Canadian Privacy Decisions

Transport Canada denied a man's security clearance based on information from the RCMP. The man complained that the RCMP improperly disclosed his personal information, specifically details of an absolute discharge from a 2009 incident. The RCMP disclosed this information without the required ministerial approval, which contravened the Criminal Records Act.

• Disclosure of personal information by the RCMP.
• Compliance with the Criminal Records Act regarding absolute discharges.
• Authorization for disclosure of information for security clearances.

An inmate at a maximum-security penitentiary requested video recordings of incidents involving officers. The Correctional Service of Canada (CSC) denied access, citing third-party information and security concerns. The OPC found complaints regarding 16 destroyed videos to be well-founded, as CSC had not even reviewed them before denial. For two other videos, which CSC claimed contained third-party information and posed security risks, the OPC found CSC correctly applied exemptions, thus resolving those complaints.

• Timeliness of responding to access to information requests
• Destruction of records prior to fulfilling requests
• Application of exemptions for security of penal institutions
• Proper review of records before withholding information

The OPC investigated a complaint about an RCMP officer who accessed the CPIC database to conduct a criminal background check on a prospective tenant for a private rental. The investigation found the officer used the database for personal reasons, not for a legitimate law enforcement purpose. The RCMP took remedial actions, including an apology and a reminder to employees about database use policies, which satisfied the OPC.

• Unauthorized access to the CPIC database
• Use of personal information for non-law enforcement purposes
• Compliance with RCMP policies on database access

A formal investigation by the Office of the Privacy Commissioner of Canada concluded that Aboriginal Affairs and Northern Development Canada (AANDC) and the Department of Justice Canada wrongly collected personal information from activist Cindy Blackstock's personal Facebook page. The departments argued that information posted publicly on social media was not private, but the OPC rejected this argument, stating that public availability does not make information non-personal. The OPC recommended that both departments cease accessing personal information on social media without a direct link to government business and destroy improperly collected information, with both departments accepting the recommendations.

• Whether personal information posted on a public Facebook page is still considered private under the Privacy Act.
• Whether the collection of personal information from social media feeds was directly related to a government operating program or activity.
• Whether the departments' accessing of Indian status records was justified.

The complainant alleged that the Canada Revenue Agency (CRA) contravened the Privacy Act by improperly accessing his tax file. The investigation found that a CRA employee accessed the complainant's tax file without authorization and beyond the requirements of their position. The CRA has since confirmed the employee no longer has access to taxpayer information.

• Unauthorized access to personal information
• Contravention of use and disclosure provisions of the Privacy Act

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from a woman who alleged her personal information regarding a drug scan during a prison visit was inappropriately disclosed. The OPC found that the Correctional Service of Canada (CSC) failed to adequately investigate the disclosure, which resulted in the woman's ex-husband restricting access to their children. The OPC determined that CSC employees had disclosed the information, but could not identify the source or specific individuals involved. The complaint was upheld as well-founded due to the improper disclosure and CSC's inadequate handling of the issue.

• Inappropriate disclosure of personal information
• Adequacy of investigation into the disclosure
• Responsibility of the institution for unauthorized access and disclosure

This investigation concerned a complaint that Veterans Affairs Canada (VAC) improperly disclosed the severity of a serving member of the Canadian Forces' disability pension to the Department of National Defence (DND). This disclosure, which included the exact percentage of the disability pension, was made without the veteran's consent and was not necessary for his medical treatment. The investigation found that the disclosure was not deliberate and did not meet the criteria for the "public interest" exemption under the Privacy Act. The complaint was upheld as well-founded, and VAC implemented recommendations to improve its policies and training on information sharing.

• Unauthorized disclosure of personal information (disability pension percentage)
• Applicability of the "public interest" exemption under the Privacy Act
• Compliance with internal policies and agreements for information sharing between government departments

The RCMP was investigated after a complainant alleged that a staff sergeant inappropriately disclosed that he was a suspect in a murder investigation at a community meeting. The Sergeant identified the man as a "person of interest" and stated he declined a polygraph test. While the RCMP believed the complainant had consented to the discussion due to his attendance at the meeting and assurances from group representatives, the OPC found the RCMP had erred in presuming consent. The onus was on the RCMP to actively obtain consent.

