Canadian Privacy Decisions

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly withheld financial statements for the leaseback of seven buildings, citing exemptions related to government financial interests, personal information, third-party commercial information, and consultations. PSPC failed to demonstrate that the exemptions applied, particularly given the public funds involved. The Information Commissioner ordered PSPC to disclose the information, and the institution indicated it would comply. The complaint was found to be well founded.

• Application of exemptions under paragraphs 18(d), 20(1)(b), 20(1)(c), 20(1)(d), and 21(1)(b) of the ATIA.
• Burden of proof on the institution to justify withholding information, especially concerning public funds.
• Adequacy of representations to demonstrate material harm, financial impact, or interference with negotiations.
• Confidentiality requirements for third-party information under paragraph 20(1)(b).

The complainant alleged that the Department of National Defence (DND) improperly refused to issue a new response letter for a request concerning authority to generate Branch Standing Orders. DND stated that no records were found after a thorough search and included additional contextual information and hyperlinks to publicly available documents. The complainant argued this contextual information was speculative and breached DND's duty to assist. The Information Commissioner of Canada (OIC) found that DND's response was complete and appropriate, and the supplementary information was provided in good faith to assist the requester without misrepresenting the search results or creating new records.

• Whether DND improperly refused to issue a new response letter.
• Whether DND's inclusion of contextual information breached its duty to assist requesters.
• Whether DND's response accurately and completely addressed the access request.

This joint investigation by Canadian privacy authorities found that TikTok's collection and use of personal information, particularly from children, for ad targeting and content personalization was inappropriate and lacked valid consent. TikTok failed to implement adequate age verification measures, leading to the collection of data from underage users without a legitimate purpose. The investigation also found that TikTok's privacy communications were unclear, not easily accessible, and not available in French, failing to provide meaningful consent from adult and youth users for its data practices.

• Appropriate purpose for collecting and using children's personal information.
• Obtaining valid and meaningful consent for tracking, profiling, and targeted advertising.
• Transparency obligations regarding collection and use of personal information for user profiling.
• Adequacy of age assurance measures to prevent underage users from accessing the platform.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records concerning allegations of political interference with the Attorney General's functions related to the SNC-Lavalin prosecution. The investigation found that the RCMP did not adequately search records within the requested timeframe and improperly deemed a large police reporting file irrelevant. The Information Commissioner ordered the RCMP to conduct a new search and process the previously excluded file.

• Reasonableness of the search conducted by the RCMP.
• Timeliness of the search conducted by the RCMP.
• Relevance of the Police Reporting and Occurrence System (PROS) file.

The complainant alleged that the Department of National Defence (DND) failed to respond to an access request within the 30-day period required by the Access to Information Act. The request was for a specific document dated November 8, 2018. The investigation found that DND did not respond by the deadline and was therefore deemed to have refused access. The delay was caused by a subordinate office (CFINTCOM) taking an unacceptably long time to retrieve the requested records. The Information Commissioner ordered DND to provide a complete response within 36 business days.

• Failure to respond within the 30-day time limit
• DND deemed to have refused access under subsection 10(3)
• Unacceptable delay in record retrieval by subordinate office
• Order for complete response within 36 business days

The complainant alleged that National Defence (DND) failed to respond to an access request for a specific report and associated documents within the mandatory 30-day timeframe. The investigation found that DND did not provide a response by the deadline, and a delay by an internal Office of Primary Interest (OPI) in retrieving records was deemed unacceptable. The Information Commissioner found the complaint well-founded and ordered DND to provide a complete response within 36 business days.

• Timeliness of response to an access request
• Failure to meet the 30-day response deadline
• Unacceptable delay in record retrieval by an OPI

The complainant alleged that Transport Canada did not conduct a reasonable search for records concerning Class D operation with a single engine helicopter, requested between Transport Canada and the RCMP. Transport Canada initially provided only two pages but later, during the investigation, found approximately 690 additional pages. The Commissioner found the complaint well-founded, ordering Transport Canada to process these additional records and respond to the complainant within 60 business days.

• Reasonableness of the search conducted by Transport Canada
• Proper processing of additional responsive records
• Timeliness of response after additional records were found