Canadian privacy & access decisions

The complainant alleged that the Department of Justice Canada (Justice) improperly withheld information under section 23 of the Access to Information Act. The request sought legal fees related to a specific litigation file. Justice claimed solicitor-client privilege over disbursements and details of expenses in a cost-recovery report, citing a presumption of privilege for lawyers' bills of account. The Information Commissioner acknowledged this presumption but found it rebutted in this case. The Commissioner determined there was no reasonable possibility that an inquirer could use the information to deduce privileged communications. Therefore, the Commissioner recommended that Justice disclose all information initially withheld under section 23. Justice agreed to implement the recommendation, and the complaint was found to be well founded.

• Whether the information consists of communication between a lawyer or notary and his or her client
• Whether the communication relates directly to the seeking or giving of legal advice
• Whether the parties intend the communication and advice to remain confidential
• Whether the information was prepared or gathered for the dominant purpose of litigation
• Whether the litigation is either in progress or is reasonably expected to occur
• Whether the presumption of privilege for lawyers' bills of account was rebutted
• Whether there was a reasonable possibility that an assiduous inquirer could use the information to deduce or otherwise acquire communications protected by privilege

The complainant alleged that Public Safety Canada (Public Safety) improperly refused to process an access request for records related to keywords such as 'counter-radicalization' and 'cyber radicalization', including associated metadata. Public Safety argued that portions of the request did not meet the requirements of section 6 of the Access to Information Act due to the expansive volume of records and the complexity of identifying relevant information. The Commissioner agreed that some parts of the request were too broad, but found that other parts (Paragraph 1 and Schedule A) were sufficiently detailed and should have been processed. The Commissioner also determined that Public Safety failed to meet its legislated obligations by not claiming an extension of time and by refusing to process any part of the request. The complaint was found to be well founded, and Public Safety committed to processing the valid portions of the request at a rate of 5,000 pages per year.

• Whether the request provided sufficient detail to enable an experienced employee to identify records with reasonable effort (s.6 ATIA)
• Whether Public Safety was justified in refusing to process the entire request if only parts of it met s.6 ATIA requirements
• Whether Public Safety complied with its obligation to claim an extension of time under s.9(1) ATIA
• Whether Public Safety made every reasonable effort to assist the requester (s.4(2.1) ATIA)
• Whether Public Safety was required to consult on the term 'metadata' and provide records in the requested format

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act, concerning a follow-up investigation related to a Code of Conduct decision against the complainant. During the investigation, the RCMP conceded that some of the withheld information was not personal information and issued a supplementary release. However, the RCMP maintained the application of subsection 19(1) on the remaining information. The Office of the Information Commissioner (OIC) found that the remaining withheld information was indeed personal information about another individual, meeting the requirements of the exemption. The OIC also concluded that none of the circumstances under subsection 19(2) that would warrant disclosure existed. Therefore, the complaint was found to be well founded because the RCMP initially withheld information that was not personal information, but the OIC upheld the exemption for the remaining records.

• Whether the information initially withheld by the RCMP constituted personal information under s.19(1) ATIA
• Whether the remaining withheld information was personal information about another individual under s.19(1) ATIA
• Whether the circumstances for disclosure under s.19(2) ATIA existed

The OPC initiated an investigation into CashHere, a short-term lender, after being alerted by the Ontario Ministry of Government and Consumer Services that it was collecting online banking credentials (passwords, usernames, security questions/answers) from loan applicants. The OPC found that while CashHere had a legitimate need to validate identity and income, collecting banking credentials was not an appropriate purpose under PIPEDA s. 5(3) due to less privacy-invasive alternatives and disproportionate privacy risks. The investigation also noted that a related entity, MoneyHome, appeared to be continuing the same practices. CashHere ceased responding to the OPC, and the matter was found to be well-founded and unresolved.

• Whether CashHere's collection of online banking login credentials was for a purpose that a reasonable person would consider appropriate under s. 5(3) of PIPEDA
• Whether the collection of banking credentials was effective in meeting CashHere's legitimate need
• Whether there were less privacy-invasive means of achieving the same ends
• Whether the loss of privacy was proportional to the benefits for CashHere

The Office of the Information Commissioner (OIC) received nine complaints regarding Global Affairs Canada's (GAC) failure to respond to nine access requests within the statutory deadlines or taking unreasonable time extensions. GAC cited the COVID-19 pandemic as a significant factor impacting its ability to process these requests. Despite the challenges, GAC committed to providing a final response for all nine files by October 15, 2021. The Commissioner found all nine complaints to be well founded, indicating that GAC improperly delayed access to the requested information. This decision highlights the institution's obligation to meet timelines under the Access to Information Act, even when facing operational difficulties.

