Canadian privacy & access decisions

A federal institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act, seeking approval to decline to act on an access request. The institution argued that the request constituted an abuse of the right of access. The Information Commissioner reviewed the institution's submission and found that the institution successfully demonstrated that the access request was indeed an abuse of the right of access. Consequently, the Commissioner determined that the circumstances justified granting the institution's application. The Commissioner approved the institution's request to decline to act on the access request.

• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA
• Whether the circumstances warranted approval for the institution to decline to act on the request

The complainant alleged that Library and Archives Canada (LAC) took an unreasonable extension of time to respond to an access request for Royal Canadian Mounted Police (RCMP) records related to 'Project Anecdote'. LAC extended the time by 23,725 days (approximately 65 years), citing the need to digitize 780,000 pages of records and conduct consultations. The Commissioner found that LAC did not adequately demonstrate why the processing would be limited to a single employee, why tasks were calculated consecutively rather than concurrently, or why the extension period was reasonable. Furthermore, LAC could not specify the exact number of records requiring consultation, making the consultation extension unreasonable. Consequently, the Commissioner found the extension invalid, deeming LAC to have refused access to the records. The complaint was well founded, and LAC was ordered to respond forthwith and provide regular updates and interim releases.

• Whether the extension of time under s.9(1)(a) ATIA for volume of records was for a reasonable period
• Whether the extension of time under s.9(1)(b) ATIA for consultations was for a reasonable period
• Whether the institution's calculation of processing time based on a single employee was reasonable
• Whether the institution's calculation of processing time based on consecutive tasks was reasonable
• Whether the institution adequately justified the length of the extension claimed

The complainant alleged that Ingenium improperly withheld information related to the loan of objects for the exhibit "Autopsy of a Murder" under various sections of the Access to Information Act. Initially, Ingenium claimed exemptions under sections 14, 16(1)(c), 18(b), 18(d), and 19(1). During the investigation, Ingenium decided to no longer rely on sections 16(1)(c), 18(b), 18(d), and 19(1) (for signatures), and disclosed some information. Ingenium then invoked paragraph 68(c) concurrently with section 14 to withhold photographs. The Commissioner found that the photographs were not excluded under paragraph 68(c) as they were operational records, not the artifacts themselves. Furthermore, Ingenium failed to demonstrate that the disclosure of the photographs would cause a reasonable expectation of harm to federal-provincial affairs under section 14. The Commissioner also considered, but ultimately dismissed, arguments related to Quebec's privacy legislation and the Charter of Human Rights and Freedoms, noting that Charter rights do not apply to the deceased and the photographs were not objectively offensive. The complaint was found to be well-founded, and Ingenium was ordered to disclose the records.

• Whether s.14 ATIA (federal-provincial affairs) was properly applied to withhold photographs
• Whether s.16(1)(c) ATIA (conduct of investigations) was properly applied to withhold information
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) was properly applied to withhold information
• Whether s.18(d) ATIA (government financial interests) was properly applied to withhold information
• Whether s.19(1) ATIA (personal information) was properly applied to withhold signatures
• Whether s.68(c) ATIA (material placed by others in certain institutions) excluded photographs from the Act
• Whether the photographs constituted 'material placed by others' under s.68(c)
• Whether disclosure of the photographs could reasonably be expected to harm the conduct of federal-provincial affairs under s.14
• Whether Quebec's privacy legislation or the Charter of Human Rights and Freedoms justified withholding the information under the ATIA

An individual complained that the Canada Revenue Agency (CRA) failed to ensure the accuracy of their personal information, leading to an imposter fraudulently obtaining Canada Emergency Response Benefit (CERB) payments in their name. The imposter gained unauthorized access to the complainant's CRA My Account, changed direct deposit information, and applied for benefits. This resulted in the complainant receiving a tax reassessment for over $5,500. The OPC found that the CRA relied on inadequate safeguards against unauthorized access and modification, thus failing to take reasonable steps to ensure the accuracy of personal information used for administrative decisions under section 6(2) of the Privacy Act. The CRA has since implemented corrective measures, including enhanced authentication processes and security for high-impact modifications. The OPC found the complaint well-founded and conditionally resolved, noting the CRA's commitments to address the issues.