• Did the RCMP staff sergeant inappropriately disclose the complainant's status as a "person of interest" in a murder investigation at a community meeting?
• Did the complainant consent to the disclosure of his personal information by the RCMP staff sergeant?
• Was the disclosure of personal information reasonable and for a purpose authorized by the Privacy Act?

An individual complained that Veterans Affairs improperly collected his personal information by searching for and disclosing a URL linking to a Google group discussion page containing his email address and personal opinions. The OPC found that while the information was publicly available, its collection by Veterans Affairs did not relate directly to an operating program or activity of the institution, violating the Privacy Act. The complaint was well-founded, and Veterans Affairs apologized and deleted the email.

• Whether the collection of a URL linking to publicly available personal information relates directly to an operating program or activity of a federal institution.
• The distinction between the use/disclosure of publicly available information and its collection under the Privacy Act.

A woman complained to the Office of the Privacy Commissioner of Canada (OPC) after her tax information was inappropriately accessed by a Canada Revenue Agency (CRA) employee, who was the common-law spouse of her ex-husband. The OPC's investigation found the complaint to be well-founded, noting that while the CRA had a disciplinary policy, the investigation into the misconduct took too long. The OPC recommended enhanced privacy training and stressed the importance of timely investigations.

• Inappropriate access to taxpayer information by a CRA employee.
• Delay in investigating employee misconduct.
• Need for enhanced privacy training for employees.

The adult children of a deceased veteran complained to the OPC after Veterans Affairs Canada refused to release their father's pension file. The Department argued the Pension Act required it to withhold the information for 20 years after death and that the children were not beneficiaries. The OPC found that the children, acting for the estate, were entitled to access the file under the Privacy Act's Regulations to administer the estate, and that the Department's reasoning was not reasonable. Veterans Affairs subsequently released the file.

• Right of access to personal information in a deceased individual's file by the estate administrator.
• Interpretation of the Privacy Act's Regulations regarding access to files for estate administration.
• Whether the Pension Act superseded the Privacy Act's access provisions in this context.

A Canadian woman complained that her personal information, including her Social Insurance Number and tax assessment, was disclosed to a foreign national without her consent when he applied for a work permit. The information was sent by her MP to the Canadian High Commission in Dhaka. The High Commission returned all documents, including the woman's, to the applicant, who then allegedly shared them with others. The Office of the Privacy Commissioner of Canada found the complaint well-founded, noting that Citizenship and Immigration Canada acknowledged the lack of consent and that the disclosure should not have occurred.

• Disclosure of personal information without consent
• Adequacy of safeguards to prevent unauthorized disclosure
• Jurisdiction over foreign missions

An inmate at a federal penitentiary complained that the Correctional Service of Canada contravened the Privacy Act by openly posting his and other inmates' medical appointment details, including names and offender numbers, to the general penitentiary population. The institution acknowledged the breach and agreed to cease posting lists, opting instead for individual notifications. However, they did not accept the recommendation to use only partial offender numbers for individual notifications.

• Disclosure of personal information (medical appointment details)
• Adequacy of corrective measures

The Canada Revenue Agency (CRA) disclosed personal information to a third party without consent, a contravention of the Privacy Act. An employee mistakenly sent a letter containing the complainant's Social Insurance Number and details about her husband to her niece, who shares a similar name. While the CRA corrected the error and implemented measures to prevent recurrence, the Office found the complaint to be well-founded due to the failure to follow established procedures.

• Disclosure of personal information without consent
• Failure to follow internal procedures for information disclosure
• Adequacy of corrective measures

Two prisoners complained after a report containing their personal information was found among a fellow inmate's belongings. An investigation determined that a contract worker printed the report, which was then accessible to a welding instructor. While the report was later discovered with another inmate's effects, it could not be determined how it got there. The Office of the Privacy Commissioner confirmed the privacy rights of the complainants had been breached.

• Unauthorized disclosure of personal information
• Safeguarding of personal information by staff and contractors
• Accountability for handling sensitive reports