Canadian privacy & access decisions

The complainant alleged that Agriculture and Agri-Food Canada (AAFC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request sought communications with the National Farm Animal Care Council (NFACC) regarding a Five-Year Review Summary Report and proposed amendments to the Code of Practice for the Care and Handling of Pigs. During the investigation, AAFC disclosed some records, and the complainant narrowed the scope of the complaint. The Information Commissioner found that the information remaining under subsection 19(1) was properly withheld as personal information. However, the Commissioner determined that the information withheld under paragraph 20(1)(b) did not meet the criteria for exemption, specifically, it was not financial, commercial, scientific, or technical. The complaint was found to be well founded, and AAFC was ordered to disclose the information withheld under paragraph 20(1)(b). AAFC subsequently notified the Commissioner that it would not implement the order and intended to apply to the Federal Court.

• Whether records were under the control of the institution
• Whether information met the criteria for exemption under s.19(1) ATIA (personal information)
• Whether the institution reasonably exercised its discretion under s.19(2) ATIA
• Whether information met the criteria for exemption under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information was financial, commercial, scientific, or technical

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information under several sections of the Access to Information Act related to the Canada Mortgage Bonds (CMB) program and National Housing Act Mortgage-Backed Securities (NHA MBS) programs. During the investigation, CMHC disclosed some information previously withheld under paragraphs 18(a), 18(b), 21(1)(a), and 21(1)(b), citing the passage of time. The OIC found that CMHC appropriately applied paragraph 68(a) to exclude information available for purchase and that CMHC's application of paragraphs 18(a) and 21(1)(a) was justified, including a reasonable exercise of discretion. However, CMHC failed to demonstrate that the information withheld under paragraph 20(1)(b) met the exemption's requirements, particularly because the relevant third parties (Cornerstone and AKA) did not provide representations to support the claim. Consequently, the Information Commissioner ordered CMHC to disclose the information withheld under paragraph 20(1)(b). CMHC agreed to implement the order.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether CMHC reasonably exercised its discretion under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.20(1)(a) ATIA (third-party trade secrets) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied
• Whether CMHC reasonably exercised its discretion under s.21(1)(a) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied
• Whether s.68(a) ATIA (material available for purchase) applied to exclude information

The complainant alleged that the Social Sciences and Humanities Research Council (SSHRC) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought records related to a virtual town hall meeting and other contacts between SSHRC and Memorial University of Newfoundland and Labrador (MUN) officials. SSHRC withheld technical information for WebEx meetings and data on MUN's application and success rates for SSHRC funding programs, citing confidentiality. The Commissioner found that while the WebEx access information was technical, neither SSHRC nor MUN demonstrated that it met the confidentiality criteria, particularly given the large number of potential attendees and lack of measures to prevent sharing. Furthermore, the Commissioner determined that MUN's application and success rates were not financial, commercial, scientific, or technical information, and SSHRC later confirmed some of this information was publicly available. Consequently, the Commissioner concluded that the information did not meet the requirements for exemption under paragraph 20(1)(b).

• Whether the withheld information is financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the WebEx access information is confidential under s.20(1)(b) ATIA
• Whether MUN's application and success rates are confidential under s.20(1)(b) ATIA
• Whether the information was consistently treated as confidential by the third party
• Whether the relationship between the institution and third party was fostered for public benefit by confidential communication

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information under subsections 18(a), 19(1), and 20(1)(b) of the Access to Information Act, concerning an individual's role on the Pfizer Lyme Disease Advisory Board and their research project. During the investigation, the complainant narrowed the scope to three specific sections of records withheld under paragraph 20(1)(b). The OIC sought representations from the third party (Nominated Principal Investigator via Queen's University), who had no concerns with disclosure. CIHR subsequently conceded that the threshold for paragraph 20(1)(b) had not been met and indicated preparedness to release the information. The Commissioner found that the information at issue, describing aspects of a proposed research network, was not financial, commercial, scientific, or technical as required by paragraph 20(1)(b). Therefore, the Commissioner concluded that the exemption did not apply. The complaint was found to be well founded, and CIHR was ordered to disclose the information.

