Canadian privacy & access decisions

The complainant alleged that Communications Security Establishment Canada (CSE) failed to respond to an access request within the 30-day statutory period, constituting a deemed refusal under the Access to Information Act. The request sought records related to specific files concerning the Intelligence Assessment Committee. The investigation confirmed that CSE did not respond by the due date, attributing the delay to untimely processing of records and delays in sending consultation packages to other government institutions. Despite receiving approximately 3,000 pages of responsive hardcopy records, CSE had not digitized them or initiated all necessary consultations. The Commissioner found the delay unacceptable and the proposed response date of January 24, 2025, unreasonable, especially given the historical nature of the request and prior disclosures. The complaint was found to be well founded, and CSE was ordered to provide a complete response within 72 business days. However, CSE notified the Commissioner that it would not implement the order and would seek a review by the Federal Court.

• Whether Communications Security Establishment Canada responded to the access request within the 30-day period as required by section 7 of the Access to Information Act
• Whether the institution's failure to respond by the due date constituted a deemed refusal under subsection 10(3) of the Act
• Whether the institution's proposed response date of January 24, 2025, was reasonable

The complainant alleged that National Defence (DND) failed to respond to an access to information request within the 30-day statutory period. The request sought information, including emails, reports, flight logs, and cargo manifests, related to Canadian government-owned planes landing in Lebanon between October 7 and December 5, 2023. DND did not respond by the deadline and was deemed to have refused access under subsection 10(3) of the Act. The investigation revealed that the delay was due to a lack of responsiveness from two Offices of Primary Interest (OPIs) within DND, preventing the Directorate of Access to Information and Privacy from processing the request. The Information Commissioner found the delay unacceptable and ordered DND to provide a complete response within 60 business days. DND subsequently agreed to implement the order.

• Whether National Defence responded to the access request within the 30-day period as required by section 7 of the Access to Information Act
• Whether National Defence was deemed to have refused access under subsection 10(3) of the Act due to delay

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency (CBSA) due to a high number of complaints alleging delays in responding to access requests, particularly for immigration application information. The investigation found a dramatic increase in requests to CBSA for records stored in the Global Case Management System (GCMS), which is also accessed by Immigration, Refugees and Citizenship Canada (IRCC). This surge was attributed to IRCC's failure to implement an effective system for clients to directly retrieve their immigration information, leading requesters to file identical requests with both institutions. Despite CBSA's efforts to increase funding, implement automation, and improve consistency and collaboration, the Commissioner found that CBSA must continue to find ways to meet its obligations under the Act, as the root cause (IRCC's system deficiencies) is outside its control. The complaint was found to be well founded, and the Commissioner made recommendations to the Minister of Public Safety and Emergency Preparedness.

• Whether Canada Border Services Agency failed to respond to access requests within the time limits set out in the Access to Information Act
• Whether the increase in access requests to Canada Border Services Agency for immigration application information is due to Immigration, Refugees and Citizenship Canada's lack of an effective system for direct client information retrieval
• Whether Canada Border Services Agency's current measures are sufficient to address the high volume of access requests and backlog

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld information under paragraphs 18(b) and 20(1)(c) of the Access to Information Act. The request sought a list of grants and contributions, including assistance type and other details, approved under specific ISED programs. During the investigation, the complainant withdrew the allegation regarding paragraph 20(1)(c). ISED argued that disclosing the assistance type would harm its negotiating position by allowing companies to compare terms and seek more favorable conditions, thereby interfering with future negotiations. However, the Commissioner found that ISED failed to demonstrate how the release of this information would cause further harm, as similar information was already publicly available. The Commissioner concluded that ISED did not meet the requirements of paragraph 18(b) and ordered the disclosure of the withheld information. ISED agreed to implement the order.