• Whether Global Affairs Canada failed to respond to access requests within the statutory deadlines
• Whether Global Affairs Canada took unreasonable time extensions for access requests

A joint investigation by Canadian privacy commissioners examined Clearview AI's facial recognition tool, which scraped billions of images from public websites to create a database for law enforcement and other users. Clearview argued that Canadian privacy laws did not apply due to a lack of jurisdiction and that the information was "publicly available," thus exempt from consent requirements. The Offices asserted jurisdiction, finding a real and substantial connection to Canada through Clearview's marketing and use by Canadian entities. They determined Clearview failed to obtain requisite consent, as the "publicly available" exception did not apply to sensitive biometric data scraped from social media for unrelated purposes. Furthermore, Clearview's mass collection and use of sensitive facial biometric information for commercial purposes were deemed inappropriate. In Quebec, Clearview also failed to report its biometric database and obtain express consent as required by law. The matter was found to be well-founded, with recommendations for Clearview to cease operations in Canada and delete Canadian data, which Clearview did not commit to implementing.

• Whether the Canadian privacy commissioners had jurisdiction over Clearview AI's activities.
• Whether Clearview AI obtained requisite consent for its collection, use, and disclosure of personal information under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether the "publicly available" information exception applied to Clearview AI's collection of images from public websites.
• Whether Clearview AI's collection, use, and disclosure of personal information was for an appropriate purpose under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether Clearview AI satisfied its biometric obligations in Quebec, specifically regarding reporting the creation of a biometric database and obtaining express consent under the LCCJTI.
• Whether Clearview AI's activities were protected by freedom of expression under the Canadian Charter of Rights and Freedoms.

The Information Commissioner initiated a complaint against Canadian Heritage (PCH) after reports indicated the institution had suspended processing access requests due to the COVID-19 pandemic. The investigation revealed that PCH's Access to Information and Privacy Secretariat could not access its work premises or departmental network remotely between March 16, 2020, and July 10, 2020. This resulted in a backlog of 224 access requests. The Commissioner found that PCH's failure to respond to these requests was not justified by any of the circumstances outlined in subsection 9(1) of the Act, thereby breaching requesters' quasi-constitutional rights of access. The complaint was deemed well-founded, and the Commissioner made six recommendations to the Minister of Canadian Heritage, who agreed to implement corrective measures.

• Whether the institution's suspension of access request processing constituted a breach of the Access to Information Act
• Whether the institution's failure to respond to requests was justified under subsection 9(1) of the Act

The complainant challenged Transport Canada's decision to withhold information concerning vehicle safety recall completion rates, citing sections 14, 20, and 21 of the Access to Information Act. The Office of the Information Commissioner (OIC) requested submissions from the complainant, Transport Canada, and a third party. The Commissioner determined that neither Transport Canada nor the third party had adequately demonstrated that the claimed exemptions applied to the information in question. Consequently, the Commissioner recommended that Transport Canada disclose all previously withheld information, excluding any personal information. Transport Canada confirmed its intention to implement these recommendations. The complaint was found to be well founded.

• Whether s.14 ATIA (federal-provincial affairs) applied to the withheld information
• Whether s.20 ATIA (third-party information) applied to the withheld information
• Whether s.21 ATIA (advice and recommendations) applied to the withheld information
• Whether Transport Canada and the third party met their burden of proof for the claimed exemptions

The complainant challenged VIA Rail's decision to withhold information concerning a High Frequency Rail Proposal. VIA Rail had applied multiple exemptions under the Access to Information Act. The Information Commissioner found that VIA Rail failed to demonstrate that the withheld information properly fell within the scope of the claimed exemptions. Furthermore, VIA Rail did not perform a severance exercise to release non-exempt portions of the records. The Commissioner recommended that VIA Rail conduct a severance exercise, disclose all information not meeting exemption criteria, and properly exercise discretion for any remaining exempt information. Consequently, the complaint was deemed well founded.

