Canadian Privacy Decisions

The complainant alleged that National Defence (DND) failed to respond to an access request for correspondence related to a hiring process within the legislated 30-day period. The investigation found that DND did not meet the deadline, and the delay was caused by the unresponsiveness of an internal office. The Information Commissioner found the complaint well-founded and ordered DND to respond to the request within 36 business days.

• Timeliness of response to an access request
• Definition of a response
• Consequences of not responding within the prescribed time limit

The complainant alleged that Library and Archives Canada (LAC) took an unreasonably long extension of time to respond to a request for RCMP records concerning Project Anecdote. LAC claimed an extension of over 65 years, citing the large volume of records (780,000 pages) requiring digitization and review, as well as consultations. The Information Commissioner found that LAC failed to demonstrate the reasonableness of the extension, as it did not justify the calculation method, the sole reliance on one employee, or the concurrent nature of tasks. Therefore, the extension was deemed invalid and LAC was considered to have refused access.

• Reasonableness of time extension under subsection 9(1)(a) due to volume of records
• Reasonableness of time extension under subsection 9(1)(b) due to consultations
• Calculation of extension based on specific tasks and resources
• LAC's failure to demonstrate that the extension was for the shortest possible duration

An institution applied to the Information Commissioner for approval to decline processing an access request, arguing it was an abuse of the right of access. The Commissioner agreed, finding that the institution had demonstrated the request was an abuse of access rights and that declining to act was warranted. Consequently, the application was granted.

• Whether the access request constituted an abuse of the right of access.

The complainant alleged that Ingenium improperly withheld records related to an exhibit loan under several Access to Information Act provisions. During the investigation, Ingenium decided to no longer rely on some exemptions and agreed to disclose more information. The Commissioner found that photographs withheld under section 14 (federal-provincial affairs) and paragraph 68(c) (material placed by others) were not properly excluded or exempted. The Commissioner ordered Ingenium to disclose the records.

• Whether photographs were properly excluded under paragraph 68(c) of the ATIA.
• Whether photographs were properly exempted under section 14 of the ATIA (federal-provincial affairs).
• The application of the ATIA versus Quebec privacy legislation and Charter values.
• The interpretation of "material placed by others" under paragraph 68(c).

The OPC investigated a complaint that the Canada Revenue Agency (CRA) failed to ensure the accuracy of a taxpayer's personal information used for administrative decisions. An imposter used the complainant's compromised CRA My Account to fraudulently receive COVID-19 benefits and Employment Insurance. The investigation found that the CRA's inadequate safeguards allowed unauthorized access and modification, contravening section 6(2) of the Privacy Act. The CRA has since implemented corrective measures.

• Adequacy of safeguards to protect against unauthorized access and modification of personal information.
• Reasonable steps taken by the CRA to ensure the accuracy of personal information used for administrative decisions.
• Timeliness of notification and privacy breach reporting.
• Impact of identity theft on tax reassessments.

The Office of the Privacy Commissioner of Canada investigated a complaint from a federal government employee who alleged that her personal information was repeatedly disclosed to another employee with the same name, and that administrative errors occurred in their files. The OPC found that the institution contravened the Privacy Act by improperly disclosing the complainant's personal information and by failing to ensure the accuracy of information used for administrative purposes. The complaint was found to be well-founded but conditionally resolved after the institution committed to implementing corrective measures.

• Unauthorized disclosure of personal information under section 8 of the Privacy Act.
• Failure to ensure the accuracy and completeness of personal information used for administrative purposes under subsection 6(2) of the Privacy Act.
• Lack of employee awareness regarding privacy breach reporting procedures.
• Systemic nature of errors due to employees having the same name.

The OPC investigated a complaint that Brinks Home failed to implement adequate safeguards, leading to the compromise of customer personal information via its online portal. While the OPC found Brinks Home had failed to adequately protect customer information, the issue was resolved through corrective actions and the subsequent sale of customer accounts. The OPC also determined that Brinks Home was not required to report the breach to the OPC or notify affected individuals because it did not present a real risk of significant harm.

• Adequacy of safeguards for personal information
• Compliance with mandatory breach reporting requirements
• Assessment of real risk of significant harm (RROSH)
• Employee error leading to unauthorized access

The complainant alleged that the 1,000-day time extension taken by Health Canada to respond to an access request was unreasonable. The request concerned information about an application for religious exemption to serve ayahuasca. Health Canada claimed the extension was necessary due to the large volume and complexity of the records, which required extensive internal consultations. The Commissioner found that Health Canada met the requirements for claiming the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. Therefore, the complaint was determined not to be well founded.

