Canadian privacy & access decisions

An individual complained that the Canada Revenue Agency (CRA) failed to ensure the accuracy of their personal information, leading to an imposter fraudulently obtaining Canada Emergency Response Benefit (CERB) payments in their name. The imposter gained unauthorized access to the complainant's CRA My Account, changed direct deposit information, and applied for benefits. This resulted in the complainant receiving a tax reassessment for over $5,500. The OPC found that the CRA relied on inadequate safeguards against unauthorized access and modification, thus failing to take reasonable steps to ensure the accuracy of personal information used for administrative decisions under section 6(2) of the Privacy Act. The CRA has since implemented corrective measures, including enhanced authentication processes and security for high-impact modifications. The OPC found the complaint well-founded and conditionally resolved, noting the CRA's commitments to address the issues.

• Whether the CRA took all reasonable steps to ensure the accuracy of personal information used for administrative purposes under subsection 6(2) of the Privacy Act
• Whether the safeguards in place at the time of the breach were adequate to prevent unauthorized access and modification of personal information
• Whether the CRA's authentication processes were sufficient to prevent identity theft and fraudulent activity
• Whether the CRA should have contacted Employment and Social Development Canada (ESDC) sooner regarding the complainant's identity theft
• Whether the CRA provided timely notification of the privacy breach to the affected individual
• Whether the CRA fulfilled its mandatory privacy breach reporting obligations to the OPC

An employee complained that her personal information was repeatedly disclosed to another employee with the same name, and that numerous administrative errors occurred in their respective files. The OPC found that the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant's personal information, including her PRI, email, mailing address, and financial and health information. It also contravened subsection 6(2) of the Act by failing to ensure the accuracy of personal information used for administrative purposes, leading to errors in employee files. The OPC concluded that these issues were systemic due to human error and a lack of awareness among employees regarding privacy breach reporting procedures. The institution accepted the OPC's recommendations to prevent unauthorized disclosures and ensure data accuracy, leading to a conditionally resolved finding.

• Whether the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant’s personal information to another employee with the same name
• Whether the government institution contravened subsection 6(2) of the Privacy Act by failing to ensure that personal information used for administrative purposes was accurate, up-to-date, and complete
• Whether the repeated disclosures and inaccuracies constituted a systemic problem
• Whether the institution's assessment of the sensitivity of the disclosed information was appropriate

A Brinks Home customer complained that he could view other customers' personal information through his online portal. The OPC investigated whether Brinks Home had adequate security safeguards and complied with breach notification requirements. Brinks Home acknowledged an employee error caused 3,340 customer records to be accessible to 102 other customers, with up to 20 potentially accessing the data. The OPC found that Brinks Home failed to adequately protect personal information, but this issue was resolved by the company's corrective actions and subsequent sale of its Canadian customer accounts. Regarding breach notification, the OPC determined that while the information was sensitive, the probability of misuse was low because the unauthorized access was by known customers, not malicious actors. Therefore, the incident did not pose a real risk of significant harm, and Brinks Home was not required to report it or notify affected individuals.

• Whether Brinks Home implemented adequate security safeguards to protect customers' personal information under Principle 4.7 of Schedule 1 of PIPEDA
• Whether Brinks Home complied with breach notification requirements under section 10.1 of PIPEDA
• Whether the breach presented a real risk of significant harm (RROSH)
• Whether the personal information involved was sensitive
• Whether the probability of misuse of the personal information was low

The complainant alleged that Health Canada's 1,000-day extension of time to respond to an access request was unreasonable. The request sought information regarding an application for religious exemption to serve ayahuasca. Health Canada claimed the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, citing a large volume of records (over 14,000 pages) and the need for extensive consultations, particularly with its Legal Services Unit, due to the sensitive and precedent-setting nature of the subject matter. The institution argued that processing the request within a shorter timeframe would unreasonably interfere with its operations and that consultations could not be completed within 30 days. The Information Commissioner found that Health Canada met all the requirements for both paragraphs 9(1)(a) and 9(1)(b), concluding that the calculation of the extension was logical and supportable, and that the extension was reasonable. Consequently, the complaint was deemed not well founded, and the due date for the response remains December 19, 2025.

• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under s.9(1)(a)
• Whether the extension of time was for a reasonable period under s.9(1)(a)
• Whether consultations were necessary under s.9(1)(b)
• Whether consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to named companies and expenses. The Office of the Information Commissioner (OIC) investigated by reviewing CBSA's search efforts, including the program areas tasked and the search parameters. The OIC found that the Office of Primary Interest (OPI) most likely to hold relevant records, the Information, Science and Technology Branch, had searched appropriate repositories and provided 896 pages of documents for processing. Based on this, the Commissioner concluded that CBSA conducted a reasonable search. The complaint was therefore deemed not well founded.

• Whether the institution conducted a reasonable search for records

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(d), and subsection 19(1) of the Access to Information Act, related to the use of Indigenous languages in House of Commons proceedings. The OIC investigation found that the claim under subsection 19(1) was no longer pursued by the complainant. PSPC failed to demonstrate that most of the withheld information met the requirements of paragraphs 18(b) or 20(1)(d), except for per diem rates under paragraph 18(b). However, the Commissioner found that PSPC did not reasonably exercise its discretion when deciding to withhold these per diem rates, as it did not consider all relevant factors, including those favoring disclosure. The Commissioner ordered PSPC to disclose the information improperly withheld under paragraphs 18(b) and 20(1)(d) and to re-exercise its discretion regarding the per diem rates. PSPC agreed to implement the order.

• Whether the information met the requirements of s.20(1)(d) ATIA (negotiations by a third party)
• Whether disclosure of information could interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether there was a reasonable expectation of harm under s.20(1)(d) ATIA
• Whether the information met the requirements of s.18(b) ATIA (negotiations by government institutions)
• Whether disclosure of estimates for per diem fees could reasonably be expected to interfere with PSPC's negotiations under s.18(b) ATIA
• Whether disclosure of other information could reasonably be expected to interfere with negotiations under s.18(b) ATIA
• Whether PSPC reasonably exercised its discretion to decide whether to disclose per diem rates under s.18(b) ATIA
• Whether PSPC considered all relevant factors for and against disclosure when exercising discretion

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for records related to social distancing guidance. PHAC claimed a 1,380-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, setting the response due date to February 11, 2027. The OIC investigated whether PHAC met the requirements for such an extension. PHAC demonstrated that its calculation was logical and supportable, and that processing the request in a shorter timeframe would unreasonably interfere with its operations. The OIC concluded that PHAC had met all the requirements of the Act for the extension. Consequently, the complaint was found to be not well founded, and the extension was deemed reasonable.

• Whether the 1,380-day extension of time claimed by PHAC under s.9(1)(a) and s.9(1)(b) was reasonable
• Whether PHAC's calculation of the time extension was sufficiently logical and supportable
• Whether providing access within a materially lesser period would unreasonably interfere with PHAC's operations
• Whether consultations could reasonably be completed within 30 days

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory time limits, as required by section 7 of the Access to Information Act. The request sought the total number of accommodation and exemption requests related to the CAF COVID-19 vaccination mandate, including approvals, denials, and those under review. DND received the request and extended the response period by 60 days under paragraph 9(1)(a), setting a new deadline of May 15, 2023. However, DND did not respond by this extended date, leading to a deemed refusal under subsection 10(3). The investigation revealed that delays were caused by a lack of responsiveness from two Offices of Primary Interest (OPIs) within DND, preventing the access to information unit from processing the request. The Commissioner found the delay unacceptable and ordered DND to complete record retrieval and provide a full response within 36 business days. DND subsequently agreed to implement the order.

• Whether National Defence responded to the access request within the statutory time limits
• Whether National Defence is deemed to have refused access under subsection 10(3) ATIA
• Whether the delay in responding was due to internal OPI unresponsiveness

A federal institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act, seeking approval to decline to act on an access request. The institution argued that the request constituted an abuse of the right of access. However, the Commissioner found that the institution's submissions and evidence were insufficient to demonstrate that the access request met the criteria for abuse of right. The Commissioner noted that the institution appeared to confuse the issue of whether records were under its control with the question of abuse of right, and also failed to demonstrate any attempt to assist the requester. Consequently, the Commissioner decided that the application did not merit further consideration and denied the institution's request.

• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution provided sufficient evidence to support its s.6.1 application
• Whether the institution attempted to assist the requester

The complainant alleged that National Defence (DND) improperly withheld information under subsections 15(1) and 19(1) of the Access to Information Act, concerning historical records of the Intelligence Advisory Committee. During the investigation, DND issued two supplementary responses, disclosing additional information, and the complainant narrowed the complaint to specific pages withheld under subsection 15(1). DND proposed a third supplementary response, agreeing to disclose more information but maintaining some redactions under subsection 15(1). The Information Commissioner concluded that the remaining withheld information did not meet the requirements of subsection 15(1), particularly regarding the absence of apparent harm from disclosure. The Commissioner recommended DND disclose all remaining information withheld under subsection 15(1). However, DND notified the Commissioner that it would not implement this recommendation. Consequently, the complaint was found to be well-founded.

