Canadian Privacy Decisions

The complainant requested information regarding legal fees for a specific litigation file from the Department of Justice Canada. The Department withheld expense details and disbursements under section 23 (legal advice and litigation privilege), citing solicitor-client privilege and a presumption of privilege for legal bills. The Information Commissioner found that while disbursements are generally presumed privileged, this presumption was rebutted in this case. The Commissioner concluded that the information was not subject to privilege as there was no reasonable possibility that it could be used to deduce protected communications, and recommended its disclosure. The Department of Justice Canada agreed to implement this recommendation.

• Whether section 23 (legal advice and litigation privilege) of the ATIA applied to the withheld expense details and disbursements.
• Whether the presumption of privilege for legal bills, as established in Maranda v. Richer, was rebutted.
• Whether the withheld information could be used by an assiduous inquirer to deduce privileged communications.

The complainant alleged that Public Safety Canada refused to process an access request for records related to various keywords. Public Safety argued parts of the request did not meet the Act's requirements and processing it would be overly burdensome. The Commissioner found the complaint well-founded, agreeing that some parts of the request were too vague but that Public Safety improperly refused to process the parts that did meet the criteria. Public Safety Canada committed to processing 5,000 pages per year of the relevant records.

• Adequacy of the request details under section 6 of the ATIA
• Institution's obligation to process requests in parts
• Institution's duty to assist requesters
• Timely processing of large volumes of records

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act related to a follow-up investigation concerning a Code of Conduct decision against the complainant. The RCMP initially withheld information, but later released some of it, conceding it was not personal information. However, they continued to withhold other information under subsection 19(1). The OIC concluded that the remaining withheld information was indeed personal information concerning another individual and did not meet the exceptions in subsection 19(2), therefore the complaint was well founded.

• Application of subsection 19(1) (personal information) of the ATIA
• Whether withheld information constituted personal information of another individual
• Whether the exceptions in subsection 19(2) of the ATIA applied

The Office of the Privacy Commissioner of Canada (OPC) investigated a short-term lender, CashHere, after receiving an alert that it was collecting clients' online banking credentials (usernames, passwords, security questions and answers) as part of its payday loan application process. The OPC found that while the lender had a legitimate need to verify identity and income, collecting these highly sensitive credentials was not a purpose that a reasonable person would consider appropriate due to the significant privacy risks and the availability of less invasive alternatives. The investigation also uncovered a related entity, MoneyHome, engaging in similar practices.

• Appropriateness of collecting online banking credentials for loan applications
• Proportionality of privacy harms versus lender benefits
• Availability of less privacy-invasive means to verify identity and income
• Potential link between CashHere and MoneyHome

The Office of the Information Commissioner (OIC) received nine complaints concerning Global Affairs Canada's failure to meet deadlines or take unreasonable time extensions in responding to access requests. In four cases, the institution cited the COVID-19 pandemic as a significant factor. Global Affairs committed to finalizing all nine requests by October 15, 2021. The OIC found all nine complaints to be well founded.

• Timeliness of response to access to information requests
• Impact of COVID-19 on institution's ability to process requests
• Reasonableness of time extensions

A joint investigation by Canadian privacy authorities found that Clearview AI, Inc. contravened PIPEDA and provincial privacy laws by collecting, using, and disclosing personal information without consent and for inappropriate purposes. Clearview's facial recognition tool scraped billions of images from the internet to create biometric facial arrays, which were then provided to law enforcement and other clients. The authorities concluded that Clearview's mass collection and use of sensitive biometric data was not for an appropriate purpose, nor was it obtained with the requisite consent.

• Whether Clearview obtained requisite consent for the collection, use, and disclosure of personal information.
• Whether Clearview collected, used, and disclosed personal information for an appropriate purpose.
• Whether Clearview satisfied its biometric obligations in Quebec.
• Whether Canadian privacy authorities had jurisdiction over Clearview's activities.

The Information Commissioner investigated a complaint that Canadian Heritage (PCH) had suspended processing access requests due to the COVID-19 pandemic. PCH was unable to access its premises or systems from March 16, 2020, to July 10, 2020, resulting in a backlog of 224 requests. The Commissioner found the complaint well-founded, stating PCH's failure to respond breached requesters' rights under the Act.