• Reasonableness of a 1,000-day time extension claimed by Health Canada
• Whether the large volume of records unreasonably interfered with Health Canada's operations
• Whether necessary consultations could reasonably be completed within 30 days
• Whether the duration of the extension was reasonable under the circumstances

The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for records concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to certain companies and expenses. The Office of the Information Commissioner (OIC) investigated CBSA's search process and concluded that the relevant branch searched appropriate repositories and provided responsive records. Therefore, the OIC found the search to be reasonable and the complaint not well-founded.

• Whether the institution conducted a reasonable search for records.
• Definition of a reasonable search under the Access to Information Act.
• Adequacy of search efforts by the Information, Science and Technology Branch.

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld records concerning the use of Indigenous languages in the House of Commons proceedings, citing exemptions related to government and third-party negotiations. The Information Commissioner found that PSPC failed to justify withholding information under paragraph 20(1)(d) regarding third-party negotiations. While PSPC could withhold per diem rates under paragraph 18(b) related to government negotiations, it failed to reasonably exercise its discretion in doing so. The Commissioner ordered PSPC to disclose most of the withheld information and reconsider its decision on the per diem rates.

• Proper application of paragraph 18(b) (negotiations by government institutions)
• Proper application of paragraph 20(1)(d) (negotiations by a third party)
• Reasonable exercise of discretion to withhold information
• Burden of proof on the institution to justify exemptions

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonably long extension of time to respond to an access request for records related to social distancing guidance. PHAC claimed a 1,380-day extension, making the response date February 11, 2027. The OIC found that PHAC met all the requirements for the extension, concluding it was reasonable and the complaint was not well founded.

• Reasonableness of time extension claimed by PHAC under subsection 9(1) of the ATIA
• Whether PHAC met the requirements of paragraphs 9(1)(a) and 9(1)(b) of the ATIA

The complainant alleged that National Defence (DND) failed to respond to an access request regarding COVID-19 vaccination mandate accommodations within the statutory time limits. The investigation found that DND missed its extended deadline, leading to a deemed refusal of access. The Commissioner ordered DND to complete the retrieval of all responsive records and provide a response to the request. DND indicated it would comply with the order.

• Failure to respond within statutory time limits
• Deemed refusal of access due to delay
• Responsibility of offices of primary interest for record retrieval
• Undermining of the access to information system credibility

The Information Commissioner reviewed an institution's application to decline acting on an access request. The institution argued the request was an abuse of the right of access. However, the Commissioner found the institution's submissions insufficient and noted they failed to assist the requester or adequately demonstrate an abuse of access rights. Consequently, the Commissioner denied the application.

• Whether the access request constitutes an abuse of the right of access.
• Sufficiency of the institution's evidence to support its application.
• The institution's duty to assist the requester.

The complainant alleged that National Defence improperly withheld information concerning the Intelligence Advisory Committee under exemptions related to international affairs/national security (subsection 15(1)) and personal information (subsection 19(1)). While the institution disclosed some information during the investigation, the Information Commissioner found that the remaining withheld information did not meet the requirements of subsection 15(1), as the potential harm from disclosure was not apparent. The Commissioner recommended full disclosure, but National Defence disagreed and chose not to implement the recommendation.

• Whether withheld information meets the criteria for exemption under subsection 15(1) of the ATIA.
• Whether the institution demonstrated a reasonable expectation of harm from disclosing the remaining information.
• Whether the institution reasonably exercised its discretion to withhold information.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Aylo (formerly MindGeek) concerning its handling of user-uploaded intimate content. The OPC found that MindGeek failed to obtain valid consent for the collection, use, and disclosure of personal information, particularly highly sensitive intimate images. The OPC also determined that MindGeek did not provide an accessible or effective process for individuals to remove their non-consensual content from its websites. Furthermore, the investigation concluded that MindGeek lacked accountability for the personal information under its control. The complaint was found to be well-founded and remains unresolved.

• Validity of consent for collecting and using intimate images
• Effectiveness and accessibility of content takedown processes
• Accountability for personal information under control
• Jurisdiction over international operations