• Whether the withheld information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and section 23 of the Access to Information Act, related to an Occupational Health and Safety Tribunal decision concerning a Canadian National Railway (CN Rail) employee's death. The Commissioner found that ESDC and CN Rail did not demonstrate that all requirements for paragraph 20(1)(b) were met, particularly regarding confidentiality and whether the information was truly commercial or technical. While ESDC met the requirements for subsection 19(1) and section 23, the Commissioner determined that ESDC failed to reasonably exercise its discretion to decide whether to disclose the information, especially for publicly available personal information. Consequently, the Commissioner ordered ESDC to disclose the information withheld under paragraph 20(1)(b) and to re-exercise its discretion for information withheld under subsection 19(1) and section 23, considering all relevant factors for and against disclosure. ESDC agreed to implement the order.

• Whether s.19(1) personal information exemption was properly applied
• Whether the institution reasonably exercised its discretion under s.19(2) for personal information
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the institution reasonably exercised its discretion for s.23 solicitor-client privileged information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request was for fatality investigation reports from rail industry employers. The Information Commissioner found that while much of the withheld information was personal information under s.19(1), some was not about identifiable individuals and should be disclosed. Regarding third-party information, the Commissioner determined that neither ESDC nor the third parties provided sufficient justification for withholding all information under paragraphs 20(1)(b) or 20(1)(c). The Commissioner ordered ESDC to disclose information not about identifiable individuals, re-exercise discretion regarding publicly available personal information, disclose information not meeting the requirements of paragraph 20(1)(b), and re-exercise discretion under subsection 20(5) for information related to a third party that consented to disclosure. ESDC agreed to implement the order. The complaint was found to be well founded.

• Whether information withheld under s.19(1) was truly about identifiable individuals
• Whether ESDC adequately considered if personal information was publicly available under s.19(2)(b)
• Whether ESDC adequately considered public interest in disclosure under s.19(2)(c) in relation to s.8 of the Privacy Act
• Whether information met the definition of financial, commercial, scientific or technical information under s.20(1)(b)
• Whether information was confidential by an objective standard under s.20(1)(b)
• Whether information was consistently treated as confidential by third parties under s.20(1)(b)
• Whether ESDC reasonably exercised discretion under s.20(5) when a third party consented to disclosure
• Whether ESDC reasonably exercised discretion under s.20(6) for public health or safety reasons
• Whether disclosure could reasonably be expected to have a material financial impact or injure competitive position under s.20(1)(c)
• Whether ESDC properly applied severance under s.25

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act concerning submarine operations in the Arctic. LAC initially released some information but maintained that the remaining records were justifiably withheld. The Information Commissioner found that LAC failed to demonstrate that the information was obtained in confidence, as required by subsection 13(1), lacking evidence of an expectation of confidentiality. Furthermore, the Commissioner determined that LAC did not provide convincing evidence that the disclosure of the information, much of which was historical and publicly available, could reasonably be expected to harm national security or defence, as required by subsection 15(1). Consequently, the Commissioner concluded that the complaint was well founded and recommended full disclosure. However, LAC notified the Commissioner that it would not implement the recommendation.

• Whether the information was obtained in confidence from a specified government body under s.13(1) ATIA
• Whether there was a reasonable expectation of harm to national security or defence from disclosure under s.15(1) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the institution reasonably exercised its discretion under s.15(1) ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the National Priority Ranking Framework, the Priority Framework for Water and Wastewater Projects, and long-term First Nations Infrastructure Investment Plans, including internal correspondence, from 2014 onwards. The investigation revealed that the Offices of Primary Interest (OPIs) initially tasked with the search might not have been the most appropriate ones, and that additional OPIs likely held responsive records. ISC was unable to provide concrete details about the search parameters or sufficient documentation of their efforts. The Commissioner concluded that ISC did not conduct a reasonable search. Consequently, the Commissioner ordered ISC to conduct a new, expanded search and provide a new response to the complainant, either granting access to any additional records found or explaining why no such records were located.

• Whether Indigenous Services Canada conducted a reasonable search for records in response to the access request

The complainant alleged that Canada Post failed to conduct a reasonable search for records containing their name in response to an access request. The investigation by the Office of the Information Commissioner (OIC) found that Canada Post had not demonstrated that all relevant Offices of Primary Interest (OPIs) were tasked or that those tasked produced all relevant records. The OIC noted the absence of certain record types, such as personnel files, overtime sheets, and day logs, which the complainant identified as missing or incomplete. Canada Post could not provide sufficient explanation for these omissions, nor for why only one work location was tasked when the complainant worked at several. The Commissioner concluded that Canada Post did not conduct a reasonable search. Consequently, the complaint was found to be well founded, and Canada Post was ordered to conduct a more thorough search and process any newly identified records.