• Impact of COVID-19 pandemic on processing access requests
• Institution's ability to access premises and remote systems
• Failure to respond to access requests within statutory timelines

The complainant disputed Transport Canada's decision to withhold information regarding vehicle safety recall completion rates, citing exemptions under sections 14, 20, and 21 of the Access to Information Act. The Information Commissioner found that neither Transport Canada nor the third party met their burden to prove the exemptions applied to the records. The Commissioner recommended that Transport Canada release all withheld information, except for specific personal details. Transport Canada agreed to implement these recommendations.

• Application of section 14 of the ATIA (intergovernmental relations)
• Application of section 20 of the ATIA (third-party information)
• Application of section 21 of the ATIA (confidential deliberations)
• Burden of proof on the institution to justify exemptions

The complainant requested information regarding a High Frequency Rail Proposal from VIA Rail Canada. VIA Rail withheld the information citing several exemptions under the Access to Information Act. The Office of the Information Commissioner found that VIA Rail failed to prove the exemptions applied and did not perform a proper severance analysis to release non-exempt portions of the records. Consequently, the complaint was found to be well founded.

• Whether VIA Rail Canada properly applied exemptions under sections 18 and 21 of the ATIA.
• Whether VIA Rail Canada conducted an adequate severance exercise.
• Whether VIA Rail Canada exercised due diligence in responding to the access request.

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1968 within the statutory time limits. PCO claimed an extension for consultations, but when other institutions did not respond, PCO closed the file based on its "no late file" policy. The OIC found that the Act does not permit PCO to fail to respond due to unreceived recommendations and determined PCO was in deemed refusal.

• Timeliness of response to access request
• Proper application of time extension provisions
• PCO's "no late file" policy in relation to the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1971 within the statutory time limits. PCO cited its "no late file" policy as the reason for closing the file when consultations with other institutions were not completed on time. The Information Commissioner found that PCO's failure to respond constituted a deemed refusal under the Act.

• Failure to respond within ATIA time limits
• Validity of "no late file" policy
• Deemed refusal under subsection 10(3) of the ATIA

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1962 within the statutory time limits. PCO claimed an extension and then closed the file, stating it had not received recommendations from other government institutions, based on its “no late file” policy. The Information Commissioner found that the Act does not authorize this reason for non-response and that PCO was in deemed refusal.

• Failure to respond to an access request within the statutory time limits
• Validity of PCO's "no late file" policy
• Application of subsection 10(3) of the Access to Information Act (deemed refusal)

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1957 to 1958 within the statutory time limits. PCO claimed an extension and consulted other institutions, but failed to respond when recommendations were not received by the deadline, citing a “no late file” policy. The OIC found that the Act does not permit such a failure to respond and that PCO was in deemed refusal.

• Timeliness of response to access request
• Proper application of time extensions
• Effect of "no late file" policy on ATIA obligations

This report details a systemic investigation into the Royal Canadian Mounted Police's (RCMP) timeliness in responding to access to information requests between 2016 and 2019. The investigation found significant delays and an increasing backlog of requests. The Information Commissioner made 15 recommendations across six areas to improve the RCMP's performance. However, the Minister of Public Safety largely ignored these recommendations, failing to provide adequate explanations or commit to concrete plans for improvement. Consequently, the Commissioner found the situation dire and tabled a special report to Parliament.

• Timeliness of access to information requests
• RCMP's failure to provide representations during delay investigations
• Adequacy of the Minister's response to recommendations
• Impact of resources and systems on access to information performance

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access to information request within the statutory time limits. PCO had claimed an extension and then placed the request on hold for consultations, which it conducted over several years. The Commissioner found the complaint well-founded, as PCO's indefinite hold on the request had no provision in the Act. The Commissioner recommended PCO provide a final response by June 1, 2020, but PCO failed to meet this deadline, citing the COVID-19 pandemic's impact on consultations. As the complaint was filed before recent amendments, the Commissioner's jurisdiction was limited to making recommendations.

• Timeliness of response
• Indefinite hold on request for consultations
• Impact of COVID-19 pandemic on processing
• Commissioner's jurisdiction and remedies