• Whether the CRA took all reasonable steps to ensure the accuracy of personal information used for administrative purposes under subsection 6(2) of the Privacy Act
• Whether the safeguards in place at the time of the breach were adequate to prevent unauthorized access and modification of personal information
• Whether the CRA's authentication processes were sufficient to prevent identity theft and fraudulent activity
• Whether the CRA should have contacted Employment and Social Development Canada (ESDC) sooner regarding the complainant's identity theft
• Whether the CRA provided timely notification of the privacy breach to the affected individual
• Whether the CRA fulfilled its mandatory privacy breach reporting obligations to the OPC

A Brinks Home customer complained that he could view other customers' personal information through his online portal. The OPC investigated whether Brinks Home had adequate security safeguards and complied with breach notification requirements. Brinks Home acknowledged an employee error caused 3,340 customer records to be accessible to 102 other customers, with up to 20 potentially accessing the data. The OPC found that Brinks Home failed to adequately protect personal information, but this issue was resolved by the company's corrective actions and subsequent sale of its Canadian customer accounts. Regarding breach notification, the OPC determined that while the information was sensitive, the probability of misuse was low because the unauthorized access was by known customers, not malicious actors. Therefore, the incident did not pose a real risk of significant harm, and Brinks Home was not required to report it or notify affected individuals.

• Whether Brinks Home implemented adequate security safeguards to protect customers' personal information under Principle 4.7 of Schedule 1 of PIPEDA
• Whether Brinks Home complied with breach notification requirements under section 10.1 of PIPEDA
• Whether the breach presented a real risk of significant harm (RROSH)
• Whether the personal information involved was sensitive
• Whether the probability of misuse of the personal information was low

An employee complained that her personal information was repeatedly disclosed to another employee with the same name, and that numerous administrative errors occurred in their respective files. The OPC found that the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant's personal information, including her PRI, email, mailing address, and financial and health information. It also contravened subsection 6(2) of the Act by failing to ensure the accuracy of personal information used for administrative purposes, leading to errors in employee files. The OPC concluded that these issues were systemic due to human error and a lack of awareness among employees regarding privacy breach reporting procedures. The institution accepted the OPC's recommendations to prevent unauthorized disclosures and ensure data accuracy, leading to a conditionally resolved finding.

• Whether the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant’s personal information to another employee with the same name
• Whether the government institution contravened subsection 6(2) of the Privacy Act by failing to ensure that personal information used for administrative purposes was accurate, up-to-date, and complete
• Whether the repeated disclosures and inaccuracies constituted a systemic problem
• Whether the institution's assessment of the sensitivity of the disclosed information was appropriate

The complainant alleged that Health Canada's 1,000-day extension of time to respond to an access request was unreasonable. The request sought information regarding an application for religious exemption to serve ayahuasca. Health Canada claimed the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, citing a large volume of records (over 14,000 pages) and the need for extensive consultations, particularly with its Legal Services Unit, due to the sensitive and precedent-setting nature of the subject matter. The institution argued that processing the request within a shorter timeframe would unreasonably interfere with its operations and that consultations could not be completed within 30 days. The Information Commissioner found that Health Canada met all the requirements for both paragraphs 9(1)(a) and 9(1)(b), concluding that the calculation of the extension was logical and supportable, and that the extension was reasonable. Consequently, the complaint was deemed not well founded, and the due date for the response remains December 19, 2025.

• Whether the access request was for a large number of records under s.9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under s.9(1)(a)
• Whether the extension of time was for a reasonable period under s.9(1)(a)
• Whether consultations were necessary under s.9(1)(b)
• Whether consultations could reasonably be completed within 30 days under s.9(1)(b)
• Whether the extension of time was for a reasonable period under s.9(1)(b)

The complainant alleged that the Canada Border Services Agency (CBSA) failed to conduct a reasonable search for records in response to an access request concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to named companies and expenses. The Office of the Information Commissioner (OIC) investigated by reviewing CBSA's search efforts, including the program areas tasked and the search parameters. The OIC found that the Office of Primary Interest (OPI) most likely to hold relevant records, the Information, Science and Technology Branch, had searched appropriate repositories and provided 896 pages of documents for processing. Based on this, the Commissioner concluded that CBSA conducted a reasonable search. The complaint was therefore deemed not well founded.

• Whether the institution conducted a reasonable search for records