• Whether the information fell within the scope of the exemptions claimed under s.18 ATIA
• Whether the information fell within the scope of the exemptions claimed under s.21 ATIA
• Whether VIA Rail conducted a proper severance exercise to disclose non-exempt information

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1971 within the time limits stipulated by the Access to Information Act. PCO had claimed an extension, partly for consultations with other government institutions. When these consultations were not completed by the deadline, PCO informed the complainant it would not process the request, citing its 'no late file' policy. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations. Consequently, PCO was deemed to have refused the request under subsection 10(3) of the Act. The Commissioner recommended that PCO respond to the request and revise its policy to comply with the Act. PCO agreed to implement both recommendations, and the complaint was found to be well founded.

• Whether the institution failed to respond to an access request within the time limits set out in the Access to Information Act
• Whether the institution's 'no late file' policy, which led to closing a file due to outstanding consultations, is compliant with the Act
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1962. PCO claimed an extension, partly for consultations, but then closed the file, citing its 'no late file' policy and the lack of recommendations from other government institutions. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Commissioner recommended PCO respond to the request by a specific date and revoke or revise its 'no late file' policy to comply with the Act. PCO committed to a revised response date and confirmed the revocation of its policy. The complaint was found to be well founded.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to cease processing an access request due to outstanding recommendations from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1968. PCO claimed an extension, partly for consultations, but then closed the file under its 'no late file' policy when consulted institutions did not respond by the deadline. The OIC found that the Act does not permit an institution to cease processing a request due to delayed consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Information Commissioner recommended PCO respond to the request and revoke its 'no late file' policy. PCO agreed to revoke the policy and committed to responding by a revised date.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to close the file due to delayed responses from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The Information Commissioner initiated a systemic investigation into the Royal Canadian Mounted Police's (RCMP) ability to provide timely responses to access to information requests between 2016-2017 and 2018-2019. The investigation was prompted by persistent complaints about the RCMP's failure to meet statutory timeframes and its lack of participation in delay complaint investigations. The Commissioner found that the RCMP's performance had significantly deteriorated, with a substantial increase in requests taking over 365 days to complete and a growing backlog. The RCMP attributed these issues to its geographical dispersion, the volume of requests, and the sensitive nature of its information holdings. The Commissioner made 15 recommendations across six areas, including tasking processes, procedures, training, electronic systems, resources, and a comprehensive strategy. However, the Minister of Public Safety's response largely ignored or inadequately addressed most of these recommendations, failing to commit to concrete plans or provide explanations for not addressing identified failings. Consequently, the Commissioner found the complaint to be well-founded, concluding that the Minister had accepted the status quo despite the dire situation.

• Whether the RCMP's tasking processes contributed to delays in responding to access requests
• Whether the RCMP's procedures for processing access requests were adequate and consistently applied
• Whether the RCMP provided sufficient training to staff involved in access to information
• Whether the RCMP's electronic systems were adequate for processing access requests efficiently
• Whether the RCMP had adequate human and financial resources for its access to information program
• Whether the RCMP had a comprehensive strategy to meet its access obligations and reduce its backlog
• Whether the Minister of Public Safety's response to the Commissioner's recommendations was satisfactory
• Whether the RCMP's failure to provide representations to the OIC during delay complaint investigations was appropriate

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1957 to 1958. PCO claimed an extension, partly for consultations with other government institutions. When these consultations were not completed by the deadline, PCO closed the file, citing a "no late file" policy and the absence of recommendations from consulted institutions. The Office of the Information Commissioner found that the Access to Information Act does not permit an institution to close a file or fail to respond due to outstanding consultations. Consequently, PCO was deemed to be in refusal under subsection 10(3) of the Act. The Commissioner recommended that PCO respond to the request and revise its policy to comply with the Act. PCO did not implement the recommendations.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether an institution can close an access request file due to outstanding consultations with other government institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access to information request within the statutory time limits. The request, submitted in July 2016, sought records related to assistance for the 2016 Alberta fire disaster, involving approximately 9,100 pages. PCO initially claimed a 120-day extension but then put the request on indefinite hold for consultations, a practice not permitted by the Act. Despite the Information Commissioner's recommendation to provide a final response by June 1, 2020, PCO failed to meet this deadline, citing ongoing consultations and the impact of the COVID-19 pandemic. The Commissioner found the complaint to be well founded, noting that PCO was deemed to have refused access due to the delay. However, due to the complaint's filing date, the Commissioner lacked the authority to issue a binding order for disclosure.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution's indefinite 'hold' for consultations is permissible under the Act
• Whether the institution was deemed to have refused access under subsection 10(3) due to delay