Canadian Privacy Decisions

Immigration, Refugees and Citizenship Canada (IRCC) contravened the Privacy Act when an employee inadvertently sent 497 emails containing personal information to the wrong email addresses. The investigation found that IRCC had insufficient administrative and procedural controls to prevent such errors. While IRCC took steps to notify affected individuals and mitigate harm, the Office of the Privacy Commissioner recommended improvements to prevent future breaches. IRCC accepted these recommendations and implemented enhanced measures, leading the OPC to consider the matter resolved.

• Whether IRCC contravened section 8 of the Privacy Act by disclosing personal information to unintended recipients.
• Adequacy of IRCC's administrative and procedural controls to prevent accidental disclosures.
• Effectiveness of IRCC's measures to mitigate the impact of the breach on affected individuals.
• Sufficiency of IRCC's actions to reduce the risk of recurrence.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) did not conduct a reasonable search for records related to the Wood Mountain (Lakota) First Nation land claim. While CIRNAC initially provided records from 2017 onwards, OIC investigation and research revealed potential missing records from 2009 to 2016. Following further searches prompted by the OIC, CIRNAC located additional records. The Information Commissioner found the complaint well-founded and ordered CIRNAC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Identification and location of all records responsive to the access request
• Completeness of the records provided to the complainant

The complainant requested a copy of an agreement between the Vancouver Fraser Port Authority (VFPA) and the Musqueam Indian Band. The VFPA withheld the entire agreement, citing exemptions related to competitive position and confidential third-party information. The Information Commissioner found that the VFPA did not adequately justify withholding the information under the competitive position exemption and failed to reasonably exercise its discretion. The Commissioner also found that the information did not meet the criteria for the confidential third-party information exemption. Consequently, the complaint was found to be well-founded.

• Whether the agreement between VFPA and Musqueam Indian Band qualified for exemption under subsection 18(b) of the Access to Information Act (ATIA).
• Whether the VFPA reasonably exercised its discretion to withhold the information under subsection 18(b) ATIA.
• Whether the agreement contained information qualifying for exemption under paragraph 20(1)(b) ATIA.
• Whether the information was supplied by a third party as required by paragraph 20(1)(b) ATIA.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records concerning the Laval River slope stabilization project. The Information Commissioner found that DFO failed to justify withholding information under exemptions related to confidential government information (s. 13(1)(c)) and financial impact on a third party (s. 20(1)(c)). However, the Commissioner upheld the withholding of personal information under s. 19(1). DFO was ordered to release the information withheld under s. 13(1)(c) and s. 20(1)(c), and indicated its intention to comply.

• Whether information was obtained in confidence from a government body (s. 13(1)(c) ATIA)
• Whether information constituted personal information (s. 19(1) ATIA)
• Whether disclosure could reasonably be expected to cause a material financial impact on a third party (s. 20(1)(c) ATIA)

The complainant alleged that Global Affairs Canada did not conduct a reasonable search for records related to international education roundtables in 2010 and Canada's decision not to endorse the "London Statement." The investigation found that additional responsive records should have existed but were not preserved due to inadvertence and poor information management practices. Global Affairs conducted further searches and found additional records. The Commissioner ordered Global Affairs to provide the newly found records and recommended improvements to information management practices.

• Reasonableness of the search conducted by the institution
• Proper preservation and retention of records
• Identification and disclosure of responsive records

The complainant alleged that Health Canada improperly withheld dates related to an Abbreviated New Drug Submission (ANDS) under exemptions for confidential third-party commercial information (paragraph 20(1)(b)) and potential financial impact on a third party (paragraph 20(1)(c)). The Information Commissioner found that the dates did not meet the criteria for either exemption, as they were considered administrative details rather than commercial information and the expectation of financial harm was too speculative. The Commissioner ordered Health Canada to disclose the dates.

• Whether the dates of correspondence are confidential third-party financial, commercial, scientific or technical information under paragraph 20(1)(b) of the ATIA.
• Whether disclosure of the dates could reasonably be expected to have a material financial impact on a third party or harm its competitive position under paragraph 20(1)(c) of the ATIA.
• The interpretation of 'commercial information' in light of Supreme Court of Canada jurisprudence.
• The requirement for a reasonable expectation of probable harm to justify withholding information under paragraph 20(1)(c).

The complainant alleged that Fisheries and Oceans Canada (DFO) did not conduct a reasonable search for records related to specific First Nations in British Columbia between 1871 and 1960. During the OIC investigation, DFO conducted a second search and retrieved approximately 7000 additional pages of responsive records. The Information Commissioner found the initial search to be unreasonable but was satisfied after the second search.

• Reasonable search
• Scope of the request

The complainant alleged that Transport Canada improperly withheld portions of a hazardous occurrence investigation report concerning the death of a CN employee, citing personal information (subsection 19(1)) and confidential third-party commercial/technical information (paragraph 20(1)(b)) exemptions. The Information Commissioner found that certain information, including train and track numbers and details in witness statements, did not meet the criteria for exemption under subsection 19(1). The Commissioner also found that Transport Canada did not adequately demonstrate that the information met the four requirements for exemption under paragraph 20(1)(b). Consequently, the Commissioner ordered Transport Canada to disclose specific withheld information.

