Canadian Privacy Decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint that the Canada Border Services Agency (CBSA) contravened the Privacy Act by collecting and using DNA from a complainant for genetic genealogy analysis to determine his nationality for deportation purposes. The OPC found that the CBSA contravened the Act by failing to obtain valid authorization for the indirect collection of the complainant's genetic information from FamilyTreeDNA (FTDNA), by improperly disclosing his personal information to other FTDNA users, and by failing to adequately describe the collection of relatives' genetic information in its public notices (PIBs).

• Was the CBSA's collection of genetic genealogy information directly related to its operations?
• Was the authorization for indirect collection from FTDNA valid?
• Did incidental disclosures of personal information contravene the Act?
• Were the transparency obligations under Section 11 met?

The spouse of a Correctional Services Canada (CSC) employee complained that the employee's manager inappropriately collected personal information about them from their public Facebook page in relation to the employee's use of "Other leave with pay (699)". The OPC found that CSC contravened section 4 of the Privacy Act by collecting information that was not related directly to an operating program or activity of CSC. The OPC also noted that CSC's ATIP office incorrectly advised the complainant on how to raise a privacy concern.

• Whether the collection of personal information from a public Facebook page was related directly to an operating program or activity of CSC.
• Whether information collected from a public source is exempt from the collection provisions of the Privacy Act.
• Whether CSC's ATIP office provided appropriate guidance to a member of the public wishing to raise a privacy concern.

The complainant alleged that Transport Canada improperly withheld information regarding applications and Minimum Safe Manning Documents for the motor vessel Spirit of Vancouver Island, citing personal information and confidential third-party commercial/technical information exemptions. The Information Commissioner found that the personal information exemption was no longer at issue. While some information on page 50 met the criteria for the third-party emergency management plan exemption (paragraph 20(1)(b.1)), the Commissioner found that only the titles and headings of that document should be disclosed. The Commissioner also found that the third-party commercial/technical information exemption (paragraph 20(1)(b)) was not met for any of the remaining withheld information.

• Application of paragraph 20(1)(b.1) to emergency management plans
• Application of paragraph 20(1)(b) to confidential third-party information
• Whether Transport Canada properly exercised its discretion regarding disclosure
• Whether the institution met the burden of proof for the exemptions