Canadian privacy & access decisions

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act, seeking approval to decline to act on an access request. The institution argued that the request constituted an abuse of the right of access, citing two main reasons: the request's alleged purpose to obtain information not under the institution's control or another individual's personal information, and the significant burden processing the request would place on the institution. The Commissioner examined whether the request's purpose was illegitimate and whether the institution's burden assessment was adequately justified. The Commissioner found that seeking information potentially not under control or personal information does not inherently constitute an abuse of the right of access. Furthermore, the Commissioner determined that the institution's estimates for record volume and processing time were not sufficiently substantiated. Consequently, the Commissioner concluded that the institution failed to demonstrate that the access request was an abuse of the right of access, and the application was denied.

• Whether the access request constitutes an abuse of the right of access under s.6.1(1) ATIA
• Whether the request's purpose to obtain information not under the institution's control makes it an abuse of right
• Whether the request's purpose to obtain another individual's personal information makes it an abuse of right
• Whether processing the request would overburden the institution
• Whether the institution's estimate of record volume was sufficiently justified
• Whether the institution's assessment of the impact on the OPI and ATIP office was sufficiently justified

An institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act, seeking approval to decline to act on 72 access requests. The institution argued that these requests constituted an abuse of the right of access and were vexatious, citing their high volume, repetitive nature, and the burden they placed on resources. The Commissioner found that 71 of the 72 requests were an abuse of the right of access, concluding that those in Annex A were repetitive and those in Annex B were unduly systematic. While the institution did not prove the requests had a purpose other than obtaining information, the Commissioner noted the institution had fulfilled its duty to assist. Considering the minimal public interest in further disclosure given thousands of pages already released, and the disproportionate effort required, the Commissioner partially granted the application. The institution was approved to decline to act on 71 requests, but not one request related to ATIP training. The Commissioner also declined to impose limits on future requests.

• Whether the institution's application to decline to act on 72 access requests under s.6.1(1) ATIA should be granted
• Whether the access requests constituted an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the access requests were vexatious under s.6.1(1) ATIA
• Whether the access requests were repetitive
• Whether the access requests were made with a purpose other than obtaining records or information
• Whether the access requests were unduly systematic
• Whether the institution fulfilled its duty to assist the requester under s.4(2.1) ATIA
• Whether the public interest in the records sought warranted granting or denying the application
• Whether the Commissioner should exercise discretion to grant the application
• Whether limits should be placed on future access requests from the requester

The complainant alleged that Indigenous Services Canada (ISC) failed to respond to an access request within the extended due date. The request sought all transactions and communications related to providing safe drinking water to Grassy Narrows First Nation during a 25-year boil water advisory. ISC initially received over 17,000 pages of responsive records, leading to the file being backlogged due to volume and ongoing litigation. Despite the complainant agreeing to significantly narrow the scope of the request to final versions containing scientific analysis and sampling data, reducing the record count to an estimated 6,500 pages, ISC was unable to provide a work plan or an estimated response date. The Information Commissioner found that ISC failed to meet its obligation to respond within the extended period and ordered the institution to provide a complete response within 75 business days. ISC confirmed it would implement the order.

• Whether Indigenous Services Canada responded to the access request within the extended time limit under subsection 9(1) of the Access to Information Act
• Whether Indigenous Services Canada's failure to provide a work plan or estimated response date after the scope was narrowed constituted a contravention of its obligations under the Act

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld At-Sea Observer (ASO) data for black dogfish bycatch from 2000-2021 under paragraphs 20(1)(b) and 20(1)(c) of the Access to Information Act, and that it applied an unofficial "Rule of 5" policy. During the investigation, DFO also suggested the information could fall under subsection 19(1). The Commissioner found that DFO failed to demonstrate that the information met the requirements for exemption under paragraph 20(1)(b), as it was not shown to be financial, commercial, scientific, or technical, nor objectively confidential, nor consistently treated as confidential by third parties. Similarly, DFO's arguments for withholding under paragraph 20(1)(c) were deemed speculative and lacked evidence of a reasonable expectation of harm without identifiable third parties. The Commissioner also concluded that the information did not meet the requirements of subsection 19(1) because there was no serious possibility of identifying individuals, a finding supported by the Office of the Privacy Commissioner. Finally, the investigation revealed that DFO did not apply the alleged "Rule of 5" policy to this access request. The complaint was found to be well founded, and DFO was ordered to disclose all the information.