• Whether s.18(b) ATIA applied to information regarding the assistance type of grants and contributions
• Whether disclosure could injure the competitive position of a government institution
• Whether there was a reasonable expectation of harm to the competitive position
• Whether contractual or other negotiations were under way or would be conducted in the future
• Whether disclosure could interfere with negotiations
• Whether there was a reasonable expectation of harm to negotiations
• Whether ISED properly exercised its discretion under s.18(b)

The complainant alleged that National Defence (DND) failed to respond to an access to information request within the 30-day statutory period. The request sought correspondence related to a hiring process for a General Safety Officer position at Canadian Forces Base Suffield, including information about the anticipated re-hire of a named individual. DND received the request on April 3, 2023, and did not extend the deadline or transfer the request, making the due date May 3, 2023. The investigation found that DND did not respond by this date, leading to a deemed refusal of access under subsection 10(3) of the Act. The delay was attributed to a lack of responsiveness from one of the Offices of Primary Interest within DND. The Information Commissioner found the delay unacceptable and ordered DND to provide a complete response to the access request within 36 business days of the final report. DND subsequently notified the Commissioner that it would implement the order.

• Whether National Defence responded to the access request within the 30-day period as required by section 7 of the ATIA
• Whether National Defence is deemed to have refused access under subsection 10(3) of the ATIA due to delay

The complainant alleged that Library and Archives Canada (LAC) took an unreasonable extension of time to respond to an access request for Royal Canadian Mounted Police (RCMP) records related to 'Project Anecdote'. LAC extended the time by 23,725 days (approximately 65 years), citing the need to digitize 780,000 pages of records and conduct consultations. The Commissioner found that LAC did not adequately demonstrate why the processing would be limited to a single employee, why tasks were calculated consecutively rather than concurrently, or why the extension period was reasonable. Furthermore, LAC could not specify the exact number of records requiring consultation, making the consultation extension unreasonable. Consequently, the Commissioner found the extension invalid, deeming LAC to have refused access to the records. The complaint was well founded, and LAC was ordered to respond forthwith and provide regular updates and interim releases.

• Whether the extension of time under s.9(1)(a) ATIA for volume of records was for a reasonable period
• Whether the extension of time under s.9(1)(b) ATIA for consultations was for a reasonable period
• Whether the institution's calculation of processing time based on a single employee was reasonable
• Whether the institution's calculation of processing time based on consecutive tasks was reasonable
• Whether the institution adequately justified the length of the extension claimed

The complainant alleged that Ingenium improperly withheld information related to the loan of objects for the exhibit "Autopsy of a Murder" under various sections of the Access to Information Act. Initially, Ingenium claimed exemptions under sections 14, 16(1)(c), 18(b), 18(d), and 19(1). During the investigation, Ingenium decided to no longer rely on sections 16(1)(c), 18(b), 18(d), and 19(1) (for signatures), and disclosed some information. Ingenium then invoked paragraph 68(c) concurrently with section 14 to withhold photographs. The Commissioner found that the photographs were not excluded under paragraph 68(c) as they were operational records, not the artifacts themselves. Furthermore, Ingenium failed to demonstrate that the disclosure of the photographs would cause a reasonable expectation of harm to federal-provincial affairs under section 14. The Commissioner also considered, but ultimately dismissed, arguments related to Quebec's privacy legislation and the Charter of Human Rights and Freedoms, noting that Charter rights do not apply to the deceased and the photographs were not objectively offensive. The complaint was found to be well-founded, and Ingenium was ordered to disclose the records.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to withhold photographs
• Whether s.16(1)(c) ATIA (conduct of investigations) was properly applied to withhold information
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) was properly applied to withhold information
• Whether s.18(d) ATIA (government financial interests) was properly applied to withhold information
• Whether s.19(1) ATIA (personal information) was properly applied to withhold signatures
• Whether s.68(c) ATIA (material placed by others in certain institutions) excluded photographs from the Act
• Whether the photographs constituted 'material placed by others' under s.68(c)
• Whether disclosure of the photographs could reasonably be expected to harm the conduct of federal-provincial affairs under s.14
• Whether Quebec's privacy legislation or the Charter of Human Rights and Freedoms justified withholding the information under the ATIA

