Canadian Privacy Decisions

The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search for emails related to a specific CSIS brief concerning foreign interference. The investigation found that PCO's initial search was inadequate, as additional relevant records were discovered during a second search, including 11 pages of emails. The Information Commissioner ordered PCO to provide a new response to the access request.

• Reasonableness of the search conducted by the institution.
• Failure to retrieve all responsive records.

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day time limit. The request sought information on flights of Canadian government-owned planes landing in Lebanon. The investigation found that DND did not respond by the deadline and was deemed to have refused access. The delay was attributed to unresponsiveness from internal offices. The Information Commissioner found the complaint well-founded and ordered DND to provide a complete response within 60 business days.

• Failure to respond within the statutory time limit (section 7 ATIA).
• Deemed refusal of access due to non-response (subsection 10(3) ATIA).
• Impact of internal delays on meeting access to information obligations.
• Responsibility of the institution to ensure timely responses.

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld information about grants and contributions under paragraphs 18(b) and 20(1)(c) of the Access to Information Act. ISED failed to demonstrate that disclosing the assistance type for certain projects would reasonably be expected to harm ongoing negotiations or contractual matters. The Information Commissioner found the complaint well-founded and ordered ISED to disclose the information withheld under paragraph 18(b).

• Application of paragraph 18(b) of the ATIA regarding negotiations by government institutions.
• Burden of proof on the institution to demonstrate harm from disclosure.
• Reasonable expectation of harm to negotiations from releasing assistance type for grants and contributions.

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency (CBSA) due to a significant increase in access requests for immigration information and a rise in delay complaints. The investigation found that CBSA is overwhelmed by these requests because Immigration, Refugees and Citizenship Canada (IRCC) has not implemented an effective system for clients to retrieve their own immigration application information. This has caused a spillover effect, increasing CBSA's workload. The Commissioner made recommendations to the Minister of Public Safety and Emergency Preparedness to address the issue, and CBSA has committed to implementing them.

• High volume of access requests for immigration application information made to CBSA.
• Increase in delay complaints against CBSA.
• Lack of an effective system for clients to retrieve immigration application information directly from IRCC.
• Impact of IRCC's delays on CBSA's ATIP unit workload.

The complainant alleged that National Defence (DND) failed to respond to an access request for correspondence related to a hiring process within the legislated 30-day period. The investigation found that DND did not meet the deadline, and the delay was caused by the unresponsiveness of an internal office. The Information Commissioner found the complaint well-founded and ordered DND to respond to the request within 36 business days.

• Timeliness of response to an access request
• Definition of a response
• Consequences of not responding within the prescribed time limit

The complainant alleged that Library and Archives Canada (LAC) took an unreasonably long extension of time to respond to a request for RCMP records concerning Project Anecdote. LAC claimed an extension of over 65 years, citing the large volume of records (780,000 pages) requiring digitization and review, as well as consultations. The Information Commissioner found that LAC failed to demonstrate the reasonableness of the extension, as it did not justify the calculation method, the sole reliance on one employee, or the concurrent nature of tasks. Therefore, the extension was deemed invalid and LAC was considered to have refused access.

• Reasonableness of time extension under subsection 9(1)(a) due to volume of records
• Reasonableness of time extension under subsection 9(1)(b) due to consultations
• Calculation of extension based on specific tasks and resources
• LAC's failure to demonstrate that the extension was for the shortest possible duration

The complainant alleged that Ingenium improperly withheld records related to an exhibit loan under several Access to Information Act provisions. During the investigation, Ingenium decided to no longer rely on some exemptions and agreed to disclose more information. The Commissioner found that photographs withheld under section 14 (federal-provincial affairs) and paragraph 68(c) (material placed by others) were not properly excluded or exempted. The Commissioner ordered Ingenium to disclose the records.

• Whether photographs were properly excluded under paragraph 68(c) of the ATIA.
• Whether photographs were properly exempted under section 14 of the ATIA (federal-provincial affairs).
• The application of the ATIA versus Quebec privacy legislation and Charter values.
• The interpretation of "material placed by others" under paragraph 68(c).

The Office of the Privacy Commissioner of Canada investigated a complaint from a federal government employee who alleged that her personal information was repeatedly disclosed to another employee with the same name, and that administrative errors occurred in their files. The OPC found that the institution contravened the Privacy Act by improperly disclosing the complainant's personal information and by failing to ensure the accuracy of information used for administrative purposes. The complaint was found to be well-founded but conditionally resolved after the institution committed to implementing corrective measures.

