Canadian Privacy Decisions

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information concerning a research project and an individual's role on an advisory board. The request focused on specific pages of records previously withheld under paragraph 20(1)(b) of the Access to Information Act, relating to a seed grant program, a sentinel site, and a research network's governance structure. The Commissioner found that the information did not meet the criteria for exemption under paragraph 20(1)(b) as it was neither financial, commercial, scientific, nor technical. Consequently, the complaint was well founded, and the CIHR was ordered to disclose the information.

• Whether the withheld information meets the criteria for exemption under paragraph 20(1)(b) of the ATIA.
• Whether the information constitutes financial, commercial, scientific, or technical information as defined by the ATIA.
• Whether the third party provided sufficient representations to support the exemption.

The Office of the Privacy Commissioner of Canada investigated a complaint against Agronomy Company of Canada Ltd. (Agronomy) following a significant data breach. The investigation found that Agronomy lacked appropriate safeguards, including multi-factor authentication, network segregation, and encryption, which contributed to the breach affecting 845 individuals. The OPC also found Agronomy lacked accountability structures. However, the complaint regarding valid consent for credit services was found not well-founded. Agronomy has since made significant improvements to its security measures and accountability practices.

• Adequacy of security safeguards
• Accountability for personal information
• Validity of consent for collection and use of personal information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld fatality investigation reports under the personal information (subsection 19(1)) and third-party commercial/technical information (paragraph 20(1)(b)) exemptions. The Information Commissioner found that some withheld information did not meet the requirements of subsection 19(1), and that ESDC failed to properly consider its discretion for disclosure under subsection 19(2)(b). The Commissioner also found that much of the information claimed under paragraph 20(1)(b) did not meet the criteria for being commercial/technical or confidential, and that ESDC failed to exercise its discretion properly regarding information related to a third party that had consented to disclosure. The complaint was found to be well-founded.

• Whether information withheld under subsection 19(1) meets the definition of personal information.
• Whether ESDC exercised its discretion reasonably under subsection 19(2) for publicly available information.
• Whether information withheld under paragraph 20(1)(b) meets the definition of confidential third-party commercial or technical information.
• Whether ESDC exercised its discretion reasonably under subsection 20(5) for information related to a consenting third party.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to an Occupational Health and Safety Tribunal decision concerning the death of an employee. The exemptions claimed were for personal information (subsection 19(1)), confidential third-party financial, commercial, scientific or technical information (paragraph 20(1)(b)), and solicitor-client privilege (section 23). The Information Commissioner found that ESDC failed to justify withholding information under paragraph 20(1)(b) and did not properly exercise discretion for information withheld under subsection 19(1) and section 23. ESDC was ordered to disclose information withheld under paragraph 20(1)(b) and to reconsider the disclosure of information withheld under subsection 19(1) and section 23.

• Justification for withholding personal information under subsection 19(1) ATIA
• Confidentiality and commercial/technical nature of information under paragraph 20(1)(b) ATIA
• Applicability of solicitor-client privilege under section 23 ATIA
• Reasonable exercise of discretion by the institution before withholding information

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information related to submarine operations in the Arctic region under exemptions for confidential government information and national security. The Information Commissioner found that LAC did not provide sufficient evidence to justify withholding the information under either exemption. The Commissioner recommended that LAC disclose the records in their entirety, but LAC stated it would not implement this recommendation.

• Justification for withholding information under subsection 13(1) (confidential information from government bodies).
• Justification for withholding information under subsection 15(1) (national security, defence).
• Whether the institution met the 'harm test' for exemption 15(1).
• Whether the institution met the 'confidentiality' requirement for exemption 13(1).

The complainant alleged that Indigenous Services Canada (ISC) did not conduct a reasonable search for records related to various infrastructure investment plans and frameworks. The investigation found that ISC's initial search was insufficient, as the Offices of Primary Interest tasked may not have been appropriate and other offices might hold responsive records. The Information Commissioner ordered ISC to conduct a new, broader search for records.

• Reasonableness of the search conducted by the institution
• Identification and tasking of appropriate offices of primary interest
• Adequacy of documentation of search efforts