Canadian Privacy Decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld records concerning cybersecurity and data breach risks associated with the ArriveCAN application, citing exemptions related to facilitating offences and third-party negotiations. During the investigation, CBSA disclosed some records but continued to withhold others under subsection 16(2) and claimed subsection 19(1) for personal information. The Information Commissioner found that while some information properly fell under subsection 16(2), other withheld information did not. Furthermore, CBSA failed to properly consider the disclosure of personal information under subsection 19(1). Although the complaint was found well-founded, the issue was resolved as CBSA released additional information and the complainant was satisfied.

• Applicability of subsection 16(2) (facilitating the commission of an offence)
• Applicability of paragraph 20(1)(d) (negotiations by a third party)
• Proper application of subsection 19(1) (personal information) and the discretion required under subsection 19(2)
• Procedural fairness regarding the submission of representations after an initial report

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld records containing communications between CBC and Twitter employees, citing exemptions related to the safety of individuals and personal information. The OIC found that the CBC failed to demonstrate that disclosing the requested information would reasonably be expected to threaten an individual's safety or facilitate the commission of an offence. The Commissioner ordered the CBC to disclose the withheld information.

• Whether the CBC properly applied section 17 (safety of individuals) to withhold records.
• Whether the CBC properly applied subsection 16(2) (facilitating the commission of an offence) to withhold records.
• Whether the CBC properly applied subsection 19(1) (personal information) to withhold records.
• The standard of proof for demonstrating a reasonable expectation of harm under sections 16(2) and 17.

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld records concerning the negotiation of a 1991 lease under section 23 of the Access to Information Act, citing solicitor-client and litigation privilege. PSPC applied these exemptions broadly to 96,781 pages of records. The Information Commissioner found that while some information qualified for solicitor-client privilege, PSPC failed to demonstrate that any information met the criteria for litigation privilege. Furthermore, PSPC did not reasonably exercise its discretion in withholding information and failed to perform severance as required by section 25.

• Application of section 23 (solicitor-client and litigation privilege)
• Application of section 25 (severance)
• Reasonableness of the institution's exercise of discretion
• Burden of proof on the institution to justify exemptions

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld records related to Taseko Mines Limited’s New Prosperity Project under several exemptions in the Access to Information Act. The Information Commissioner found that ECCC failed to demonstrate that information withheld under paragraphs 20(1)(d) (negotiations by a third party), 21(1)(a) (advice or recommendations), and 21(1)(b) (accounts of consultations or deliberations) met the exemption criteria, and that certain information claimed under section 23 (solicitor-client privilege) did not qualify. ECCC has agreed to comply with the order to disclose the specified information. The complaint was found to be well founded.

• Whether information withheld under paragraph 20(1)(d) interfered with third-party negotiations
• Whether information withheld under paragraph 21(1)(a) constituted advice or recommendations
• Whether information withheld under paragraph 21(1)(b) constituted accounts of consultations or deliberations
• Whether information withheld under section 23 met the criteria for solicitor-client or litigation privilege

This investigation examined allegations that the Canada Revenue Agency (CRA) inappropriately disclosed an adopted child's adoptive name, and the adoptive mother's personal information, to the child's biological mother. The OPC found that, on the balance of probabilities, the CRA likely disclosed the child's adoptive name, contravening section 8 of the Privacy Act. Deficiencies were also identified in the CRA's internal procedures for safeguarding adopted children's personal information. The complaint was found to be well-founded but not resolved, as the CRA agreed to implement some, but not all, of the OPC's recommendations.

• Whether the CRA disclosed the child's adoptive name and the adoptive mother's personal information to the biological mother without consent.
• Whether the CRA's internal procedures adequately protected the personal information of adopted children.
• Whether the CRA's actions contravened section 8 of the Privacy Act.
• Whether the complaint was resolved based on the CRA's response to the OPC's recommendations.

The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for Microsoft Teams messages related to ArriveCAN. CBSA's policy retains these messages for only 30 days, but an administrative error delayed the processing of the request beyond this period, leading officials to believe no records existed. Although CBSA later found one relevant record in its corporate repositories during the investigation, the initial delay meant a reasonable search was not conducted at the time of the request. The complaint was found to be well founded.

• Reasonableness of the search conducted by the institution
• Timeliness of request processing
• Impact of administrative errors on the right of access
• Proper retention and retrieval of electronic records

The complainant alleged that the Canada Revenue Agency (CRA) improperly denied access to personal information related to five grievances, relying on exceptions under the Privacy Act. The OPC found that while the CRA conducted reasonable searches, it failed to adequately substantiate its use of paragraph 22(1)(b) of the Act to withhold information. Much of the withheld information was transactional and did not demonstrate a clear risk of harm upon disclosure. The complaint was found to be well-founded, but unresolved, as the CRA maintained its position on the withheld information.

• Proper application of paragraph 22(1)(b) of the Privacy Act regarding risk of harm.
• Adequacy of government institution's searches for responsive records.
• Substantiation of claims for withholding information under statutory exemptions.
• Requirement for case-by-case assessment when applying exemptions.

The complainant alleged that Transport Canada improperly withheld information related to rail workplace fatality investigation reports. The request was for copies of all such reports completed since January 2000. The Information Commissioner found that Transport Canada failed to demonstrate that the exemptions for personal information (s.19) and third-party commercial/financial/technical information (s.20) were properly applied in all instances. Specifically, Transport Canada did not reasonably exercise its discretion regarding publicly available personal information and failed to justify withholding certain third-party information.