An employee complained that her personal information was repeatedly disclosed to another employee with the same name, and that numerous administrative errors occurred in their respective files. The OPC found that the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant's personal information, including her PRI, email, mailing address, and financial and health information. It also contravened subsection 6(2) of the Act by failing to ensure the accuracy of personal information used for administrative purposes, leading to errors in employee files. The OPC concluded that these issues were systemic due to human error and a lack of awareness among employees regarding privacy breach reporting procedures. The institution accepted the OPC's recommendations to prevent unauthorized disclosures and ensure data accuracy, leading to a conditionally resolved finding.

• Whether the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant’s personal information to another employee with the same name
• Whether the government institution contravened subsection 6(2) of the Privacy Act by failing to ensure that personal information used for administrative purposes was accurate, up-to-date, and complete
• Whether the repeated disclosures and inaccuracies constituted a systemic problem
• Whether the institution's assessment of the sensitivity of the disclosed information was appropriate

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(d), and subsection 19(1) of the Access to Information Act, related to the use of Indigenous languages in House of Commons proceedings. The OIC investigation found that the claim under subsection 19(1) was no longer pursued by the complainant. PSPC failed to demonstrate that most of the withheld information met the requirements of paragraphs 18(b) or 20(1)(d), except for per diem rates under paragraph 18(b). However, the Commissioner found that PSPC did not reasonably exercise its discretion when deciding to withhold these per diem rates, as it did not consider all relevant factors, including those favoring disclosure. The Commissioner ordered PSPC to disclose the information improperly withheld under paragraphs 18(b) and 20(1)(d) and to re-exercise its discretion regarding the per diem rates. PSPC agreed to implement the order.

• Whether the information met the requirements of s.20(1)(d) ATIA (negotiations by a third party)
• Whether disclosure of information could interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether there was a reasonable expectation of harm under s.20(1)(d) ATIA
• Whether the information met the requirements of s.18(b) ATIA (negotiations by government institutions)
• Whether disclosure of estimates for per diem fees could reasonably be expected to interfere with PSPC's negotiations under s.18(b) ATIA
• Whether disclosure of other information could reasonably be expected to interfere with negotiations under s.18(b) ATIA
• Whether PSPC reasonably exercised its discretion to decide whether to disclose per diem rates under s.18(b) ATIA
• Whether PSPC considered all relevant factors for and against disclosure when exercising discretion

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory time limits, as required by section 7 of the Access to Information Act. The request sought the total number of accommodation and exemption requests related to the CAF COVID-19 vaccination mandate, including approvals, denials, and those under review. DND received the request and extended the response period by 60 days under paragraph 9(1)(a), setting a new deadline of May 15, 2023. However, DND did not respond by this extended date, leading to a deemed refusal under subsection 10(3). The investigation revealed that delays were caused by a lack of responsiveness from two Offices of Primary Interest (OPIs) within DND, preventing the access to information unit from processing the request. The Commissioner found the delay unacceptable and ordered DND to complete record retrieval and provide a full response within 36 business days. DND subsequently agreed to implement the order.

• Whether National Defence responded to the access request within the statutory time limits
• Whether National Defence is deemed to have refused access under subsection 10(3) ATIA
• Whether the delay in responding was due to internal OPI unresponsiveness

The complainant alleged that National Defence (DND) improperly withheld information under subsections 15(1) and 19(1) of the Access to Information Act, concerning historical records of the Intelligence Advisory Committee. During the investigation, DND issued two supplementary responses, disclosing additional information, and the complainant narrowed the complaint to specific pages withheld under subsection 15(1). DND proposed a third supplementary response, agreeing to disclose more information but maintaining some redactions under subsection 15(1). The Information Commissioner concluded that the remaining withheld information did not meet the requirements of subsection 15(1), particularly regarding the absence of apparent harm from disclosure. The Commissioner recommended DND disclose all remaining information withheld under subsection 15(1). However, DND notified the Commissioner that it would not implement this recommendation. Consequently, the complaint was found to be well-founded.

