Canadian privacy & access decisions

The complainant alleged that Export Development Canada (EDC) improperly withheld information related to financial assistance provided to Canadian companies in Honduras. The request sought a summary of all financial assistance over $50,000 from 2009 to 2019. EDC claimed exemptions under subsections 18.1(1) (confidential financial, commercial, scientific or technical information of EDC) and 24(1) (disclosure restricted by another law) of the Access to Information Act. The Information Commissioner found that EDC failed to demonstrate that the information "belonged to" it for the purpose of s.18.1(1), as it was shared with and retained by customers. For s.24(1), EDC invoked section 24.3 of the Export Development Act, but the Commissioner determined that the information was "created" by EDC, not "obtained" by it, thus falling outside the scope of the exemption. The Commissioner ordered EDC to disclose policy types, policy numbers, and maximum liability amounts. EDC partially implemented the order, disclosing only policy types, and indicated its intention to seek a Federal Court review regarding the interpretation of the Export Development Act.

• Whether the information "belongs to" EDC for the purpose of s.18.1(1) ATIA
• Whether EDC consistently treated the information as confidential for the purpose of s.18.1(1) ATIA
• Whether the information was "obtained by" EDC or "created by" EDC for the purpose of s.24.3(1) of the Export Development Act
• Whether the information falls under s.24(1) ATIA due to s.24.3(1) of the Export Development Act

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld information related to the "Autopsy of a Murder" exhibit under several sections of the Access to Information Act. The withheld records included contracts, photographs, and inventory lists. The institution claimed exemptions under paragraphs 18(b) and 18(d) for competitive position and financial interests, subsection 19(1) for personal information, and paragraphs 20(1)(c) and 20(1)(d) for third-party financial impact and negotiations. The Commissioner found that the institution failed to provide sufficient evidence to demonstrate a reasonable expectation of harm for the exemptions under section 18 and 20. Regarding subsection 19(1), the Commissioner determined that the photographs of human remains either did not identify an individual or related to individuals deceased for over 20 years, thus not qualifying as personal information. The complaint was found to be well-founded, and the Commissioner ordered the disclosure of all information at issue.

• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.18(d) ATIA (government financial interests, undue benefit to an individual) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied to photographs of human remains
• Whether s.19(1) ATIA (personal information) was properly applied to signatures (removed from scope)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether the Coroner's office had a right to make representations as a third party under s.35(2)(c) ATIA

On November 30, 2018, Marriott International, Inc. announced a data security breach involving unauthorized access to a Starwood Hotels database, which it had acquired in 2016. The breach, spanning over four years, affected up to 12.8 million Canadian records, including passport and payment card details. The OPC launched an investigation into Luxury Hotels Canada, Marriott's Canadian operating company, following eleven complaints. The investigation found Marriott's security safeguards, accountability measures, and information retention practices to be inadequate, contravening PIPEDA Principles 4.7, 4.1.4, and 4.5. Specifically, Marriott failed to detect the breach sooner due to insufficient logging, monitoring, and multi-factor authentication, and retained personal information longer than necessary. While Marriott's notification to affected individuals was deemed adequate, the OPC had outstanding concerns regarding remote access, unencrypted data storage, and retention periods. The findings are well-founded and conditionally resolved, as Marriott committed to implementing the OPC's recommendations, including engaging an external assessor and reviewing its privacy framework.

• Whether personal information held by Marriott was protected by security safeguards appropriate to the sensitivity of the information as required by Principle 4.7 (Safeguards).
• Whether Marriott demonstrated due diligence and took steps to fulfil its responsibilities to implement policies and practices to protect personal information under Principle 4.1.4 (Accountability) when acquiring control of the Starwood network.
• Whether Marriott retained personal information for longer than necessary, relevant to Principle 4.5 (Limiting use, disclosure and retention).
• Whether the mitigation measures offered by Marriott to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with Principle 4.7 (Safeguards).