• Whether Canada Post conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest (OPIs) were tasked
• Whether all relevant records under the OPIs' control were produced

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the Access to Information Act. The requested records were medical certificates provided by Marineland for the export of five beluga whales. During the investigation, the complainant withdrew the allegation regarding subsection 19(1), removing it from the scope of the complaint. The Commissioner found that DFO and Marineland failed to demonstrate that the information met all the requirements of paragraph 20(1)(b), specifically that the information was confidential and consistently treated as such. Consequently, the Commissioner ordered DFO to disclose the records in their entirety, excluding any information previously withheld under subsection 19(1). DFO agreed to implement the order.

• Whether paragraph 20(1)(b) applied to the medical certificates
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential
• Whether the third party consistently treated the information as confidential
• Whether the information was available from sources otherwise accessible by the public
• Whether the information originated and was communicated with a reasonable expectation of non-disclosure
• Whether the information was communicated in a fiduciary relationship or one not contrary to the public interest

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) improperly withheld records under section 23 (solicitor-client and litigation privilege) of the Access to Information Act. The request sought records from the 1850s to 1980 related to land ownership, sale, reversion, or return on the Bruce/Saugeen Peninsula. CIRNAC initially claimed solicitor-client privilege but later conceded it did not apply, then reversed course to maintain section 23 based on litigation privilege, citing ongoing court cases. The Information Commissioner found that CIRNAC failed to establish that the records were subject to litigation privilege, specifically that they were produced or gathered for the dominant purpose of the cited litigation. The Commissioner recommended full disclosure of the records. CIRNAC refused to implement the recommendation, asserting the information remained protected by litigation privilege. The complaint was found to be well founded.

• Whether the records were subject to solicitor-client privilege under s.23 ATIA
• Whether the records were subject to litigation privilege under s.23 ATIA
• Whether the records were produced or gathered for the dominant purpose of litigation

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under subsections 15(1) (national security, defence) and 19(1) (personal information) of the Access to Information Act concerning historical Canadian intelligence assessments. The OIC found that PCO was justified in withholding information under subsection 19(1). However, PCO failed to demonstrate how the release of distribution markings, names of former Communications Security Establishment (CSE) employees, a distribution list of allies, information on nuclear development programs, and technology transfer details would cause a reasonable expectation of harm under subsection 15(1). The Commissioner noted that similar information had been previously released by PCO and other institutions, discrediting PCO's claims of harm. Furthermore, the Commissioner was not satisfied that PCO properly exercised its discretion in deciding against disclosure. The complaint was found to be well founded, and PCO was ordered to disclose the records in their entirety, but PCO indicated it would not implement the order.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.15(1) national security, defence exemption was properly applied to distribution markings
• Whether s.15(1) national security, defence exemption was properly applied to names of CSE employees
• Whether s.15(1) national security, defence exemption was properly applied to a distribution list of allies
• Whether s.15(1) national security, defence exemption was properly applied to information on nuclear development programs
• Whether s.15(1) national security, defence exemption was properly applied to information on technology transfer
• Whether s.15(1) national security, defence exemption was properly applied to information on a region-based working group
• Whether PCO reasonably exercised its discretion to disclose information under s.15(1)

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information in response to an access request for final versions of documents. CMHC initially claimed exemptions under paragraphs 18(a), 18(b), 19(1), 20(1)(b), 21(1)(a), 21(1)(b), and section 23 of the Access to Information Act. During the investigation, the scope of the complaint was narrowed, and CMHC voluntarily disclosed some information previously withheld under paragraphs 18(a), 18(b), 21(1)(a), and 21(1)(b). The remaining information was withheld under paragraph 20(1)(b), concerning third-party financial, commercial, scientific, or technical information. The Information Commissioner found that CMHC and the third parties (TD Bank Financial Group and Andrew Kalotay Associates, Inc.) failed to demonstrate that the information met the requirements of paragraph 20(1)(b), as the third parties did not provide representations and CMHC could not show that all conditions for the exemption were met. Consequently, the Commissioner ordered CMHC to disclose all information withheld under paragraph 20(1)(b). CMHC agreed to implement the order.