• Whether certain information in the investigation report qualified as personal information under subsection 19(1) ATIA, considering the serious possibility of identification.
• Whether Transport Canada reasonably exercised its discretion to disclose information under subsection 19(2) ATIA.
• Whether certain information qualified as confidential third-party financial, commercial, scientific, or technical information under paragraph 20(1)(b) ATIA.
• Whether information was objectively confidential, originated in a reasonable expectation of confidence, and its disclosure was in the public interest.

The complainant alleged that Natural Resources Canada (NRCan) improperly withheld information related to a contract under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act. The OIC found that NRCan and the third party did not demonstrate that all the requirements for these exemptions were met for most of the withheld information. The Commissioner recommended disclosing all information except for a void cheque and the unit prices and quantities. NRCan disclosed some additional information but not all that was recommended, leading to the complaint being found well-founded.

• Whether information was confidential third-party financial, commercial, scientific or technical information under paragraph 20(1)(b) of the ATIA.
• Whether disclosing information could reasonably be expected to have a material financial impact on a third party or harm its competitive position under paragraph 20(1)(c) of the ATIA.
• Whether the institution met the requirements of the exemptions claimed.
• Whether the institution implemented the Commissioner's recommendation.

The complainant alleged that National Defence failed to conduct reasonable searches for records related to specific contracts under the Access to Information Act. The OIC found that National Defence had not attempted to retrieve records from a third-party contractor and had not searched all likely locations, such as a cloud-based platform. Consequently, the OIC ordered National Defence to conduct further searches, process any responsive records found, and provide updated responses to the complainant.

• Reasonableness of search efforts
• Definition of 'control' over records
• Failure to retrieve records from third-party contractor
• Deficiencies in records management

The complainant alleged that Parks Canada improperly withheld records concerning the Grassy Mountain Coal Project. The withheld information was claimed to be exempt under provisions related to personal information, advice and recommendations, and litigation privilege. The Information Commissioner found that while some information initially withheld under paragraph 21(1)(a) should have been disclosed, it was released during the investigation. The Commissioner was satisfied that the remaining withheld information met the criteria for the other exemptions claimed. The complaint was ultimately found to be well-founded.

• Whether information was properly withheld under subsection 19(1) (personal information).
• Whether information was properly withheld under paragraph 21(1)(a) (advice or recommendations).
• Whether information was properly withheld under section 23 (litigation privilege).
• Whether the institution properly excluded records deemed not relevant based on the complainant's prior agreement.

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all records sought under the Privacy Act. The investigation found that IRCC did not initially conduct a reasonable search for records, particularly concerning visa cancellations and reissuing. However, IRCC subsequently expanded its search to include all relevant offices, and although no additional information was found, the OPC was satisfied that its obligations under the Act were met, resolving the complaint.

• Reasonableness of IRCC's search for records.
• Whether IRCC failed to disclose all responsive information.
• Adequacy of IRCC's search scope and tasked offices.

An individual complained that Canada Post was using personal information collected from the outside of delivered mail to create marketing lists rented to private sector companies. The Office of the Privacy Commissioner of Canada (OPC) found that Canada Post's collection and use of this information for marketing purposes contravened section 5 of the Privacy Act because individuals were not authorized to have their information indirectly collected and used this way. While Canada Post disagreed with the findings and did not agree to cease the practice, it committed to improving transparency about its data usage.

• Whether Canada Post's collection of personal information from mail for marketing purposes complies with section 4 of the Privacy Act.
• Whether Canada Post's use and disclosure of personal information for marketing purposes complies with sections 7 and 8 of the Privacy Act.
• Whether Canada Post's indirect collection of personal information for marketing purposes, without explicit authorization, contravenes section 5 of the Privacy Act.
• What constitutes valid authorization for indirect collection of personal information under the Privacy Act.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to correspondence with a third party, citing personal information and third-party business and financial information exemptions. DFO and the third party conceded that two exemptions were improperly applied, and the Information Commissioner found that the remaining exemption for confidential third-party information was not met. The Commissioner ordered DFO to disclose the information.

• Application of subsection 19(1) (personal information)
• Application of paragraphs 20(1)(a) (trade secrets) and 20(1)(c) (financial impact on third party)
• Application of paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Confidentiality criteria for paragraph 20(1)(b)

The complainant alleged that the Public Health Agency of Canada (PHAC) did not conduct a reasonable search for records concerning the fee schedule or dispersal of payments to provinces and territories under a specific section of the Budget Implementation Act. During the OIC's investigation, PHAC re-searched and found approximately 104 additional responsive pages. The Information Commissioner concluded the initial search was not reasonable but was satisfied after the additional retrieval.

• Reasonableness of the search conducted by PHAC
• PHAC's obligation to identify and locate all responsive records