Canadian privacy & access decisions

A former refugee complained that the Canadian Border Services Agency (CBSA) contravened his privacy rights by using commercial genetic genealogy (FamilyTreeDNA) to determine his nationality for deportation. He alleged lack of legal authority, unnecessary collection, invalid consent, deceptive practices, inadequate disclosure limitation, and insufficient Personal Information Bank (PIB) description. The Office of the Privacy Commissioner (OPC) found that while the collection was directly related to CBSA's program, the agency contravened section 5 of the Privacy Act by failing to obtain valid, informed authorization for indirect collection from FTDNA. CBSA also contravened section 8 by making incidental disclosures of the complainant's personal information to other FTDNA users, failing to monitor account settings, and not using a pseudonym. Furthermore, the CBSA's PIB descriptions were non-compliant with section 11, as they did not adequately describe the collection of genetic profiles of other FTDNA users. The OPC made several recommendations, which CBSA committed to implement for most parts, but two accounts remained open at the time of the report, leading to an ongoing, unresolved contravention. Consequently, the complaint was found well-founded in part and conditionally resolved in part.

• Whether CBSA's collection of genetic genealogy information was directly related to an operating program or activity under s.4 of the Privacy Act
• Whether CBSA collected unnecessary information under s.4 of the Privacy Act
• Whether CBSA obtained valid authorization from the complainant for the indirect collection of his personal information from FTDNA under s.5(1) of the Privacy Act
• Whether the complainant's consent for indirect collection was voluntary and not given under duress
• Whether the complainant was adequately informed about FTDNA's terms and his rights as a DNA donor for valid authorization
• Whether CBSA acted deceptively in its collection via FTDNA
• Whether the incidental indirect collection of genetic profile information of hundreds of other individuals contravened s.5(1) of the Privacy Act
• Whether CBSA's incidental disclosures of the complainant's personal information contravened s.8 of the Privacy Act
• Whether allowing potential disclosure of the complainant's personal information to other law enforcement bodies (via "law enforcement matching" opt-in) contravened s.8 of the Privacy Act
• Whether the disclosure of ancillary personal information (ethnicity) to genetic matches contravened s.8 of the Privacy Act
• Whether the disclosure of the complainant's identity to genetic matches (failure to use a pseudonym) contravened s.8 of the Privacy Act
• Whether CBSA's Personal Information Bank (PIB) descriptions complied with the transparency obligations under s.11 of the Privacy Act
• Whether the PIB adequately described the collection of biometric information for individuals subject to removal orders
• Whether the PIB adequately described the collection of genetic profiles of other FTDNA users (relatives of individuals subject to removal orders)

A complaint was filed against Correctional Service Canada (CSC) by the spouse of an employee, alleging inappropriate collection and disclosure of personal information from their public Facebook page. The information was collected by an assistant warden to investigate the employee's use of 'other leave with pay (699)' during the COVID-19 pandemic. The OPC found that significant portions of the collected information were not directly related to an operating program or activity of CSC, thus contravening Section 4 of the Privacy Act. The OPC also noted that the exclusion for publicly available information under subsection 69(2) of the Privacy Act applies only to use and disclosure, not collection. CSC subsequently deleted the collected screenshots and committed to developing guidance for managers on collecting information in a labour relations context. The complainant also raised concerns about CSC's internal complaint process, which CSC acknowledged was mishandled.

• Whether the collection of personal information from a public Facebook page was directly related to an operating program or activity of CSC under Section 4 of the Privacy Act
• Whether the exclusion for publicly available information under subsection 69(2) of the Privacy Act applies to the collection of personal information
• Whether the subsequent disclosure of the collected information was appropriate
• Whether CSC's internal process for handling privacy complaints from the public was adequate

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(b) of the Access to Information Act, related to applications and Minimum Safe Manning Documents for the motor vessel Spirit of Vancouver Island. The complaint regarding subsection 19(1) was later removed from the investigation's scope. During the investigation, Transport Canada also applied paragraph 20(1)(b.1) to one document. The Commissioner found that while portions of one document met the requirements of paragraph 20(1)(b.1), the titles and headings did not. Furthermore, neither Transport Canada nor the third party provided sufficient representations to justify withholding information under paragraph 20(1)(b), except for the titles and headings of the document also claimed under 20(1)(b.1). The Commissioner ordered Transport Canada to disclose all information withheld under paragraphs 20(1)(b) and 20(1)(b.1), with the exception of the main content of page 50, and to disclose the titles and headings on page 50. Transport Canada indicated it would "likely" comply with the order.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(b.1) third-party emergency management plans information was properly withheld
• Whether the information concerned critical infrastructure information under s.20(1)(b.1)
• Whether the information was supplied in confidence under s.20(1)(b.1)
• Whether the information was supplied for the preparation, maintenance, testing or implementation of emergency management plans under s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(5) regarding s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(6) regarding s.20(1)(b.1)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)