• Whether s.18(a) ATIA (government trade secrets, government financial, commercial, scientific or technical information) was properly applied
• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information is confidential under s.20(1)(b) ATIA
• Whether the third party supplied the information to a government institution under s.20(1)(b) ATIA
• Whether the third party has consistently treated the information as confidential under s.20(1)(b) ATIA
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied
• Whether s.23 ATIA (solicitor-client privilege) was properly applied

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding erroneous quarantine notifications sent by the ArriveCAN application to approximately 10,200 Apple device users. These notifications, issued between June 28 and July 20, 2022, incorrectly instructed fully vaccinated travellers to quarantine due to a defect in ArriveCAN version 3.0. The OPC found that the Canada Border Services Agency (CBSA) failed to take all reasonable steps to ensure the accuracy of personal information used for an administrative purpose, as required by subsection 6(2) of the Privacy Act. Specifically, the OPC identified shortcomings in rigorous pre-release testing, effective human intervention, and timely correction and recourse for affected individuals. The CBSA disagreed with the finding and refused to implement the OPC's recommendation to correct the inaccurate "quarantine_exempted" value in its database. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the Canada Border Services Agency (CBSA) took all reasonable steps to ensure that personal information used for an administrative decision was as accurate as possible under subsection 6(2) of the Privacy Act.
• Whether the "quarantine_exempted" data field constituted personal information used for an administrative purpose by the CBSA.
• Whether the CBSA conducted rigorous pre-release testing for issues that could lead to the highest negative impacts on individual users.
• Whether the CBSA ensured effective human intervention with respect to high-impact decisions on individuals.
• Whether the CBSA provided effective and timely correction and recourse for individuals affected by inaccurate information.

A former refugee complained that the Canadian Border Services Agency (CBSA) contravened his privacy rights by using commercial genetic genealogy (FamilyTreeDNA) to determine his nationality for deportation. He alleged lack of legal authority, unnecessary collection, invalid consent, deceptive practices, inadequate disclosure limitation, and insufficient Personal Information Bank (PIB) description. The Office of the Privacy Commissioner (OPC) found that while the collection was directly related to CBSA's program, the agency contravened section 5 of the Privacy Act by failing to obtain valid, informed authorization for indirect collection from FTDNA. CBSA also contravened section 8 by making incidental disclosures of the complainant's personal information to other FTDNA users, failing to monitor account settings, and not using a pseudonym. Furthermore, the CBSA's PIB descriptions were non-compliant with section 11, as they did not adequately describe the collection of genetic profiles of other FTDNA users. The OPC made several recommendations, which CBSA committed to implement for most parts, but two accounts remained open at the time of the report, leading to an ongoing, unresolved contravention. Consequently, the complaint was found well-founded in part and conditionally resolved in part.

• Whether CBSA's collection of genetic genealogy information was directly related to an operating program or activity under s.4 of the Privacy Act
• Whether CBSA collected unnecessary information under s.4 of the Privacy Act
• Whether CBSA obtained valid authorization from the complainant for the indirect collection of his personal information from FTDNA under s.5(1) of the Privacy Act
• Whether the complainant's consent for indirect collection was voluntary and not given under duress
• Whether the complainant was adequately informed about FTDNA's terms and his rights as a DNA donor for valid authorization
• Whether CBSA acted deceptively in its collection via FTDNA
• Whether the incidental indirect collection of genetic profile information of hundreds of other individuals contravened s.5(1) of the Privacy Act
• Whether CBSA's incidental disclosures of the complainant's personal information contravened s.8 of the Privacy Act
• Whether allowing potential disclosure of the complainant's personal information to other law enforcement bodies (via "law enforcement matching" opt-in) contravened s.8 of the Privacy Act
• Whether the disclosure of ancillary personal information (ethnicity) to genetic matches contravened s.8 of the Privacy Act
• Whether the disclosure of the complainant's identity to genetic matches (failure to use a pseudonym) contravened s.8 of the Privacy Act
• Whether CBSA's Personal Information Bank (PIB) descriptions complied with the transparency obligations under s.11 of the Privacy Act
• Whether the PIB adequately described the collection of biometric information for individuals subject to removal orders
• Whether the PIB adequately described the collection of genetic profiles of other FTDNA users (relatives of individuals subject to removal orders)