Canadian privacy & access decisions

A federal institution applied to the Information Commissioner for approval to decline to act on two access to information requests, arguing they were vexatious and an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The institution claimed the requester submitted a high volume of requests, refused to narrow their scope, and engaged in intimidating communications, thereby diverting public resources and harassing the department. The Commissioner found that the institution failed to fulfill its duty to assist the requester under subsection 4(2.1) of the Act, as its communication was solely aimed at reducing scope without offering other assistance. Furthermore, the Commissioner determined that the institution did not provide clear and compelling evidence to support its claims that the requests were vexatious or an abuse of the right of access. The Commissioner denied the institution's application, requiring it to process the access requests.

• Whether the institution fulfilled its duty to assist obligations under subsection 4(2.1) of the Act
• Whether the access requests were vexatious under subsection 6.1(1) of the Act
• Whether the access requests constituted an abuse of the right to make a request under subsection 6.1(1) of the Act

The Office of the Privacy Commissioner of Canada (OPC) investigated Agronomy Company of Canada Ltd. following a complaint alleging inadequate safeguards, lack of accountability, and invalid consent for personal information collection and use, stemming from a data breach. A malicious actor gained access to Agronomy's systems, exfiltrating sensitive personal information of 845 individuals, including SINs, financial details, and identification documents, before deploying ransomware. The OPC found Agronomy failed to implement appropriate safeguards, citing a lack of multifactor authentication, network segregation, data encryption, and detection tools, which contributed to the breach. Furthermore, Agronomy lacked a comprehensive privacy policy, a designated privacy officer, and adequate staff training, indicating a failure in accountability. While these two aspects were found well-founded, Agronomy committed to significant improvements, leading to a conditionally resolved outcome. However, the OPC found the complaint regarding invalid consent for credit services not well-founded, as the complainant had signed a clearly labelled credit application and utilized the extended credit.

• Whether Agronomy implemented appropriate safeguards to adequately protect personal information under its control, as per PIPEDA Principle 4.7.
• Whether Agronomy's technical safeguards (multifactor authentication, network segregation, data encryption, detection and response tools) were appropriate for the sensitivity of the information.
• Whether Agronomy's organizational safeguards (incident response protocols, information management, security documentation, staff training) were adequate.
• Whether Agronomy was accountable for personal information under its control, including designating an individual for PIPEDA compliance and implementing policies and practices, as per PIPEDA Principle 4.1.
• Whether Agronomy obtained valid and meaningful consent for the collection and use of personal information for credit services, particularly sensitive information, as per PIPEDA Principle 4.3.

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsections 19(1), 20(1)(b), and section 23 of the Access to Information Act, related to an Occupational Health and Safety Tribunal decision concerning a Canadian National Railway (CN Rail) employee's death. The Commissioner found that ESDC and CN Rail did not demonstrate that all requirements for paragraph 20(1)(b) were met, particularly regarding confidentiality and whether the information was truly commercial or technical. While ESDC met the requirements for subsection 19(1) and section 23, the Commissioner determined that ESDC failed to reasonably exercise its discretion to decide whether to disclose the information, especially for publicly available personal information. Consequently, the Commissioner ordered ESDC to disclose the information withheld under paragraph 20(1)(b) and to re-exercise its discretion for information withheld under subsection 19(1) and section 23, considering all relevant factors for and against disclosure. ESDC agreed to implement the order.

• Whether s.19(1) personal information exemption was properly applied
• Whether the institution reasonably exercised its discretion under s.19(2) for personal information
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether s.23 solicitor-client privilege exemption was properly applied
• Whether the institution reasonably exercised its discretion for s.23 solicitor-client privileged information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request was for fatality investigation reports from rail industry employers. The Information Commissioner found that while much of the withheld information was personal information under s.19(1), some was not about identifiable individuals and should be disclosed. Regarding third-party information, the Commissioner determined that neither ESDC nor the third parties provided sufficient justification for withholding all information under paragraphs 20(1)(b) or 20(1)(c). The Commissioner ordered ESDC to disclose information not about identifiable individuals, re-exercise discretion regarding publicly available personal information, disclose information not meeting the requirements of paragraph 20(1)(b), and re-exercise discretion under subsection 20(5) for information related to a third party that consented to disclosure. ESDC agreed to implement the order. The complaint was found to be well founded.

• Whether information withheld under s.19(1) was truly about identifiable individuals
• Whether ESDC adequately considered if personal information was publicly available under s.19(2)(b)
• Whether ESDC adequately considered public interest in disclosure under s.19(2)(c) in relation to s.8 of the Privacy Act
• Whether information met the definition of financial, commercial, scientific or technical information under s.20(1)(b)
• Whether information was confidential by an objective standard under s.20(1)(b)
• Whether information was consistently treated as confidential by third parties under s.20(1)(b)
• Whether ESDC reasonably exercised discretion under s.20(5) when a third party consented to disclosure
• Whether ESDC reasonably exercised discretion under s.20(6) for public health or safety reasons
• Whether disclosure could reasonably be expected to have a material financial impact or injure competitive position under s.20(1)(c)
• Whether ESDC properly applied severance under s.25

The complainant alleged that Library and Archives Canada (LAC) improperly withheld information under subsections 13(1) and 15(1) of the Access to Information Act concerning submarine operations in the Arctic. LAC initially released some information but maintained that the remaining records were justifiably withheld. The Information Commissioner found that LAC failed to demonstrate that the information was obtained in confidence, as required by subsection 13(1), lacking evidence of an expectation of confidentiality. Furthermore, the Commissioner determined that LAC did not provide convincing evidence that the disclosure of the information, much of which was historical and publicly available, could reasonably be expected to harm national security or defence, as required by subsection 15(1). Consequently, the Commissioner concluded that the complaint was well founded and recommended full disclosure. However, LAC notified the Commissioner that it would not implement the recommendation.

• Whether the information was obtained in confidence from a specified government body under s.13(1) ATIA
• Whether there was a reasonable expectation of harm to national security or defence from disclosure under s.15(1) ATIA
• Whether the institution reasonably exercised its discretion under s.13(2) ATIA
• Whether the institution reasonably exercised its discretion under s.15(1) ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the National Priority Ranking Framework, the Priority Framework for Water and Wastewater Projects, and long-term First Nations Infrastructure Investment Plans, including internal correspondence, from 2014 onwards. The investigation revealed that the Offices of Primary Interest (OPIs) initially tasked with the search might not have been the most appropriate ones, and that additional OPIs likely held responsive records. ISC was unable to provide concrete details about the search parameters or sufficient documentation of their efforts. The Commissioner concluded that ISC did not conduct a reasonable search. Consequently, the Commissioner ordered ISC to conduct a new, expanded search and provide a new response to the complainant, either granting access to any additional records found or explaining why no such records were located.

• Whether Indigenous Services Canada conducted a reasonable search for records in response to the access request