Canadian privacy & access decisions

The complainant alleged that the Department of Justice Canada (Justice) improperly withheld information under section 23 of the Access to Information Act. The request sought legal fees related to a specific litigation file. Justice claimed solicitor-client privilege over disbursements and details of expenses in a cost-recovery report, citing a presumption of privilege for lawyers' bills of account. The Information Commissioner acknowledged this presumption but found it rebutted in this case. The Commissioner determined there was no reasonable possibility that an inquirer could use the information to deduce privileged communications. Therefore, the Commissioner recommended that Justice disclose all information initially withheld under section 23. Justice agreed to implement the recommendation, and the complaint was found to be well founded.

• Whether the information consists of communication between a lawyer or notary and his or her client
• Whether the communication relates directly to the seeking or giving of legal advice
• Whether the parties intend the communication and advice to remain confidential
• Whether the information was prepared or gathered for the dominant purpose of litigation
• Whether the litigation is either in progress or is reasonably expected to occur
• Whether the presumption of privilege for lawyers' bills of account was rebutted
• Whether there was a reasonable possibility that an assiduous inquirer could use the information to deduce or otherwise acquire communications protected by privilege

The complainant alleged that Public Safety Canada (Public Safety) improperly refused to process an access request for records related to keywords such as 'counter-radicalization' and 'cyber radicalization', including associated metadata. Public Safety argued that portions of the request did not meet the requirements of section 6 of the Access to Information Act due to the expansive volume of records and the complexity of identifying relevant information. The Commissioner agreed that some parts of the request were too broad, but found that other parts (Paragraph 1 and Schedule A) were sufficiently detailed and should have been processed. The Commissioner also determined that Public Safety failed to meet its legislated obligations by not claiming an extension of time and by refusing to process any part of the request. The complaint was found to be well founded, and Public Safety committed to processing the valid portions of the request at a rate of 5,000 pages per year.

• Whether the request provided sufficient detail to enable an experienced employee to identify records with reasonable effort (s.6 ATIA)
• Whether Public Safety was justified in refusing to process the entire request if only parts of it met s.6 ATIA requirements
• Whether Public Safety complied with its obligation to claim an extension of time under s.9(1) ATIA
• Whether Public Safety made every reasonable effort to assist the requester (s.4(2.1) ATIA)
• Whether Public Safety was required to consult on the term 'metadata' and provide records in the requested format

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act, concerning a follow-up investigation related to a Code of Conduct decision against the complainant. During the investigation, the RCMP conceded that some of the withheld information was not personal information and issued a supplementary release. However, the RCMP maintained the application of subsection 19(1) on the remaining information. The Office of the Information Commissioner (OIC) found that the remaining withheld information was indeed personal information about another individual, meeting the requirements of the exemption. The OIC also concluded that none of the circumstances under subsection 19(2) that would warrant disclosure existed. Therefore, the complaint was found to be well founded because the RCMP initially withheld information that was not personal information, but the OIC upheld the exemption for the remaining records.

• Whether the information initially withheld by the RCMP constituted personal information under s.19(1) ATIA
• Whether the remaining withheld information was personal information about another individual under s.19(1) ATIA
• Whether the circumstances for disclosure under s.19(2) ATIA existed

The OPC initiated an investigation into CashHere, a short-term lender, after being alerted by the Ontario Ministry of Government and Consumer Services that it was collecting online banking credentials (passwords, usernames, security questions/answers) from loan applicants. The OPC found that while CashHere had a legitimate need to validate identity and income, collecting banking credentials was not an appropriate purpose under PIPEDA s. 5(3) due to less privacy-invasive alternatives and disproportionate privacy risks. The investigation also noted that a related entity, MoneyHome, appeared to be continuing the same practices. CashHere ceased responding to the OPC, and the matter was found to be well-founded and unresolved.

• Whether CashHere's collection of online banking login credentials was for a purpose that a reasonable person would consider appropriate under s. 5(3) of PIPEDA
• Whether the collection of banking credentials was effective in meeting CashHere's legitimate need
• Whether there were less privacy-invasive means of achieving the same ends
• Whether the loss of privacy was proportional to the benefits for CashHere

The Office of the Information Commissioner (OIC) received nine complaints regarding Global Affairs Canada's (GAC) failure to respond to nine access requests within the statutory deadlines or taking unreasonable time extensions. GAC cited the COVID-19 pandemic as a significant factor impacting its ability to process these requests. Despite the challenges, GAC committed to providing a final response for all nine files by October 15, 2021. The Commissioner found all nine complaints to be well founded, indicating that GAC improperly delayed access to the requested information. This decision highlights the institution's obligation to meet timelines under the Access to Information Act, even when facing operational difficulties.

• Whether Global Affairs Canada failed to respond to access requests within the statutory deadlines
• Whether Global Affairs Canada took unreasonable time extensions for access requests

A joint investigation by Canadian privacy commissioners examined Clearview AI's facial recognition tool, which scraped billions of images from public websites to create a database for law enforcement and other users. Clearview argued that Canadian privacy laws did not apply due to a lack of jurisdiction and that the information was "publicly available," thus exempt from consent requirements. The Offices asserted jurisdiction, finding a real and substantial connection to Canada through Clearview's marketing and use by Canadian entities. They determined Clearview failed to obtain requisite consent, as the "publicly available" exception did not apply to sensitive biometric data scraped from social media for unrelated purposes. Furthermore, Clearview's mass collection and use of sensitive facial biometric information for commercial purposes were deemed inappropriate. In Quebec, Clearview also failed to report its biometric database and obtain express consent as required by law. The matter was found to be well-founded, with recommendations for Clearview to cease operations in Canada and delete Canadian data, which Clearview did not commit to implementing.

• Whether the Canadian privacy commissioners had jurisdiction over Clearview AI's activities.
• Whether Clearview AI obtained requisite consent for its collection, use, and disclosure of personal information under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether the "publicly available" information exception applied to Clearview AI's collection of images from public websites.
• Whether Clearview AI's collection, use, and disclosure of personal information was for an appropriate purpose under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether Clearview AI satisfied its biometric obligations in Quebec, specifically regarding reporting the creation of a biometric database and obtaining express consent under the LCCJTI.
• Whether Clearview AI's activities were protected by freedom of expression under the Canadian Charter of Rights and Freedoms.