functions as a government institution officer or employee. The Privacy Commissioner was consulted and agreed with this assessment. Consequently, the Commissioner concluded that the information did not meet the requirements for exemption under section 19(1). The complaint was found to be well founded, and VAC agreed to disclose the remaining names and service numbers.

• Whether the names and service numbers of Arctic Star recipients constitute "personal information" under s.19(1) ATIA
• Whether the information falls under the exception to the definition of "personal information" in paragraph 3(j) of the Privacy Act