• Unauthorized disclosure of personal information under section 8 of the Privacy Act.
• Failure to ensure the accuracy and completeness of personal information used for administrative purposes under subsection 6(2) of the Privacy Act.
• Lack of employee awareness regarding privacy breach reporting procedures.
• Systemic nature of errors due to employees having the same name.

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld records concerning the use of Indigenous languages in the House of Commons proceedings, citing exemptions related to government and third-party negotiations. The Information Commissioner found that PSPC failed to justify withholding information under paragraph 20(1)(d) regarding third-party negotiations. While PSPC could withhold per diem rates under paragraph 18(b) related to government negotiations, it failed to reasonably exercise its discretion in doing so. The Commissioner ordered PSPC to disclose most of the withheld information and reconsider its decision on the per diem rates.

• Proper application of paragraph 18(b) (negotiations by government institutions)
• Proper application of paragraph 20(1)(d) (negotiations by a third party)
• Reasonable exercise of discretion to withhold information
• Burden of proof on the institution to justify exemptions

The complainant alleged that National Defence (DND) failed to respond to an access request regarding COVID-19 vaccination mandate accommodations within the statutory time limits. The investigation found that DND missed its extended deadline, leading to a deemed refusal of access. The Commissioner ordered DND to complete the retrieval of all responsive records and provide a response to the request. DND indicated it would comply with the order.

• Failure to respond within statutory time limits
• Deemed refusal of access due to delay
• Responsibility of offices of primary interest for record retrieval
• Undermining of the access to information system credibility

The complainant alleged that National Defence improperly withheld information concerning the Intelligence Advisory Committee under exemptions related to international affairs/national security (subsection 15(1)) and personal information (subsection 19(1)). While the institution disclosed some information during the investigation, the Information Commissioner found that the remaining withheld information did not meet the requirements of subsection 15(1), as the potential harm from disclosure was not apparent. The Commissioner recommended full disclosure, but National Defence disagreed and chose not to implement the recommendation.

• Whether withheld information meets the criteria for exemption under subsection 15(1) of the ATIA.
• Whether the institution demonstrated a reasonable expectation of harm from disclosing the remaining information.
• Whether the institution reasonably exercised its discretion to withhold information.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Aylo (formerly MindGeek) concerning its handling of user-uploaded intimate content. The OPC found that MindGeek failed to obtain valid consent for the collection, use, and disclosure of personal information, particularly highly sensitive intimate images. The OPC also determined that MindGeek did not provide an accessible or effective process for individuals to remove their non-consensual content from its websites. Furthermore, the investigation concluded that MindGeek lacked accountability for the personal information under its control. The complaint was found to be well-founded and remains unresolved.

• Validity of consent for collecting and using intimate images
• Effectiveness and accessibility of content takedown processes
• Accountability for personal information under control
• Jurisdiction over international operations

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for "School Narratives" and supporting documents. CIRNAC officials identified that records existed but refused to process them, citing confidentiality and a lengthy processing time. The Information Commissioner found the complaint well-founded, ordering CIRNAC to retrieve and process all responsive records and provide a new response to the request.

• Reasonableness of the search conducted by the institution
• Institution's refusal to process identified records
• Complainant's right of access to records under the control of a government institution

This special report from the OPC investigated the RCMP's Project Wide Awake initiative, which uses third-party services to collect open-source information. The investigation found that the RCMP did not conduct adequate due diligence to ensure that the personal information collected via the Babel X service and its data providers was compliant with Canadian privacy laws. Additionally, the RCMP failed to meet its transparency obligations under the Privacy Act by providing inadequate descriptions of its open-source information collection practices and purposes in its Personal Information Banks.

• Compliance with collection provisions of the Privacy Act
• Adequacy of due diligence regarding third-party data collection practices
• Adequacy of transparency obligations under the Privacy Act
• Sufficiency of Personal Information Bank descriptions

The complainant alleged that National Defence failed to conduct a reasonable search for records related to a selection process for Steward/Command Master Sailor. The Office of the Information Commissioner (OIC) investigation found that not all relevant offices were tasked and the search criteria were unclear. National Defence was ordered to complete the retrieval of all responsive records and provide a new response to the access request.

• Reasonable search
• Completeness of search
• Clarity of tasking for record retrieval