Canadian privacy & access decisions

The Information Commissioner received a complaint alleging that the titles of certain briefing notes published on the Open Canada website were improperly withheld. The complaint did not arise from an access request made under Part 1 of the Access to Information Act (ATIA). The Commissioner reviewed the complaint under section 30 of the ATIA, which outlines the types of complaints that can be investigated. It was determined that the complaint did not fall under paragraphs 30(1)(a) to (d.1) as it did not relate to an access request. Furthermore, it did not fall under paragraph 30(1)(e) or 30(1)(f) as it did not concern a matter relating to requesting or obtaining access to records under Part 1 of the ATIA. The Commissioner noted that subsection 91(1) of the ATIA specifically precludes her from exercising powers related to the proactive publication of information under Part 2 of the Act. Consequently, the complaint was found inadmissible, and the Commissioner declined to investigate due to a lack of authority.

• Whether the complaint fell within the scope of section 30(1)(a) to (d.1) of the ATIA (complaints related to access requests)
• Whether the complaint fell within the scope of section 30(1)(e) or (f) of the ATIA (other matters relating to requesting or obtaining access under Part 1)
• Whether the Commissioner has authority to investigate complaints related to proactive publication under Part 2 of the ATIA (s.91(1))

The Information Commissioner initiated a systemic investigation into the Canada Border Services Agency's (CBSA) handling of access to information requests related to the ArriveCAN application. The investigation focused on the completeness and timeliness of responses. While allegations of permanent destruction of emails were not substantiated, the investigation revealed that the ArriveCAN project team used the communication platform Slack, which was permanently deleted in May 2023 without consultation with the ATIP unit or content review. This led to a finding that the CBSA failed to conduct reasonable searches for six ArriveCAN-related access requests, as Slack was not searched despite likely containing responsive records. The investigation also identified broader weaknesses in information management, including the use of non-government email accounts and insufficient governance over third-party tools. Although the CBSA failed to meet legislated timelines for some ArriveCAN requests, no unique timeliness concerns specific to the initiative were identified. The complaint was found to be well-founded, and the CBSA accepted the Commissioner's recommendations for corrective measures.

• Whether the Canada Border Services Agency conducted reasonable searches for records related to ArriveCAN access requests
• Whether the deletion of the ArriveCAN Slack workspace impacted the completeness of responses to access requests
• Whether the Canada Border Services Agency's information management practices were adequate for access to information purposes
• Whether the Canada Border Services Agency responded to ArriveCAN-related access requests within legislated timelines

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under section 23 (solicitor-client privilege) of the Access to Information Act. The request sought documents related to the appointment of an administrator for a Lieutenant Governor. While the Commissioner found that the information met the requirements for solicitor-client privilege, LAC's initial exercise of discretion not to release the 93-year-old record was deemed unreasonable. LAC had a policy to release such records if over 100 years old, but failed to consider other relevant factors like the content, context, and the fact that involved individuals were long deceased. During the investigation, LAC re-exercised its discretion, considering these factors, and subsequently released all the information. The complaint was found to be well-founded due to the initial unreasonable exercise of discretion, but no order was necessary as the information was ultimately disclosed.

• Whether the information met the requirements of s.23 ATIA (solicitor-client privilege)
• Whether the institution reasonably exercised its discretion not to disclose information subject to s.23 ATIA

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly withheld personal information under subsection 19(1) of the Access to Information Act. The request sought records related to weightlifting in 2023 and 2024, specifically confirmation letters, athlete rationale forms, and appeals. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The investigation found that Canadian Heritage's search was too narrow, as it only used one athlete's name despite the request not being limited to a specific individual. While the institution provided explanations for the non-existence of some specific records, the Commissioner concluded that the overall search was not reasonable and additional records might exist. The Information Commissioner ordered Canadian Heritage to conduct a new, broader search and provide a new response to the complainant.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether the scope of the search was broad enough to capture all responsive records
• Whether s.19(1) personal information exemption was properly applied

The complainant alleged that the Canadian Food Inspection Agency (CFIA) failed to respond to an access request within the 30-day statutory period. The request sought records related to the cull of ostriches at Universal Ostrich Farms. The CFIA was deemed to have refused access due to the delay, which it attributed to ongoing RCMP investigations, safety and security concerns, and the volume of records. The Information Commissioner found the CFIA's delay in searching and gathering records to be irresponsible and a blatant disregard for the Act. The Commissioner noted that the Act does not permit an institution to 'pause' a request due to sensitivity or a strategic plan for multiple requests. The Commissioner ordered the CFIA to provide a complete response within 36 business days of the final report. The CFIA confirmed it would implement the order and had already begun retrieving and reviewing records.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (ongoing RCMP investigations, safety/security concerns, volume of records) justified the failure to respond within statutory timelines
• Whether the Access to Information Act authorizes an institution to 'pause' a response to an access request

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly claimed that some records did not exist in response to an access request for communications between Canadian Olympic Committee staff and Sport Canada staff related to weightlifting. The investigation found that the institution's search scope was too narrow, as it only used one athlete's name for keywords and did not adequately explain why certain repositories like Outlook were not searched. Furthermore, the OIC identified specific responsive records that were not provided by Canadian Heritage. The Commissioner concluded that Canadian Heritage did not conduct a reasonable search and that additional records likely exist. The complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether Canadian Heritage improperly responded that some or all requested records do not exist