• Whether the requested information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA.
• Whether the requested information was confidential under s.20(1)(b) ATIA.
• Whether the requested information was supplied by a third party under s.20(1)(b) ATIA.
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA.
• Whether disclosure of the information could reasonably be expected to cause material financial impact on a third party or injure its competitive position under s.20(1)(c) ATIA.
• Whether the information constituted personal information under s.19(1) ATIA.
• Whether DFO applied an unofficial internal policy ("Rule of 5") to refuse access to the information.
• Whether DFO adequately identified third parties for notification under s.33 and s.35(2)(c) ATIA.

The complainant alleged that Global Affairs Canada (Global Affairs) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act concerning consultations on military operations. During the investigation, Global Affairs made a supplementary disclosure but continued to withhold certain portions. The OIC found that Global Affairs failed to demonstrate that all requirements for the claimed exemptions were met and did not reasonably exercise its discretion regarding disclosure. Specifically, the OIC determined that much of the information was not foreign-sourced as required by s.13(1) and that Global Affairs did not adequately justify the harm required for s.15(1), especially given prior disclosures of similar information. The Commissioner informed Global Affairs of her intention to order disclosure and re-exercise of discretion. Global Affairs subsequently released all previously withheld information, rendering a formal order unnecessary. The complaint was found to be well founded.

• Whether the information was obtained in confidence from a specified government body under s.13(1)
• Whether Global Affairs reasonably exercised its discretion to disclose information under s.13(2)
• Whether disclosure could reasonably be expected to harm international affairs, national security, or defence under s.15(1)
• Whether Global Affairs reasonably exercised its discretion to disclose information under s.15(2)

The Office of the Privacy Commissioner of Canada (OPC) launched a Commissioner-initiated investigation (CII) into a privacy breach at WestJet that occurred on June 12, 2025. An unauthorized third party gained access to an employee's administrative account, bypassed multi-factor authentication, deployed ransomware, and exfiltrated data affecting approximately 5.1 million Canadian employees and customers. The breach exposed names, dates of birth, email addresses, mailing addresses, phone numbers, gender, travel booking information, and passport details, but no credit card numbers or SINs. WestJet took immediate containment measures, reported the breach, and provided direct and indirect notifications, credit monitoring, and identity theft protection services. WestJet has committed to further actions, including an external security assessment and providing a summary report to the OPC by August 7, 2026, to ensure the adequacy of its updated security safeguards and prevent future breaches. The CII will be discontinued upon the Commissioner being satisfied that WestJet has fulfilled all commitments.

• Adequacy of security safeguards under PIPEDA
• Adequacy of notifications to affected individuals under PIPEDA
• Whether WestJet's post-breach remediation actions and future commitments provide a fair and reasonable response to the incident

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld information under several provisions of the Access to Information Act and failed to conduct a reasonable search for records related to a marine water incident. The OIC investigation found that VFPA did not demonstrate that some withheld information qualified as personal information or advice/recommendations. Specifically, information related to an employee's functions was not personal information, and certain reports and factual information did not constitute advice or recommendations. However, the OIC found that VFPA's application of solicitor-client privilege and its exercise of discretion for other exemptions were reasonable. The OIC also concluded that VFPA conducted a reasonable search for records. The complaint was found to be well-founded because VFPA improperly withheld some information under subsection 19(1) and paragraph 21(1)(a). VFPA was ordered to disclose specific information, and the institution agreed to implement the order.

• Whether s.19(1) ATIA (personal information) was properly applied to information about an individual's functions as an employee
• Whether s.19(1) ATIA (personal information) was properly applied to other personal information
• Whether VFPA reasonably exercised discretion under s.19(2) ATIA for personal information
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to information in a report prepared for the institution
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to factual information
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to exchanges of advice or recommendations
• Whether VFPA reasonably exercised discretion under s.21(1)(a) ATIA for advice or recommendations
• Whether s.23 ATIA (solicitor-client privilege) was properly applied to information related to legal advice
• Whether VFPA reasonably exercised discretion under s.23 ATIA for solicitor-client privilege
• Whether VFPA conducted a reasonable search for records

An anonymous applicant complained that the Privy Council Office (PCO) improperly withheld information under multiple sections of the Access to Information Act (ATIA) in response to a request for records concerning the "Intelligence Advisory Committee (IAC) Mandate and Membership." During the investigation, PCO failed to provide any representations to justify its application of exemptions, despite multiple requests from the Office of the Information Commissioner (OIC). The Commissioner found that PCO did not meet the burden of proof for exemptions under subsections 13(1), 15(1), 16(1), 16(2), 18, and 24(1), citing reasons such as the Canadian origin of information, prior disclosures, inconsistent redactions, the age of the records, and the absence of justification. While subsection 19(1) was upheld for certain personal information, the Commissioner found no basis for PCO to exercise discretion to release it. Consequently, the Commissioner concluded the complaint was well founded and ordered PCO to fully disclose all responsive records improperly withheld. PCO subsequently gave notice that it would not fully implement the order and attempted to provide late submissions, but the Commissioner rejected these new arguments and maintained the original order.

