Canadian Privacy Decisions

The Department of National Defence (DND) disclosed the identity of a workplace violence (WPV) complainant and the investigation report to a second investigator, who was conducting a separate administrative investigation into the complainant's conduct. The OPC found that while disclosing the report to labour relations was a consistent use, disclosing it to the second investigator was not, as it was not a reasonably expected use of the information given the confidentiality assurances provided to the complainant. This disclosure was therefore found to be a contravention of the Privacy Act.

• Was the disclosure of the WPV complainant's identity and report to a second investigator a 'consistent use' under paragraph 8(2)(a) of the Privacy Act?
• Did DND's consent form clearly communicate potential uses and disclosures of the complainant's identity?
• Did the disclosure align with the reasonable expectations of the complainant regarding confidentiality?
• What corrective actions are necessary to ensure future compliance with privacy principles in WPV investigations?

The complainant alleged that Shared Services Canada (SSC) wrongfully refused to process an access request for records related to informal official language complaints. SSC argued that the request, even after narrowing its scope, did not meet the requirements of section 6 of the Access to Information Act because it would require tasking too many employees and would impose an unreasonable administrative burden. The Information Commissioner disagreed, finding the request sufficiently detailed and ordering SSC to process it.

• Whether the access request provided sufficient detail to enable an experienced employee to identify records with reasonable effort.
• Whether administrative burden on an institution is a valid reason to refuse processing a request.
• Whether the scope of the request necessitated tasking all employees of the department.
• Whether section 6.1 of the Act was the appropriate process to address claims of vexatious requests.

Biron Health Group sent promotional emails to travellers who had undergone COVID-19 testing upon arrival in Canada, using their email addresses collected for testing purposes. The complainant alleged this violated PIPEDA. Biron argued they assumed implicit consent due to a business relationship, but the OPC found this assumption unreasonable given the mandatory nature of the testing. Biron has since ceased the practice, deleted affected email addresses, and the complaint was settled.

• Use of personal information for secondary marketing purposes without consent
• Reasonableness of assuming implicit consent in a mandatory service context
• Nature of consent required for collecting and using health-related information

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to provide records regarding a specific contract. PSPC stated they could not identify relevant records, claiming they were not in their possession. The Information Commissioner found that while the records (a subcontract and related documents) were not in PSPC's physical possession, they were under PSPC's control for the purposes of the Access to Information Act. Therefore, PSPC should have retrieved and processed these records.

• Whether records held by a third-party contractor are under the control of a federal institution.
• Whether the institution conducted a reasonable search for the requested records.
• The interpretation of the 'under the control' clause in the Access to Information Act.

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld job creation estimates under paragraph 20(1)(c) of the Access to Information Act. The scope was narrowed to 11 third parties. Only one third party, Toyota, provided representations to support the exemption. The Information Commissioner found that neither ISED nor Toyota sufficiently demonstrated that disclosure would cause material financial harm or prejudice competitive position. The Commissioner recommended disclosure of all information, but ISED stated it would continue to withhold certain information related to Toyota.

• Application of paragraph 20(1)(c) (financial impact on a third party)
• Sufficiency of representations from third parties
• Reasonable expectation of harm
• Necessity of an explanatory note

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld records related to $103 million in funding from the National Trade Corridors Fund. The VFPA cited exemptions related to government interests, negotiations, and confidential third-party information. The Information Commissioner found that the VFPA failed to demonstrate that all withheld information met the requirements for exemptions under paragraphs 18(b) and 18(d). Furthermore, the VFPA and the third party, Canadian National Railway, did not demonstrate that the exemptions under paragraphs 20(1)(b) and 20(1)(d) were met. The Commissioner ordered the disclosure of all information withheld under paragraphs 20(1)(b) and 20(1)(d), and specific information withheld under paragraphs 18(b) and 18(d). The VFPA agreed to implement the order.

• Whether the Vancouver Fraser Port Authority properly applied exemptions under paragraphs 18(b), 18(d), 20(1)(b), and 20(1)(d) of the Access to Information Act.
• Whether the Vancouver Fraser Port Authority discharged its burden to demonstrate that the withheld information met the requirements of the cited exemptions.
• Whether the third party, Canadian National Railway, met the requirements for the application of exemptions under paragraphs 20(1)(b) and 20(1)(d).
• Whether the Vancouver Fraser Port Authority reasonably exercised its discretion in withholding information.

The complainant alleged that the Department of Justice Canada (Justice) took an unreasonable 2,280 days to respond to an access request. Justice claimed an extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act due to the large volume and complexity of records and the need for consultations. The Information Commissioner found that while the volume of records and the need for consultations were valid reasons for an extension, Justice failed to sufficiently justify the length of the extension claimed under paragraph 9(1)(a). Therefore, the complaint was found to be well-founded, and the Commissioner ordered Justice to provide a final response forthwith.

