Canadian privacy & access decisions

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The institution argued that the request was vexatious, an abuse of the right of access, and made in bad faith. The Commissioner found that the institution successfully demonstrated that the access request was vexatious. Consequently, the Commissioner determined that the circumstances justified granting the institution's request to decline to act on the access request. The application was therefore granted, allowing the institution to refuse processing the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the circumstances warranted approval to decline to act on the request

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory 30-day period, as required by section 7 of the Access to Information Act. The request sought records related to Dr. Ross Harvey's review of Suffield Experimental Station/Defence Research Establishment Suffield reports, specifically his recommendations and their implementation by DRES management. DND extended the response period by 120 days, making the new deadline August 31, 2023, but failed to respond by this date. The investigation found that DND did not meet its obligation, leading to a deemed refusal of access under subsection 10(3) of the Act. The Commissioner noted ongoing internal discussions within DND regarding severances, which delayed the processing and release of records. The Commissioner concluded that DND's lack of responsiveness contravened its obligations and undermined the access system. The complaint was found to be well founded, and DND was ordered to complete the retrieval of records and provide a full response.

• Whether National Defence responded to the access request within the statutory time limits under section 7 of the ATIA
• Whether National Defence's extension of the response period under paragraph 9(1)(a) was properly followed
• Whether National Defence is deemed to have refused access under subsection 10(3) due to failure to respond
• Whether National Defence's ongoing internal review processes justified the delay in responding

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence related to a specific standing offer and company. PHAC extended the response time by 255 days, citing subsections 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner investigated whether the extension under 9(1)(a) was reasonable, noting that PHAC initially identified 2,962 pages, later corrected to 1,805 pages. While acknowledging the volume and potential interference with operations, the Commissioner found that PHAC failed to justify the reasonableness of the 180-day extension taken under 9(1)(a), particularly regarding its estimated review rate of 500 pages per 30 days. Consequently, the Commissioner concluded that the extension was invalid, and PHAC was deemed to have refused access under subsection 10(3) of the Act. The complaint was found to be well founded, and PHAC was ordered to provide a complete response within 60 business days.

• Whether the extension of time taken under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the request was for a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period under paragraph 9(1)(a)
• Whether the institution provided convincing explanation for its estimated monthly review rate of 500 pages
• Whether the institution applied sufficient rigour and logic in determining the duration of the extension
• Whether the institution is deemed to have refused access under subsection 10(3)

The complainant alleged that Housing, Infrastructure and Communities Canada (Infrastructure Canada) improperly withheld information under subsections 19(1), 20(1)(b), 20(1)(c), and 24(1) of the Access to Information Act. The request sought payment documents from Signature on the Saint Lawrence Group (SSLG) to Infrastructure Canada. During the investigation, the complainant narrowed the scope, no longer requiring investigation into GST/PST numbers, banking information, and information withheld under subsection 19(1). The Commissioner found that Infrastructure Canada and SSLG successfully demonstrated that information related to pricing and contractual relationships met the requirements of paragraph 20(1)(c). However, they failed to justify the withholding of other information under paragraphs 20(1)(b), 20(1)(c), or subsection 24(1). The Commissioner ordered Infrastructure Canada to disclose the remaining information, excluding that related to pricing and contractual relationships. Infrastructure Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(c) financial impact on a third party was properly withheld
• Whether s.24(1) disclosure restricted by another law was properly withheld
• Whether disclosure of financial information provides insight into pricing and contractual relationships
• Whether disclosure of financial information would give SSLG’s competitors an advantage
• Whether the argument that disclosure could be seen negatively by project owners on future bids was speculative
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential by an objective standard under s.20(1)(b)
• Whether the information was supplied by a third party to a government institution under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the content of the record is not available from sources otherwise accessible to the public
• Whether the information originates and is communicated in a reasonable expectation of confidence
• Whether the information was communicated in a relationship between government and the third party that is either a fiduciary relationship or one that is not contrary to the public interest, and that will be fostered for the public benefit by confidential communication
• Whether the confidentiality clause in the Project Agreement is determinative for objective confidentiality
• Whether the information contained within the invoices was supplied by a third party to Infrastructure Canada
• Whether section 295 of the Excise Tax Act applies to the Procurement Business Number under s.24(1)