• Whether information was properly withheld under s.15(1) ATIA (international affairs and national security)
• Whether information was properly withheld under s.19(1) ATIA (personal information)
• Whether disclosure of the remaining information could reasonably be expected to harm international affairs, defence, or national security
• Whether DND provided sufficient evidence of harm to justify the s.15(1) exemption
• Whether DND reasonably exercised its discretion to withhold the information

The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.

• Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
• Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
• Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
• Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
• Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
• Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
• Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records in response to an access request for Canada's School Narratives and supporting documents related to the Independent Assessment Process. CIRNAC officials acknowledged the existence of responsive records but refused to process them, citing confidentiality, the extensive time required (12 months), and existing priorities. They also expressed concerns about potential privacy violations and breaches of undertakings if the records were processed. The Information Commissioner found CIRNAC's refusal to process the records unacceptable, concluding that the institution denied the complainant's right of access. The Commissioner ordered CIRNAC to retrieve all responsive records, process them, and provide a complete response to the request within 60 business days. CIRNAC subsequently agreed to implement the order.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records
• Whether the institution's refusal to process identified records constitutes a denial of the right of access

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into the Royal Canadian Mounted Police's (RCMP) collection of open-source information under Project Wide Awake (PWA), triggered by a complaint from MP Charlie Angus. The investigation focused on the RCMP's use of third-party services, specifically Babel Street's Babel X, for collecting personal information from various online sources. The OPC found that the RCMP failed to conduct adequate due diligence to ensure that the personal information collected via Babel X and its data providers complied with Canadian privacy laws, particularly PIPEDA. Furthermore, the OPC determined that the RCMP did not meet its transparency obligations under Section 11 of the Privacy Act, as its Personal Information Bank (PIB) descriptions were inadequate in detailing the types and purposes of open-source information collected. The RCMP did not agree to implement the OPC's recommendations, including ceasing collection from problematic Babel X sources until a thorough review was completed and updating its PIB descriptions with sufficient granularity. Consequently, both issues were found to be well-founded and unresolved.

• Whether the RCMP's collection of personal information via Social Studio complied with Section 4 of the Privacy Act.
• Whether the RCMP's collection of personal information via Babel X complied with Section 4 of the Privacy Act.
• Whether the RCMP conducted adequate due diligence on the lawfulness of collection practices of Babel X and its data providers.
• Whether Section 4 of the Privacy Act permits the collection of personal information from a third-party agent that collected, used, or disclosed the information in contravention of a law that third party is subject to.
• Whether the RCMP's publicly available descriptions of its open-source information gathering are granular enough to meet transparency obligations under Section 11 of the Privacy Act.
• Whether the RCMP's published descriptions clarify limits on purposes for collection under Section 11 of the Privacy Act.
• Whether the RCMP's descriptions of open-source information collection and related purposes are adequate under Section 11 of the Privacy Act.

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to a selection process for a Steward/Command Master Sailor to the Commander of the Royal Canadian Navy. Initially, DND tasked two program areas, which reported no relevant records. The OIC, based on complainant representations, requested DND re-task these areas with specific keywords and task five named individuals. DND's subsequent search was incomplete, failing to task all individuals and use the correct date range, though it did yield seven pages of emails. Despite DND's claims of having provided all records, the OIC found that more records existed and DND had not provided a supplementary disclosure. The Commissioner concluded that DND had not conducted a reasonable search and ordered it to complete the retrieval of all responsive records, including tasking specified individuals, and to provide a new response within 36 business days.

• Whether National Defence conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest were tasked
• Whether taskings included all pertinent keywords
• Whether all specified individuals were tasked
• Whether the correct date range was used in searches