• Whether information was properly withheld under s.15(1) ATIA (international affairs and national security)
• Whether information was properly withheld under s.19(1) ATIA (personal information)
• Whether disclosure of the remaining information could reasonably be expected to harm international affairs, defence, or national security
• Whether DND provided sufficient evidence of harm to justify the s.15(1) exemption
• Whether DND reasonably exercised its discretion to withhold the information

The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.

• Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
• Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
• Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
• Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
• Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
• Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
• Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.

A representative, on behalf of a deceased member's estate executor, requested personal information from the Department of National Defence (DND) related to an investigation into allegations against the deceased. DND processed the request informally and disclosed some information under subparagraph 8(2)(m)(i) of the Privacy Act, but did not explicitly state its refusal to process the request formally under paragraph 10(b) of the Privacy Regulations. The OPC investigated whether the representative was entitled to make the request for the purpose of administering the estate. The OPC found that while the representative was authorized to administer the estate, they did not sufficiently demonstrate a connection between the requested information and the administration of the estate. Therefore, the complaint was not well-founded, as the representative failed to meet the requirements of paragraph 10(b) of the Regulations.

• Whether the representative was authorized to make a request on behalf of the deceased under paragraph 10(b) of the Regulations
• Whether the request related only to the administration of the deceased's estate under paragraph 10(b) of the Regulations
• Whether DND complied with section 16 of the Privacy Act regarding refusal notifications
• Whether DND properly processed the request informally without explicit written consent and notification of rights

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records in response to an access request for Canada's School Narratives and supporting documents related to the Independent Assessment Process. CIRNAC officials acknowledged the existence of responsive records but refused to process them, citing confidentiality, the extensive time required (12 months), and existing priorities. They also expressed concerns about potential privacy violations and breaches of undertakings if the records were processed. The Information Commissioner found CIRNAC's refusal to process the records unacceptable, concluding that the institution denied the complainant's right of access. The Commissioner ordered CIRNAC to retrieve all responsive records, process them, and provide a complete response to the request within 60 business days. CIRNAC subsequently agreed to implement the order.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records
• Whether the institution's refusal to process identified records constitutes a denial of the right of access

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to a selection process for a Steward/Command Master Sailor to the Commander of the Royal Canadian Navy. Initially, DND tasked two program areas, which reported no relevant records. The OIC, based on complainant representations, requested DND re-task these areas with specific keywords and task five named individuals. DND's subsequent search was incomplete, failing to task all individuals and use the correct date range, though it did yield seven pages of emails. Despite DND's claims of having provided all records, the OIC found that more records existed and DND had not provided a supplementary disclosure. The Commissioner concluded that DND had not conducted a reasonable search and ordered it to complete the retrieval of all responsive records, including tasking specified individuals, and to provide a new response within 36 business days.

• Whether National Defence conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest were tasked
• Whether taskings included all pertinent keywords
• Whether all specified individuals were tasked
• Whether the correct date range was used in searches

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit. Specifically, the request sought information on a "detailed review" of service delivery, proposals for community mental wellness projects, and a "risk-based review" for financial controls, all referenced in an ISC briefing note. ISC initially claimed the "detailed review" was verbal and found no records for parts 2 and 3 of the request. The Office of the Information Commissioner (OIC) found this response unreasonable, noting that the reference in an official briefing note implied the existence of responsive documentation. Following the OIC's intervention, ISC conducted additional searches, which yielded at least 170 pages of previously unlocated documents. The Commissioner concluded that ISC had not conducted a reasonable search and ordered the institution to complete the retrieval and processing of all responsive records and issue a new response to the complainant. ISC agreed to implement the order.

• Whether Indigenous Services Canada conducted a reasonable search for records related to the "detailed review" of Non-Insured Health Benefits Mental Health Counselling benefit service delivery
• Whether Indigenous Services Canada conducted a reasonable search for records related to proposals to fund community mental wellness projects outside of Benefits Program authorities
• Whether Indigenous Services Canada conducted a reasonable search for records related to the "risk-based review to improve financial controls and management practices across all regions" for the mental health benefit