The complainant alleged that National Defence (DND) took an unreasonable extension of time to respond to an access request for information related to military equipment, weaponry, and ammunition sent to Ukraine from 2019 to 2022. DND initially extended the response time by 3,210 days, citing the large volume of records and interference with operations. The Commissioner found that while the request involved a large number of records and would interfere with operations, DND did not demonstrate that the extended period was reasonable, as it lacked sufficient rigor in its calculation and planned consecutive, rather than concurrent, processing steps. Consequently, DND was deemed to have refused access to the records. During the investigation, the complainant narrowed the scope of the request, reducing the record count by approximately 20,000 pages. DND then indicated it could respond within six months, which the complainant found acceptable. The Commissioner ordered DND to provide a complete response by November 25, 2024, and DND agreed to implement the order.

• Whether the extension of time taken by National Defence under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the access request was for a large number of records or required searching through a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day time limit would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period, having regard to the circumstances, under paragraph 9(1)(a)
• Whether National Defence was deemed to have refused access to the requested records pursuant to subsection 10(3)

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable extension of time to respond to an access request for communications related to designated projects in Western Canada. IAAC had extended the response time by 880 days, citing paragraphs 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner found that while the request involved a large volume of records, IAAC failed to demonstrate that the 820-day extension taken under paragraph 9(1)(a) was reasonable, particularly regarding its estimated monthly review rate. Consequently, the Commissioner concluded that IAAC was deemed to have refused access under subsection 10(3) of the Act. The Commissioner ordered IAAC to provide a complete response to the access request by April 23, 2025. IAAC's President confirmed that the agency would implement the order, outlining steps to increase processing capacity and optimize ATIP processes.

• Whether the extension of time taken under s.9(1)(a) was for a reasonable period
• Whether the request was for a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the institution is deemed to have refused access under s.10(3)

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act, concerning investigation reports into the deaths of two individuals. The RCMP demonstrated that the records met the requirements for exemption under s.16(1)(a), as they were created less than 20 years prior, obtained by an investigative body during a lawful investigation into crime detection/suppression and law enforcement. The Commissioner found that the RCMP reasonably exercised its discretion not to disclose the information, having considered relevant factors including investigative integrity and privacy. While acknowledging the RCMP's correct application of the Act, the Commissioner noted a gap in the legislation regarding the disclosure of deceased individuals' personal information for compassionate reasons. The complaint was ultimately found not well founded.

• Whether the information was obtained or prepared by an investigative body listed in Schedule I of the Access to Information Regulations
• Whether the information was obtained or prepared during a lawful investigation within the authority of the investigative body
• Whether the information concerned an investigation related to the detection, prevention or suppression of crime or the enforcement of any law of Canada or a province
• Whether the records were created less than 20 years before the access request was made
• Whether the institution reasonably exercised its discretion to decide whether to disclose the information

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to respond to an access request within the 30-day statutory period. The request sought specific documents related to a briefing note on litigation, some of which had been previously released. The investigation confirmed that CIRNAC did not respond by the deadline, leading to a deemed refusal of access under subsection 10(3) of the Act. The Information Commissioner found the delay by the Resolution & Partnerships unit in retrieving records, despite multiple follow-ups from the ATIP office, to be unacceptable. The Commissioner ordered CIRNAC to complete record retrieval and provide a full response within 36 business days. Additionally, the Commissioner recommended that CIRNAC develop proper processes and performance indicators to ensure timely record provision by its Offices of Primary Interest. CIRNAC agreed to implement the order but did not commit to the recommendations. The complaint was found to be well founded.

• Whether the institution responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether the institution is deemed to have refused access to the requested records under subsection 10(3) of the Act
• Whether the delay by the Office of Primary Interest (Resolution & Partnerships unit) in retrieving records was acceptable

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to "Ops 3" and "Ops 4" files under the Access to Information Act. Initially, PCO provided only two pages, which were a Records Retention and Disposal Authority form, not the requested operational records. The Office of the Information Commissioner (OIC) found that PCO's initial search was inadequate, particularly as no documents from specific Interdepartmental Committee on Security and Intelligence files, which were known to exist, were located. Following the OIC's intervention, PCO conducted a subsequent search and identified 251 additional responsive pages. The Commissioner concluded that the complaint was well founded because PCO did not conduct a reasonable search initially. PCO was ordered to complete the retrieval and processing of all responsive records and provide a supplementary response to the access request by December 22, 2024. PCO has committed to implementing this order.

