Canadian privacy & access decisions

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(d), and subsection 19(1) of the Access to Information Act, related to the use of Indigenous languages in House of Commons proceedings. The OIC investigation found that the claim under subsection 19(1) was no longer pursued by the complainant. PSPC failed to demonstrate that most of the withheld information met the requirements of paragraphs 18(b) or 20(1)(d), except for per diem rates under paragraph 18(b). However, the Commissioner found that PSPC did not reasonably exercise its discretion when deciding to withhold these per diem rates, as it did not consider all relevant factors, including those favoring disclosure. The Commissioner ordered PSPC to disclose the information improperly withheld under paragraphs 18(b) and 20(1)(d) and to re-exercise its discretion regarding the per diem rates. PSPC agreed to implement the order.

• Whether the information met the requirements of s.20(1)(d) ATIA (negotiations by a third party)
• Whether disclosure of information could interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether there was a reasonable expectation of harm under s.20(1)(d) ATIA
• Whether the information met the requirements of s.18(b) ATIA (negotiations by government institutions)
• Whether disclosure of estimates for per diem fees could reasonably be expected to interfere with PSPC's negotiations under s.18(b) ATIA
• Whether disclosure of other information could reasonably be expected to interfere with negotiations under s.18(b) ATIA
• Whether PSPC reasonably exercised its discretion to decide whether to disclose per diem rates under s.18(b) ATIA
• Whether PSPC considered all relevant factors for and against disclosure when exercising discretion

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory time limits, as required by section 7 of the Access to Information Act. The request sought the total number of accommodation and exemption requests related to the CAF COVID-19 vaccination mandate, including approvals, denials, and those under review. DND received the request and extended the response period by 60 days under paragraph 9(1)(a), setting a new deadline of May 15, 2023. However, DND did not respond by this extended date, leading to a deemed refusal under subsection 10(3). The investigation revealed that delays were caused by a lack of responsiveness from two Offices of Primary Interest (OPIs) within DND, preventing the access to information unit from processing the request. The Commissioner found the delay unacceptable and ordered DND to complete record retrieval and provide a full response within 36 business days. DND subsequently agreed to implement the order.

• Whether National Defence responded to the access request within the statutory time limits
• Whether National Defence is deemed to have refused access under subsection 10(3) ATIA
• Whether the delay in responding was due to internal OPI unresponsiveness

The complainant alleged that National Defence (DND) improperly withheld information under subsections 15(1) and 19(1) of the Access to Information Act, concerning historical records of the Intelligence Advisory Committee. During the investigation, DND issued two supplementary responses, disclosing additional information, and the complainant narrowed the complaint to specific pages withheld under subsection 15(1). DND proposed a third supplementary response, agreeing to disclose more information but maintaining some redactions under subsection 15(1). The Information Commissioner concluded that the remaining withheld information did not meet the requirements of subsection 15(1), particularly regarding the absence of apparent harm from disclosure. The Commissioner recommended DND disclose all remaining information withheld under subsection 15(1). However, DND notified the Commissioner that it would not implement this recommendation. Consequently, the complaint was found to be well-founded.

• Whether information was properly withheld under s.15(1) ATIA (international affairs and national security)
• Whether information was properly withheld under s.19(1) ATIA (personal information)
• Whether disclosure of the remaining information could reasonably be expected to harm international affairs, defence, or national security
• Whether DND provided sufficient evidence of harm to justify the s.15(1) exemption
• Whether DND reasonably exercised its discretion to withhold the information

The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.

• Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
• Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
• Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
• Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
• Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
• Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
• Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records in response to an access request for Canada's School Narratives and supporting documents related to the Independent Assessment Process. CIRNAC officials acknowledged the existence of responsive records but refused to process them, citing confidentiality, the extensive time required (12 months), and existing priorities. They also expressed concerns about potential privacy violations and breaches of undertakings if the records were processed. The Information Commissioner found CIRNAC's refusal to process the records unacceptable, concluding that the institution denied the complainant's right of access. The Commissioner ordered CIRNAC to retrieve all responsive records, process them, and provide a complete response to the request within 60 business days. CIRNAC subsequently agreed to implement the order.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records
• Whether the institution's refusal to process identified records constitutes a denial of the right of access

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into the Royal Canadian Mounted Police's (RCMP) collection of open-source information under Project Wide Awake (PWA), triggered by a complaint from MP Charlie Angus. The investigation focused on the RCMP's use of third-party services, specifically Babel Street's Babel X, for collecting personal information from various online sources. The OPC found that the RCMP failed to conduct adequate due diligence to ensure that the personal information collected via Babel X and its data providers complied with Canadian privacy laws, particularly PIPEDA. Furthermore, the OPC determined that the RCMP did not meet its transparency obligations under Section 11 of the Privacy Act, as its Personal Information Bank (PIB) descriptions were inadequate in detailing the types and purposes of open-source information collected. The RCMP did not agree to implement the OPC's recommendations, including ceasing collection from problematic Babel X sources until a thorough review was completed and updating its PIB descriptions with sufficient granularity. Consequently, both issues were found to be well-founded and unresolved.

• Whether the RCMP's collection of personal information via Social Studio complied with Section 4 of the Privacy Act.
• Whether the RCMP's collection of personal information via Babel X complied with Section 4 of the Privacy Act.
• Whether the RCMP conducted adequate due diligence on the lawfulness of collection practices of Babel X and its data providers.
• Whether Section 4 of the Privacy Act permits the collection of personal information from a third-party agent that collected, used, or disclosed the information in contravention of a law that third party is subject to.
• Whether the RCMP's publicly available descriptions of its open-source information gathering are granular enough to meet transparency obligations under Section 11 of the Privacy Act.
• Whether the RCMP's published descriptions clarify limits on purposes for collection under Section 11 of the Privacy Act.
• Whether the RCMP's descriptions of open-source information collection and related purposes are adequate under Section 11 of the Privacy Act.

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to a selection process for a Steward/Command Master Sailor to the Commander of the Royal Canadian Navy. Initially, DND tasked two program areas, which reported no relevant records. The OIC, based on complainant representations, requested DND re-task these areas with specific keywords and task five named individuals. DND's subsequent search was incomplete, failing to task all individuals and use the correct date range, though it did yield seven pages of emails. Despite DND's claims of having provided all records, the OIC found that more records existed and DND had not provided a supplementary disclosure. The Commissioner concluded that DND had not conducted a reasonable search and ordered it to complete the retrieval of all responsive records, including tasking specified individuals, and to provide a new response within 36 business days.

• Whether National Defence conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest were tasked
• Whether taskings included all pertinent keywords
• Whether all specified individuals were tasked
• Whether the correct date range was used in searches

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit. Specifically, the request sought information on a "detailed review" of service delivery, proposals for community mental wellness projects, and a "risk-based review" for financial controls, all referenced in an ISC briefing note. ISC initially claimed the "detailed review" was verbal and found no records for parts 2 and 3 of the request. The Office of the Information Commissioner (OIC) found this response unreasonable, noting that the reference in an official briefing note implied the existence of responsive documentation. Following the OIC's intervention, ISC conducted additional searches, which yielded at least 170 pages of previously unlocated documents. The Commissioner concluded that ISC had not conducted a reasonable search and ordered the institution to complete the retrieval and processing of all responsive records and issue a new response to the complainant. ISC agreed to implement the order.