• Whether s.13(1) applied to Canadian-authored analysis concerning foreign governments or international events
• Whether s.13(1) applied given the absence of representations from PCO
• Whether s.15(1) applied given prior disclosures of identical information by other federal institutions
• Whether s.15(1) applied to distribution markings given prior disclosures by PCO and other departments
• Whether s.15(1) applied given inconsistent redactions of the same document within the records
• Whether s.15(1) applied given the absence of representations from PCO explaining the nature of harm
• Whether s.16(1)(a) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(b) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(c) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(1)(d) applied given PCO's failure to specify the paragraph relied upon, the age of the information, and lack of representations
• Whether s.16(2) applied given the decades-old nature of the information and the absence of representations explaining how it could facilitate an offence today
• Whether s.18(a) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(b) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(c) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.18(d) applied given the historical nature of the information and the absence of representations specifying the paragraph or demonstrating economic harm
• Whether s.19(1) applied to personal information of other individuals
• Whether PCO properly exercised discretion under s.19(2) to release personal information
• Whether s.24(1) applied to the acronym "CSIS" given its public nature and prior disclosures
• Whether s.24(1) applied to names of CSIS employees without representations explaining covert status or continued protection
• Whether PCO's submissions made after the initial report should be considered

The Information Commissioner received a complaint alleging that the titles of certain briefing notes published on the Open Canada website were improperly withheld. The complaint did not arise from an access request made under Part 1 of the Access to Information Act (ATIA). The Commissioner reviewed the complaint under section 30 of the ATIA, which outlines the types of complaints that can be investigated. It was determined that the complaint did not fall under paragraphs 30(1)(a) to (d.1) as it did not relate to an access request. Furthermore, it did not fall under paragraph 30(1)(e) or 30(1)(f) as it did not concern a matter relating to requesting or obtaining access to records under Part 1 of the ATIA. The Commissioner noted that subsection 91(1) of the ATIA specifically precludes her from exercising powers related to the proactive publication of information under Part 2 of the Act. Consequently, the complaint was found inadmissible, and the Commissioner declined to investigate due to a lack of authority.

• Whether the complaint fell within the scope of section 30(1)(a) to (d.1) of the ATIA (complaints related to access requests)
• Whether the complaint fell within the scope of section 30(1)(e) or (f) of the ATIA (other matters relating to requesting or obtaining access under Part 1)
• Whether the Commissioner has authority to investigate complaints related to proactive publication under Part 2 of the ATIA (s.91(1))

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records in response to an access request for weightlifting-related communication records from two specific Sport Canada employees. Initially, the complaint also included allegations of improper withholding under s.19(1) and s.20(1)(b), but these were later withdrawn by the complainant, narrowing the investigation to the reasonable search aspect. Canadian Heritage released five pages of records but did not provide sufficient representations to the OIC regarding the keywords used, the search for call logs and text messages, or the timing of decisions on appeals. The Commissioner found that the institution's search was likely not broad enough and that it failed to demonstrate the reasonableness of its search efforts. Consequently, the complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether Canadian Heritage provided sufficient representations to explain its search methodology

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency's (CBSA) handling of access to information requests related to the ArriveCAN application. The investigation focused on the completeness and timeliness of responses. While allegations of permanent destruction of emails were not substantiated, the investigation revealed that the ArriveCAN project team used the communication platform Slack, which was permanently deleted in May 2023 without consultation with the ATIP unit or content review. This led to a finding that the CBSA failed to conduct reasonable searches for six ArriveCAN-related access requests, as Slack was not searched despite likely containing responsive records. The investigation also identified broader weaknesses in information management, including the use of non-government email accounts and insufficient governance over third-party tools. Although the CBSA failed to meet legislated timelines for some ArriveCAN requests, no unique timeliness concerns specific to the initiative were identified. The complaint was found to be well-founded, and the CBSA accepted the Commissioner's recommendations for corrective measures.