• Proper application of the personal information exemption (s.19 ATIA)
• Proper application of the third-party commercial, financial, or technical information exemption (s.20(1)(b) ATIA)
• Proper application of the third-party financial impact or competitive harm exemption (s.20(1)(c) ATIA)
• Reasonable exercise of discretion by the institution

The complainant alleged that Health Canada improperly withheld information related to campfires and air quality, citing exemptions for personal information and financial impact on third parties. Health Canada initially withheld names and short texts about third parties under the financial impact exemption. However, the third parties did not provide evidence of material financial harm, and one explicitly stated disclosure would not cause harm. The Information Commissioner found the complaint well-founded, ordering Health Canada to disclose the withheld information.

• Whether information withheld under paragraph 20(1)(c) met the requirements of the exemption.
• Whether third parties demonstrated a material financial impact or harm to their competitive position.
• Whether disclosure was in the public interest and outweighed potential harm.

The complainant alleged that Transport Canada improperly withheld information related to an investigation into an accidental death. The request was for the final investigation report. Transport Canada withheld information claiming exemptions for law enforcement, personal information, and confidential third-party commercial information. The Information Commissioner found that the institution and the third party failed to demonstrate that the exemptions applied to certain information, ordering disclosure of the incident number and other non-exempt records. Transport Canada agreed to comply with the order.

• Applicability of paragraph 16(1)(c) (law enforcement and conduct of investigations)
• Applicability of subsection 19(1) (personal information)
• Applicability of paragraph 20(1)(b) (confidential third-party commercial information)
• Burden of proof on the institution and third party to justify exemptions

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under various sections of the Access to Information Act, related to applications for legal funding. The Information Commissioner found that the RCMP had improperly withheld information under sections 13(1)(a) and (c), 14, 15(1), and 23 (solicitor-client privilege). The Commissioner ordered the RCMP to disclose this information and to seek consent from the British Columbia government for certain records. The RCMP indicated they would not fully implement the order, leading the Commissioner to find the complaint well-founded.

• Application of exemptions related to confidential information from government bodies (s. 13)
• Application of exemptions related to federal-provincial affairs (s. 14)
• Application of exemptions related to international affairs (s. 15)
• Application of solicitor-client privilege (s. 23)

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee time sheets under subsection 19(1) (personal information) of the Access to Information Act. The CRA claimed the information, related to a period of a labour strike, could identify employees who participated in the strike. The Information Commissioner found that while the User ID and PRI would reveal strike participation, the remaining time sheet data (date, attendance type, hours, etc.) did not meet the threshold for identifying individuals, as the CRA's evidence was speculative and the large number of employees made identification unlikely. The Commissioner ordered the CRA to disclose the information that did not meet the requirements of subsection 19(1).

• Whether time sheet information from a period coinciding with a labour strike could identify employees participating in the strike.
• Whether the CRA demonstrated a serious possibility of identification for the remaining time sheet data.
• Application of subsection 19(1) (personal information) of the Access to Information Act.

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information regarding equipment leases under several exemptions, including financial and commercial information, and that PAPA did not conduct a reasonable search. The Information Commissioner found that PAPA failed to demonstrate that the rental rate information met the requirements for the financial impact exemption (paragraph 20(1)(c)). However, the Commissioner was satisfied that PAPA conducted a reasonable search for records. PAPA was ordered to disclose the redacted rental rate information.

• Whether the withheld rental rate information meets the requirements of paragraph 20(1)(c) of the Access to Information Act (financial impact on a third party)
• Whether the institution conducted a reasonable search for records
• Whether the institution properly applied exemptions under paragraphs 18(a), 18(b), and subsection 19(1) of the Access to Information Act

The complainant alleged that the National Research Council Canada (NRC) improperly withheld information concerning negotiations with the Professional Institute of the Public Service of Canada (PIPSC) regarding overtime conversion. The NRC claimed exemptions under paragraphs 20(1)(d), 21(1)(a), 21(1)(c), and section 23 of the Access to Information Act. The Information Commissioner found that the NRC failed to meet the requirements for paragraphs 20(1)(d), 21(1)(a), and 21(1)(c) for most of the withheld information, but upheld the exemption under section 23 for specific legal advice. The Commissioner ordered the release of the information improperly withheld under the other provisions. The NRC has indicated it will implement the order.

• Whether information concerning negotiations with a third party was properly withheld under paragraph 20(1)(d).
• Whether information constituted advice or recommendations improperly withheld under paragraph 21(1)(a).
• Whether information constituted positions or plans for negotiations improperly withheld under paragraph 21(1)(c).
• Whether information was subject to solicitor-client privilege under section 23.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld financial, commercial, scientific, or technical information under paragraph 20(1)(b) of the Access to Information Act. The records concerned data analyzed in a Sea Lice Science Response Report. Neither DFO nor the third parties could demonstrate that the information met the requirements for the exemption, including objectivity or that it was supplied by a third party. A section 26 exemption was also considered and dismissed. The Information Commissioner ordered DFO to fully disclose the records.

• Whether the withheld information met the requirements of paragraph 20(1)(b) of the ATIA (confidential third-party financial, commercial, scientific or technical information).
• Whether the information was objectively confidential.
• Whether the information was supplied by a third party.
• Whether the withheld information met the requirements of section 26 of the ATIA (information to be published).