• Whether Indigenous Services Canada conducted a reasonable search for records related to the "detailed review" of Non-Insured Health Benefits Mental Health Counselling benefit service delivery
• Whether Indigenous Services Canada conducted a reasonable search for records related to proposals to fund community mental wellness projects outside of Benefits Program authorities
• Whether Indigenous Services Canada conducted a reasonable search for records related to the "risk-based review to improve financial controls and management practices across all regions" for the mental health benefit

The complainant alleged that Health Canada improperly withheld information under various sections of the Access to Information Act concerning records related to Dukoral. During the investigation, the complainant narrowed the scope, no longer requiring investigation into personal information or information about the production process or composition of Dukoral. The Commissioner found that Health Canada and the third party (Valneva) did not adequately demonstrate that all information withheld under paragraphs 20(1)(b) and 20(1)(c) met the exemption requirements, particularly regarding confidentiality and reasonable expectation of harm. Similarly, certain information withheld under paragraph 21(1)(a) was found not to constitute advice or recommendations. However, the institution successfully demonstrated that information withheld under section 23 (solicitor-client privilege) was properly exempted. The Commissioner ordered Health Canada to disclose specific information previously withheld under paragraphs 20(1)(b), 20(1)(c), and 21(1)(a). Health Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information exemption was properly applied (withdrawn by complainant)
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential (not publicly available, reasonable expectation of confidence, relationship fostered for public benefit)
• Whether the information was supplied by a third party
• Whether the information was consistently treated as confidential by the third party
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether disclosure could result in material financial loss or gain to the third party
• Whether there is a reasonable expectation of harm (well beyond a mere possibility)
• Whether disclosure could injure the competitive position of the third party
• Whether Health Canada reasonably exercised its discretion under s.20(5) and s.20(6)
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether the information constitutes advice or recommendations
• Whether the information was created by or for a government institution or minister
• Whether Health Canada reasonably exercised its discretion under s.21(1)(a)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the information consists of communication between a lawyer/notary and client for legal advice
• Whether the parties intended the communication to remain confidential
• Whether Health Canada reasonably exercised its discretion under s.23

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Immigration, Refugees and Citizenship Canada (IRCC) regarding a privacy breach. IRCC inadvertently disclosed the personal information of 497 individuals when sending mass email notifications for a work permit extension program. An employee failed to apply a filter to the email address column in an Excel spreadsheet, causing email addresses to misalign with other personal data, leading to notifications being sent to incorrect recipients. The OPC found that IRCC contravened section 8 of the Privacy Act by disclosing personal information without a permissible purpose and that its prevention measures were insufficient. While IRCC's mitigation efforts, including notifying affected individuals, were deemed adequate, the OPC recommended implementing robust procedural and administrative controls. IRCC accepted these recommendations, committing to measures such as a 'two pairs of eyes' rule, updated operating procedures, and data quality assurance checks. Consequently, the OPC considered the matter resolved.

• Whether IRCC's disclosure of personal information to unintended recipients contravened section 8 of the Privacy Act.
• Whether IRCC had sufficient measures in place to prevent unauthorized disclosures of personal information of this nature.
• Whether IRCC's response to mitigate the impact of the breach on affected individuals was adequate.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records related to the Wood Mountain (Lakota) First Nation's land claim from 2000 to 2020. Initially, CIRNAC provided records only from 2017 onwards, claiming no earlier records could be located. The OIC's investigation highlighted the absence of records from key periods, specifically 2009-2012 when the claim was first submitted and rejected, and 2014-2016 when the First Nation filed with the Specific Claims Tribunal. After the OIC's persistent questioning and research, CIRNAC conducted subsequent searches and located additional responsive records. The Information Commissioner concluded that CIRNAC had not conducted a reasonable search and ordered the institution to retrieve and process all newly identified records and issue a new response to the complainant.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records

An applicant complained that the Vancouver Fraser Port Authority (VFPA) improperly withheld an agreement with the Musqueam Indian Band under sections 18(b) and 20(1)(b) of the Access to Information Act. The Commissioner found that while some parts of the agreement could reasonably be expected to interfere with the VFPA's negotiations under s.18(b), other parts were publicly known or deducible and did not meet the exemption criteria. Furthermore, the VFPA failed to reasonably exercise its discretion by not considering factors in favour of disclosure. Regarding s.20(1)(b), the Commissioner determined that the agreement, in its entirety, did not meet the criteria for confidential financial, commercial, scientific, or technical information, particularly because it consisted of negotiated terms rather than information supplied by a third party. The Commissioner ordered the VFPA to disclose information not meeting s.20(1)(b) criteria and to re-exercise discretion for information meeting s.18(b). The VFPA agreed to release some information but did not address the re-exercise of discretion.