• Whether the Privy Council Office conducted a reasonable search for records responsive to the access request

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the extended time limit, constituting a deemed refusal under the Access to Information Act. The request sought historical records related to the Canadian Intelligence Program and the Joint Intelligence Organization. The investigation confirmed that LAC did not respond by the extended deadline of February 13, 2020, for a request received in July 2019. Despite the records comprising 135 pages and a consultation with Global Affairs Canada being completed, LAC had not finalized processing the request almost five years later. The Information Commissioner found the delay unacceptable and ordered LAC to provide a complete response within 36 business days. However, LAC notified the Commissioner that it would not implement the order due to workload prioritization, stating the records required careful review and further consultation.

• Whether Library and Archives Canada responded to the access request within the extended time limit under subsection 9(1) of the Access to Information Act
• Whether Library and Archives Canada is deemed to have refused access under subsection 10(3) of the Act due to delay

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request for emails, text messages, and briefing notes related to companies working on the ArriveCAN application. The complainant specifically questioned the absence of text messages in the records provided. The Office of the Information Commissioner (OIC) investigated CBSA's search efforts, including the program areas involved, search parameters, and policies regarding text message management. CBSA explained that text messages are often considered transitory, especially if followed by an email, and that employees are responsible for saving non-transitory messages to a corporate repository. The OIC found that the Offices of Primary Interest conducted searches in appropriate repositories and that it was reasonable to believe that relevant text messages either did not exist or were not considered relevant at the time of the request, in line with CBSA and Treasury Board Secretariat policies. Consequently, the Information Commissioner concluded that CBSA conducted a reasonable search.

• Whether the Canada Border Services Agency conducted a reasonable search for records
• Whether text messages related to the ArriveCAN application existed and should have been provided
• Whether CBSA's information management policies regarding text messages were appropriately applied

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records from the Deputy Minister’s Office concerning the funding or fiscal management of the Assembly of First Nations between January 1, 2016, and April 1, 2019. The investigation revealed that CIRNAC's initial search was inadequate, as it did not task all relevant sectors despite internal recommendations and evidence suggesting the existence of more records. Specifically, the Policy and Strategic Direction (PSD) sector and the Audit and Evaluation sector were not initially tasked, even though the Deputy Minister's Office suggested their relevance. Furthermore, CIRNAC did not adequately explain why records from PSD prior to 2017 were inaccessible or why there was a paucity of records despite the Deputy Minister's known involvement in related discussions. The Commissioner concluded that CIRNAC did not conduct a reasonable search and ordered the institution to perform a new search and provide a revised response.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records from the Deputy Minister’s Office relating to funding or fiscal management of the Assembly of First Nations from January 1, 2016 to April 1, 2019
• Whether all relevant sectors were tasked in the search
• Whether the inaccessibility of records prior to 2017 was adequately explained
• Whether the paucity of located records was reasonable given the Deputy Minister's involvement

The complainant alleged that Health Canada failed to respond to an access request within the 30-day statutory period, as required by section 7 of the Access to Information Act. The request sought internal and external records related to a Regulatory Impact Analysis Statement for the Regulations Amending the Tobacco Products Regulations. Health Canada acknowledged that it had not responded by the deadline and was deemed to have refused access under subsection 10(3). The institution identified 20,250 pages of responsive records and indicated that extensive consultations with its Legal Services Unit, 10 other government departments, and 25-30 third parties would be required. Health Canada proposed a response date of July 17, 2030, citing the volume and complexity of records, and workload. The Commissioner found this proposed timeline unreasonable given the significant delay already incurred and the complainant's denied access rights. The Commissioner ordered Health Canada to provide a complete response by April 7, 2026, which the institution agreed to implement.

• Whether Health Canada responded to the access request within the 30-day period set out in section 7 of the Access to Information Act
• Whether Health Canada's proposed response date of July 17, 2030, was reasonable