Canadian privacy & access decisions

The complainant alleged that the Privy Council Office (PCO) failed to conduct a reasonable search for records related to IAC reports concerning the USSR and former Warsaw Pact and Yugoslavia from 1990. Initially, PCO provided only minutes, leading to the complaint. During the investigation, PCO conducted an additional search, releasing 1,352 pages, but the complainant maintained that several specific reports were still missing. The OIC was not satisfied with the initial search efforts and requested further representations from PCO. PCO subsequently identified that some of the missing reports had been previously withheld in their entirety, some were not in their holdings, and 100 additional pages covering other requested documents were located. The Commissioner found that PCO had now conducted a reasonable search and ordered PCO to process and release the newly identified records by January 22, 2026. PCO agreed to implement the order.

• Whether the institution conducted a reasonable search for records responsive to the access request

The complainant alleged that Environment and Climate Change Canada (ECCC) failed to respond to an access request within the extended timeframe, constituting a deemed refusal under subsection 10(3) of the Access to Information Act. The request sought records related to the "Cedar LNG" export facility project. The investigation found that ECCC did not respond by the required date, attributing the delay to the Offices of Primary Interest (OPIs) and the ATIP office's failure to provide and process records in a timely manner. The Commissioner found the delay unacceptable and ordered ECCC to issue interim responses for documents not requiring consultation and to provide a complete response by March 16, 2026. The Commissioner also recommended that ECCC develop processes to ensure timely record provision from OPIs and establish performance indicators for accountability. ECCC agreed to implement the orders and recommendations. The complaint was found to be well founded.

• Whether Environment and Climate Change Canada responded to the access request within the extended period under subsection 9(1) of the Access to Information Act
• Whether the delay in responding constituted a deemed refusal under subsection 10(3) of the Access to Information Act
• Whether the delays caused by Offices of Primary Interest (OPIs) in providing records were acceptable
• Whether the proposed timeline for completing the review and consultations was reasonable

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld information under several sections of the Access to Information Act related to financial statements for the leaseback of seven specific buildings. The OIC investigated claims under paragraphs 18(d), 20(1)(b), 20(1)(c), 20(1)(d), and 21(1)(b). The complainant withdrew their allegation regarding subsection 19(1) and certain banking information. The OIC found that PSPC's arguments for withholding the information were largely speculative and lacked sufficient evidence to meet the requirements of the exemptions claimed, particularly concerning the potential for material harm or interference with negotiations. The Commissioner concluded that PSPC could not demonstrate that it met all the requirements of the exemptions, especially given the public interest in transparency regarding significant public funds. The complaint was found to be well-founded, and PSPC was ordered to disclose most of the withheld information. PSPC subsequently notified the Commissioner that it would comply with the order.

• Whether s.18(d) government financial interests, undue benefit to an individual, was properly applied
• Whether disclosure under s.18(d) could materially harm government financial interests
• Whether disclosure under s.18(d) could materially harm the Government of Canada’s ability to manage the economy
• Whether disclosure under s.18(d) could result in an individual or corporation receiving an undue benefit
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information, was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential by an objective standard under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether s.20(1)(c) financial impact on a third party, was properly applied
• Whether disclosure under s.20(1)(c) could result in material financial loss or gain to the third party
• Whether disclosure under s.20(1)(c) could injure the competitive position of the third party
• Whether s.20(1)(d) negotiations by a third party, was properly applied
• Whether a third party is or will be conducting contractual or other negotiations under s.20(1)(d)
• Whether disclosure under s.20(1)(d) could interfere with those negotiations
• Whether s.21(1)(b) accounts of consultations or deliberations, was properly applied
• Whether the information is an account of consultations or deliberations under s.21(1)(b)
• Whether the information reveals the nature of deliberations under s.21(1)(b)

The complainant alleged that National Defence (DND) improperly refused to issue a new response letter after providing contextual information in its initial response to an access request. The request sought policy records, regulations, directives, orders, and instructions concerning the authority to generate Branch Standing Orders within the Canadian Armed Forces. DND's initial response stated that no responsive records were found but included additional information, such as hyperlinks to publicly available documents and an explanation using cautious language like "might," to assist the requester. The complainant argued this contextual information was speculative and not based on documented records, thus contravening DND's duty to assist under subsection 4(2.1) of the Access to Information Act. The OIC found that DND's inclusion of supplementary information, clearly distinguished from the official response, was an attempt to assist the requester in good faith and did not misrepresent the existence of records or create new ones. Therefore, DND was not obligated to issue a new response letter.

• Whether National Defence improperly refused to issue a new response letter
• Whether the inclusion of contextual information in a 'no records' response contravenes the duty to assist under subsection 4(2.1) ATIA
• Whether the contextual information was speculative and not grounded in documented records
• Whether the institution's response was complete and appropriate under subsection 10(1) ATIA

A joint investigation by the Office of the Privacy Commissioner of Canada (OPC) and provincial privacy regulators (CAI, OIPC BC, OIPC AB) examined TikTok Pte. Ltd.'s compliance with federal and provincial private sector privacy laws. The investigation focused on TikTok's collection, use, and disclosure of personal information for ad targeting and content personalization, with a particular emphasis on practices affecting children. The Offices found that TikTok's age assurance measures were inadequate, leading to the collection and use of sensitive personal information from a large number of underage users for purposes deemed inappropriate. Furthermore, TikTok failed to obtain valid and meaningful consent from both adult and youth users due to unclear, inaccessible, and incomplete privacy communications, including regarding biometric information and cross-border data transfers. The CAI specifically identified contraventions related to Quebec's transparency and privacy-by-default obligations. While TikTok disagreed with the findings, it committed to implementing enhanced age assurance mechanisms, improving privacy communications, and limiting ad targeting for under-18 users. The Offices concluded the matter as well-founded and conditionally resolved, contingent on TikTok's satisfactory implementation of these significant commitments.

• Whether TikTok was collecting, using, and disclosing personal information, particularly with respect to children, for an appropriate, reasonable, and legitimate purpose.
• Whether TikTok's age assurance mechanisms were effective in preventing underage users from accessing the platform.
• Whether TikTok obtained valid and meaningful consent from its users for tracking, profiling, targeting, and content personalization.
• Whether TikTok's privacy communications provided sufficient upfront, clear, and comprehensive information to adult users to ensure meaningful consent.
• Whether TikTok adequately explained its collection and use of users' biometric information to ensure meaningful consent.
• Whether TikTok's privacy communications were adequate to obtain meaningful consent from youth (13-17), considering their cognitive development and potential harms from targeted ads.
• Whether TikTok met its obligations under Quebec's Private Sector Act to inform persons concerned about the collection and use of personal information for user profiles, ad targeting, and content personalization.
• Whether TikTok ensured that privacy settings provided the highest level of privacy by default under Quebec's Private Sector Act.