• Whether s.18(b) competitive position harm was reasonably expected
• Whether s.18(b) interference with negotiations was reasonably expected
• Whether the VFPA reasonably exercised its discretion under s.18(b)
• Whether the information was financial, commercial, scientific, or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information related to the Laval River slope stabilization project under several sections of the Access to Information Act. Specifically, DFO claimed exemptions under paragraphs 13(1)(c) (confidential information from government bodies), 16(2) (security), 16(2)(c) (facilitating an offence), 19(1) (personal information), and 20(1)(c) (financial impact on a third party). During the investigation, the complainant narrowed the scope, removing the application of subsections 16(2) and 19(1) to signatures where the signing authority's name was present. The Information Commissioner found that DFO failed to demonstrate that the information withheld under paragraph 13(1)(c) was obtained in confidence, and neither DFO nor the third party justified the application of paragraph 20(1)(c). However, the Commissioner upheld the application of subsection 19(1) for personal information. Consequently, the Commissioner ordered DFO to release all information previously withheld under paragraphs 13(1)(c) and 20(1)(c), with the exception of the personal information properly withheld under subsection 19(1). DFO notified the Commissioner that it would implement the order.

• Whether s.13(1)(c) ATIA (confidential information from government bodies) was properly applied
• Whether the information was obtained in confidence for s.13(1)(c) ATIA
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether the information is about an individual for s.19(1) ATIA
• Whether there is a serious possibility of identification for s.19(1) ATIA
• Whether the information falls under exceptions to the definition of personal information for s.19(1) ATIA
• Whether DFO reasonably exercised discretion under s.19(2) ATIA
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether disclosure could result in material financial loss or gain to the third party for s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm for s.20(1)(c) ATIA
• Whether disclosure could injure the competitive position of the third party for s.20(1)(c) ATIA

The complainant alleged that Global Affairs Canada (Global Affairs) failed to conduct a reasonable search for records related to 2010 roundtable discussions on international education and the "London Statement." The initial search yielded few records, prompting the Office of the Information Commissioner (OIC) to question the institution. Global Affairs admitted that additional responsive records should have existed but were not preserved due to inadvertence, including improper filing, destruction of IT accounts, and a malfunctioning USB drive. Following further inquiries from the OIC, Global Affairs conducted additional searches, including tasking former employees, which led to the discovery of additional responsive records on an internal drive and a CD-ROM. The Commissioner found that Global Affairs did not conduct a reasonable search initially and raised concerns about its information management practices. The complaint was found to be well founded, and Global Affairs was ordered to provide the newly found records and implement information management recommendations.

• Whether Global Affairs Canada conducted a reasonable search for records
• Whether additional responsive records ought to have existed
• Whether the institution's information management practices were adequate

The complainant alleged that Health Canada improperly withheld information under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act. The request sought records related to an Abbreviated New Drug Submission (ANDS) for the medicinal ingredient "tacrolimus." Specifically, the complaint focused on the dates of correspondence between a third party and Health Canada, which were withheld concurrently under both exemptions. The Commissioner found that the dates did not constitute "commercial" information as required by paragraph 20(1)(b), citing Supreme Court jurisprudence that administrative details like dates are not typically commercial. Regarding paragraph 20(1)(c), the Commissioner determined that neither Health Canada nor the third party provided convincing evidence that disclosing these specific dates would lead to a reasonable expectation of material financial harm or competitive prejudice. The evidence presented was deemed too speculative. Consequently, the Commissioner concluded that neither exemption applied and ordered Health Canada to disclose the dates.

• Whether the dates of correspondence constitute "financial, commercial, scientific or technical information" under s.20(1)(b) ATIA
• Whether the information is confidential under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether disclosure of the dates could reasonably be expected to result in material financial loss or gain to the third party under s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm occurring under s.20(1)(c) ATIA