The complainant alleged that the Business Development Bank of Canada (BDC) improperly refused to process an access request for records related to three companies. BDC argued that the requester had not confirmed their right of access and that any responsive records would ultimately be withheld due to statutory confidentiality obligations. The Information Commissioner found that the request met the requirements of section 6 of the Access to Information Act, as it was in writing, made to the correct institution, and provided sufficient detail. The Commissioner also determined that the complainant, a corporation located in Canada, had met the right of access under section 4 of the Act. BDC's demand for proof of identification and board resolutions was deemed an improper prerequisite to processing the request. The Commissioner concluded that BDC was obligated to process the request and issue a proper response under sections 7 and 10 of the Act. The complaint was found to be well founded, and BDC was ordered to accept and process the request.

• Whether the access request met the requirements of section 6 of the ATIA
• Whether the complainant, a corporation, met the right of access under section 4 of the ATIA
• Whether BDC's demand for proof of identification and board resolutions was a valid prerequisite to processing the request
• Whether BDC's refusal to process the request based on anticipated exemptions was appropriate

The complainant alleged that the Department of Justice Canada improperly withheld a "Final report: Mandatory Minimum Penalties. Recommendations to the Minister of Justice and Attorney General of Canada. Expert Panel on Sentencing Reform" under sections 14 and 21(1)(a) of the Access to Information Act. The Department argued that disclosure would harm federal-provincial affairs and that the report constituted advice or recommendations from internal-like advisors. The Commissioner found no reasonable expectation of harm to federal-provincial affairs, noting the report was six years old, drafted by volunteers, and did not detail active negotiations or provincial positions. Furthermore, the Commissioner determined that the report was prepared by external consultants, not employees or ministerial staff, thus falling under an exception to the advice and recommendations exemption. Consequently, the Commissioner ordered the Department to disclose the records in their entirety, and the Department agreed to comply.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to the records
• Whether disclosure of the report could reasonably be expected to harm the conduct of federal-provincial affairs
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to the records
• Whether the report was prepared by consultants or advisers who were not directors, officers, or employees of an institution or members of a minister's staff, as per s.21(2)(b) ATIA

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld employee telephone numbers under paragraph 16(2)(c) of the Access to Information Act, claiming disclosure could facilitate the commission of an offence. The request was for a telephone list for the CRA Headquarters International and Large Business Directorate. The complainant also initially alleged an unreasonable search, but later withdrew this aspect of the complaint. The CRA argued that disclosing cell phone numbers, now widely used by employees, could lead to hacking, interception of communications, identity theft, fraud, and harassment, citing vulnerabilities like SS7 attacks. However, the OIC found that the CRA failed to provide clear and convincing evidence of a reasonable expectation of harm, noting that government devices are encrypted and employees are trained on security risks. The OIC also pointed out that some of the numbers were already publicly available, undermining the CRA's claim of harm. The Information Commissioner concluded that the CRA did not meet the requirements for applying paragraph 16(2)(c). The complaint was deemed well founded, and the CRA subsequently released the withheld phone numbers.

• Whether s.16(2)(c) ATIA (facilitating the commission of an offence) was properly applied to withhold employee telephone numbers
• Whether there was a reasonable expectation of harm from disclosing employee telephone numbers
• Whether the institution's security measures for government devices mitigated the risk of harm
• Whether the public availability of some employee telephone numbers undermined the claim of harm
• Whether the institution conducted a reasonable search for records

The complainant alleged that Health Canada improperly withheld information related to a COVID-19 Vaccine Periodic Safety Update Report under sections 13(1), 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act. The Information Commissioner found that Health Canada correctly applied section 13(1) and 19(1) to some information, but failed to reasonably exercise its discretion under section 13(2) for publicly available information. The Commissioner also found that Health Canada and the third party (Pfizer) did not establish that sections 20(1)(b) or 20(1)(c) applied. Consequently, the Commissioner ordered Health Canada to disclose information not covered by sections 13(1) or 19(1), and to re-evaluate the disclosure of section 13(1) information that is publicly available. Health Canada agreed to comply with the order.

• Whether s.13(1) ATIA applied to information obtained from the European Medical Agency (EMA)
• Whether Health Canada reasonably exercised its discretion under s.13(2) ATIA regarding publicly available information
• Whether s.19(1) ATIA applied to personal information that could identify individuals
• Whether Health Canada reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA applied to confidential third-party financial, commercial, scientific or technical information
• Whether s.20(1)(c) ATIA applied to information that could cause financial impact or harm competitive position to a third party

The complainant alleged that Transport Canada failed to respond to an access request within the statutory 30-day period and improperly handled the request before opening the file. The request sought correspondence related to the Greater Toronto Airports Authority (GTAA) concerning noise, flight path changes, passenger-based formulas, and airspace redesign. The investigation found that Transport Canada did not respond within the 30-day timeframe, largely due to delays from a primary Office of Primary Interest (OPI) in retrieving records, exacerbated by a building fire that prevented access to paper records. Electronic records were also not processed while waiting for paper records. However, the Commissioner found that Transport Canada did not improperly handle the request initially, as it reasonably sought clarification when the request did not explicitly name the institution. The complaint regarding the delay was found to be well-founded, and Transport Canada was ordered to provide a complete response within 120 business days. Transport Canada indicated it would not fully implement the order, stating it would provide an interim response instead.