• Whether the Canada Border Services Agency conducted reasonable searches for records related to ArriveCAN access requests
• Whether the deletion of the ArriveCAN Slack workspace impacted the completeness of responses to access requests
• Whether the Canada Border Services Agency's information management practices were adequate for access to information purposes
• Whether the Canada Border Services Agency responded to ArriveCAN-related access requests within legislated timelines

The Office of the Privacy Commissioner of Canada (OPC) initiated complaints against X Corp. and X.AI LLC following reports that their AI chatbot, Grok, generated millions of sexualized deepfakes of identifiable individuals. The investigation focused on whether valid consent was obtained for the collection, use, and disclosure of personal information for this purpose, and if such practices were appropriate under PIPEDA. The OPC found that neither company obtained valid consent, noting the sensitive nature of the information, the unreasonableness of individuals' expectations, and the significant risk of harm. Furthermore, the OPC concluded that the generation of sexualized deepfakes was inappropriate, as the loss of privacy and harm far outweighed any benefits, and less privacy-invasive means were available. While the companies implemented some safeguards, the OPC deemed their initial response insufficient and their current measures unproven. Consequently, the matter was found well-founded, with the OPC making several recommendations for improved safeguards, proactive monitoring, and annual third-party audits, while committing to ongoing monitoring.

• Whether PIPEDA applies to X Corp. and X.AI LLC, specifically regarding the existence of a "real and substantial connection" to Canada.
• Whether deepfakes of identifiable individuals, including sexualized deepfakes, constitute "personal information" under PIPEDA.
• Whether X Corp. and X.AI LLC obtained valid consent for the collection, use, and disclosure of personal information to generate sexualized deepfakes, as required by Principle 4.3 of PIPEDA.
• Whether express consent was required for the generation of sexualized deepfakes, considering the sensitivity of the information, individuals' reasonable expectations, and the risk of significant harm (Principle 4.3.4, 4.3.5, and s.6.1 of PIPEDA).
• Whether X Corp. and X.AI LLC are accountable for ensuring valid consent for content generated by their tools in the course of commercial activity.
• Whether a reasonable person would consider the collection, use, and disclosure of personal information for the purpose of an image generation service capable of producing sexualized deepfakes to be appropriate in the circumstances, as per subsection 5(3) of PIPEDA.
• Whether the organizations had a legitimate need or bona fide business interest that extended to providing an image generation tool capable of producing non-consensual sexualized deepfakes.
• Whether less privacy-invasive means were available to achieve the organizations' purposes at comparable cost and benefits.
• Whether the loss of privacy and risk of harm associated with sexualized deepfakes were proportionate to the benefits of the practice.
• Whether X Corp. and X.AI LLC's initial response and implemented safeguards were sufficient and effective in preventing the generation of sexualized deepfakes.

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (solicitor-client privilege) of the Access to Information Act. The request sought documents related to the appointment of an administrator for a Lieutenant Governor. While the Commissioner found that the information met the requirements for solicitor-client privilege, LAC's initial exercise of discretion not to release the 93-year-old record was deemed unreasonable. LAC had a policy to release such records if over 100 years old, but failed to consider other relevant factors like the content, context, and the fact that involved individuals were long deceased. During the investigation, LAC re-exercised its discretion, considering these factors, and subsequently released all the information. The complaint was found to be well-founded due to the initial unreasonable exercise of discretion, but no order was necessary as the information was ultimately disclosed.

• Whether the information met the requirements of s.23 ATIA (solicitor-client privilege)
• Whether the institution reasonably exercised its discretion not to disclose information subject to s.23 ATIA

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly withheld personal information under subsection 19(1) of the Access to Information Act. The request sought records related to weightlifting in 2023 and 2024, specifically confirmation letters, athlete rationale forms, and appeals. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The investigation found that Canadian Heritage's search was too narrow, as it only used one athlete's name despite the request not being limited to a specific individual. While the institution provided explanations for the non-existence of some specific records, the Commissioner concluded that the overall search was not reasonable and additional records might exist. The Information Commissioner ordered Canadian Heritage to conduct a new, broader search and provide a new response to the complainant.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether s.19(1) personal information exemption was properly applied

The complainant alleged that the Canadian Food Inspection Agency (CFIA) failed to respond to an access request within the 30-day statutory period. The request sought records related to the cull of ostriches at Universal Ostrich Farms. The CFIA was deemed to have refused access due to the delay, which it attributed to ongoing RCMP investigations, safety and security concerns, and the volume of records. The Information Commissioner found the CFIA's delay in searching and gathering records to be irresponsible and a blatant disregard for the Act. The Commissioner noted that the Act does not permit an institution to 'pause' a request due to sensitivity or a strategic plan for multiple requests. The Commissioner ordered the CFIA to provide a complete response within 36 business days of the final report. The CFIA confirmed it would implement the order and had already begun retrieving and reviewing records.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (ongoing RCMP investigations, safety/security concerns, volume of records) justified the failure to respond within statutory timelines
• Whether the Access to Information Act authorizes an institution to 'pause' a response to an access request