• Reasonableness of time extension claimed due to volume of records (s. 9(1)(a) ATIA)
• Reasonableness of time extension claimed for consultations (s. 9(1)(b) ATIA)
• Justification for the duration of specific processing steps
• Failure to demonstrate the reasonableness of the claimed extension period

The Information Commissioner initiated a systemic investigation into Library and Archives Canada's (LAC) delayed responses to access requests. The investigation found that nearly 80% of requests completed by LAC during the period under review did not meet legislative deadlines. The Commissioner made ten recommendations to the Minister of Canadian Heritage to address the systemic issues causing these delays, which include problems with inter-institutional consultations, lack of a declassification framework, insufficient infrastructure for processing classified records, and inadequate ATIP resources.

• LAC's failure to respond to access requests within legislative timeframes.
• Excessive delays caused by inter-institutional consultations.
• Lack of infrastructure and processes for handling classified records.
• Insufficient resources and funding for LAC's Access to Information and Privacy (ATIP) office.

The complainant alleged that Parks Canada improperly withheld portions of a draft feasibility study. Parks Canada initially cited exemptions related to personal information, financial impact on third parties, and negotiations by a third party. During the investigation, Parks Canada shifted its reliance to the exemption for confidential third-party financial, commercial, scientific, or technical information. The Information Commissioner found that neither Parks Canada nor the third party (Liricon Capital Ltd.) demonstrated that the withheld information met the requirements of the exemption. Therefore, the Commissioner ordered Parks Canada to disclose specific portions of the study.

• Whether information in a draft feasibility study was properly withheld under exemptions related to personal information, financial impact, negotiations, or confidential third-party information.
• Whether the institution and third party met the burden of proof to justify withholding information under paragraph 20(1)(b) of the Access to Information Act.
• Whether certain withheld information was already publicly available or disclosed elsewhere in the record, thus failing the confidentiality requirement of paragraph 20(1)(b).

The Office of the Privacy Commissioner of Canada investigated a complaint that Rogers Communications Inc. improperly enrolled a customer in its voiceprint authentication program, Voice ID, without her consent. The OPC found that while the purpose of the program was appropriate, Rogers failed to obtain valid and meaningful consent for the collection and use of voiceprints, which are considered sensitive biometric information. Rogers also did not provide a clear opt-out mechanism and improperly retained voiceprints. Rogers committed to significant changes to its program, leading the OPC to find the consent and retention issues well-founded and conditionally resolved.

• Appropriate purpose for collecting voiceprints
• Obtaining valid and meaningful consent for voiceprints
• Adequacy of opt-out mechanisms
• Retention of voiceprints after opt-out

The complainant alleged that Trans Mountain Corporation (TMC) improperly withheld information related to Board of Directors meetings, citing exemptions under sections 21 and 26 of the Access to Information Act. TMC later claimed a total of 15 exemptions and failed to provide sufficient justification or detail for withholding the information. The Commissioner found TMC's application of exemptions was incorrect and disclosure was warranted. However, after the Commissioner issued an intended order, TMC released additional information, satisfying the complainant, and rendering a formal order unnecessary.

• Adequacy of justification for claimed exemptions
• Reasonable exercise of discretion
• Application of severability principle
• Failure to identify specific withheld information and third parties

The complainant alleged that the Department of Finance Canada failed to respond to a request for information about a backgrounder document within the time limits set out in the Access to Information Act. The Commissioner found that significant delays were caused by an internal branch failing to provide records to the ATIP office in a timely manner. The Commissioner ordered the Minister of Finance to provide a response forthwith, noting that the ongoing delay was unacceptable.

• Failure to respond within statutory time limits
• Internal delays in record retrieval and processing
• Application of subsection 10(3) (deemed refusal)

The complainant filed four complaints alleging the Royal Canadian Mounted Police (RCMP) failed to respond to access requests within the 30-day time limit. The OIC found that the RCMP did not provide adequate justification for the significant delays, despite acknowledging operational challenges due to the COVID-19 pandemic. The Information Commissioner ordered the Minister of Public Safety and Emergency Preparedness to issue a response to each request.

• Failure to respond within the 30-day time limit under section 7 of the ATIA
• Adequacy of justification for delays due to COVID-19 operational challenges
• Requirement for institutions to respond even when records are not yet retrieved

The complainant filed a complaint under the Access to Information Act (ATIA) concerning an institution's response to their request. The institution argued the complaint was filed outside the 60-day time limit stipulated by section 31 of the ATIA. The complainant acknowledged the delay but requested the Information Commissioner extend the deadline due to the institution's undated covering letter and the misplacement of the response. The Commissioner rejected the complaint, stating she lacks the authority to extend statutory timeframes.

• Timeliness of complaint submission
• Commissioner's discretion to extend statutory time limits
• Interpretation of section 31 of the ATIA

The complainant alleged that Public Services and Procurement Canada (PSPC) obstructed their right of access by unduly delaying the processing of a request for COVID-19 pandemic contracts. The investigation found significant failures in PSPC's processing, including grouping requests incorrectly and poor record management by the office of primary interest, leading to a year-long delay. While the delay was found to be a failure to provide timely access, there was insufficient evidence to support the allegation of intent to conceal records.

• Timeliness of access request processing
• Obligation to assist requesters
• Allegations of obstruction and concealment of records
• Proper handling of access requests by offices of primary interest