• Whether Transport Canada responded to the access request within the 30-day period as per section 7 of the Access to Information Act
• Whether Transport Canada improperly handled the request before opening the file
• Whether Transport Canada met its duty to assist the complainant under subsection 4(2.1)

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to a previous access request (A-2012-00683) and a 10-page "Lessons Learned" document. The OIC found that PCO did not provide sufficient evidence to demonstrate that a reasonable search had been conducted, particularly regarding a second search by its Records Operations unit for which details were lacking. The Commissioner concluded that PCO did not conduct a reasonable search. Consequently, the complaint was deemed well founded, and PCO was ordered to conduct a new search, process any additional records found, and provide a supplementary response to the complainant within 36 business days. PCO did not indicate whether it would comply with the order.

• Whether the institution conducted a reasonable search for records

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for Microsoft Teams messages and related policies. ISED claimed a 390-day extension, citing the volume of records, complexity, and the need for senior-level review, as well as internal and external consultations. The Commissioner found that ISED failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to determine the necessary length. Specifically, the 240-day extension for volume and interference was deemed excessive, and the 150-day extension for consultations lacked sufficient justification. The Commissioner concluded that the extension was invalid, leading to a deemed refusal of access. The complaint was found to be well-founded, and ISED was ordered to provide a complete response within 60 business days.

• Whether the 240-day extension under s.9(1)(a) ATIA for volume and interference was reasonable
• Whether the 150-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether ISED made a serious effort to assess the necessary length of the extension of time
• Whether there was a link between the reasons for the extension and its length
• Whether the calculation of the length of the extension was sufficiently rigorous, logical, and supportable
• Whether ISED was in deemed refusal under s.10(3) ATIA

An unnamed federal institution applied to the Information Commissioner for approval to decline to act on an access request, arguing it constituted an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The request sought extensive records related to rare diseases and medications, spanning from the earliest records to the present, across multiple departments and communication types. The institution contended the request was overly broad, would overburden its small staff, and required manual review of an unmanageable volume of records. The Commissioner found that the request, particularly its fifth part, was indeed overly broad and that responding to it would overburden the institution, which has only 15 employees and processes a modest number of pages annually. Despite the requester's offer to provide a more specific list of diseases, the Commissioner concluded that the institution had made reasonable efforts to assist and that the request would still be unduly burdensome. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request is an abuse of the right of access under s.6.1(1) ATIA
• Whether the request is overly broad
• Whether acting on the request would overburden the institution
• Whether the institution met its duty to assist the requester under s.4(2.1) ATIA
• Whether the circumstances warrant granting approval to decline to act on the request

The complainant sought records related to the Canada Student Service Grant from Employment and Social Development Canada (ESDC), alleging improper withholding of information under several exemptions and an unreasonable search for records. The Commissioner found that ESDC improperly withheld information claimed under paragraphs 20(1)(b) and 20(1)(c), determining that the institution failed to demonstrate the information's confidentiality, its financial/commercial/scientific/technical nature, or a reasonable expectation of harm from disclosure. For information withheld under paragraphs 21(1)(a) and 21(1)(b), the Commissioner concluded that factual information and final decisions did not meet the exemption requirements and that ESDC failed to reasonably exercise its discretion for other information that did meet the requirements. Similarly, while the majority of information claimed under section 23 met the requirements for solicitor-client privilege, some portions did not, and privilege was waived for other parts by the Privy Council Office. However, the Commissioner found that ESDC conducted a reasonable search for records, despite the complainant's concerns about missing emails, handwritten notes, and cabinet confidences. Consequently, the complaint was found to be well founded regarding the improper application of exemptions and the failure to exercise discretion. The Commissioner ordered ESDC to disclose specific information and to re-exercise its discretion for other information withheld under sections 21 and 23. ESDC notified the Commissioner of its intent to comply with the order, though it also indicated a desire to apply additional exemptions not raised during the investigation, which the Commissioner rejected.

• Whether ESDC improperly withheld information under s.16(2) ATIA
• Whether ESDC improperly withheld information under s.19(1) ATIA
• Whether the information met the requirements of s.20(1)(b) ATIA (confidential financial, commercial, scientific or technical information)
• Whether the information met the requirements of s.20(1)(c) ATIA (material financial impact or harm to competitive position)
• Whether the information met the requirements of s.21(1)(a) ATIA (advice or recommendations)
• Whether the information met the requirements of s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information met the requirements of s.23 ATIA (solicitor-client and litigation privilege)
• Whether ESDC reasonably exercised its discretion to disclose information under s.20(5) ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.21 ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.23 ATIA
• Whether ESDC conducted a reasonable search for records
• Whether PCO waived solicitor-client privilege over certain information