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information under paragraphs 18(b) and 19(1) of the Access to Information Act. The request sought documents detailing the total remuneration of the 250 highest-paid unionized employees of CBC's French services for two fiscal years. The CBC withheld approximately 25 exact individual salaries per fiscal year, citing paragraph 18(b) related to competitive position. The investigation found that disclosing these specific salaries could reasonably injure the CBC's competitive position in the limited and competitive French broadcasting market, as it could be used in salary negotiations and impact employee retention. The Commissioner concluded that the CBC properly applied paragraph 18(b) and reasonably exercised its discretion by balancing its mandate with the need to manage resources in a competitive market. Given the applicability of paragraph 18(b), the Commissioner did not assess the application of subsection 19(1). The complaint was therefore not well founded.

• Whether s.18(b) ATIA (competitive position) was properly applied to withhold exact individual salaries
• Whether disclosing the information could reasonably be expected to injure the competitive position of the institution
• Whether the institution reasonably exercised its discretion in deciding to withhold the information under s.18(b)
• Whether s.19(1) ATIA (personal information) was properly applied to withhold exact individual salaries

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Advanced Access to Information and Privacy consultant. ESDC had withheld portions of the records under various exemptions, including personal information (s.19(1)), third-party financial harm (s.20(1)(c)), consultations or deliberations (s.21(1)(b)), solicitor-client privilege (s.23), and statutory prohibitions (s.24(1)). The Commissioner found that ESDC improperly applied s.19(1) to certain information in a consultant's CV related to their position, function, and responsibilities, as this fell under exceptions to the definition of personal information. ESDC also failed to demonstrate reasonable efforts to seek consent for the release of other personal information. For s.20(1)(c), the Commissioner found that ESDC and third parties did not provide sufficient evidence to support the exemption for most of the withheld contract details, except for hourly rates. Regarding s.21(1)(b), ESDC failed to show that some withheld information constituted accounts of consultations or deliberations. The Commissioner upheld ESDC's application of s.23 and s.24(1). The complaint was found to be well founded, and ESDC was ordered to disclose the improperly withheld information and to make reasonable efforts to seek consent for other personal information.

• Whether s.19(1) ATIA (personal information) was properly applied to information in a consultant's CV related to position, function, and responsibilities
• Whether information related to position, function, and responsibilities falls under exceptions to the definition of personal information (Privacy Act s.3(j) and s.3(k))
• Whether ESDC made reasonable efforts to seek consent for the release of personal information under s.19(2)(a) ATIA
• Whether ESDC reasonably exercised discretion under s.19(2)(b) ATIA regarding publicly available personal information
• Whether ESDC reasonably exercised discretion under s.19(2)(c) ATIA regarding public interest in disclosure of personal information
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to hourly rates
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to names and details of candidates
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to contract details (number of hours, days per week, maximum value of amendments, reference to third-party contract)
• Whether there was a reasonable expectation of material financial loss or harm to competitive position under s.20(1)(c) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to specific pages of records
• Whether information withheld under s.21(1)(b) constituted factual information
• Whether ESDC reasonably exercised discretion under s.21(1)(b) ATIA
• Whether s.23 ATIA (solicitor-client and litigation privilege) was properly applied
• Whether ESDC reasonably exercised discretion under s.23 ATIA
• Whether s.24(1) ATIA (disclosure restricted by another law) was properly applied to supplier business numbers under s.241 of the Income Tax Act

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 16 projects related to 12 third parties under paragraph 20(1)(c) of the Access to Information Act. ISED and several third parties argued that disclosure could lead to material financial impact or harm competitive position. The Commissioner found that neither ISED nor the third parties demonstrated a clear and direct connection between the disclosure of the specific repayment figures and a reasonable expectation of harm. The Commissioner also considered, but rejected, the applicability of paragraph 20(1)(d) for one third party, finding insufficient evidence of interference with negotiations. Consequently, the Commissioner ordered ISED to disclose all the withheld "Repayments to Date" figures. ISED agreed to implement the order.

• Whether s.20(1)(c) ATIA (financial impact on a third party or harm to competitive position) was properly applied to "Repayments to Date" figures
• Whether there was a clear and direct connection between disclosure and a risk of harm well beyond the merely possible for s.20(1)(c)
• Whether s.20(1)(d) ATIA (interference with contractual or other negotiations of a third party) was properly applied to "Repayments to Date" figures
• Whether there was a clear and direct connection between disclosure and a risk of harm well beyond the merely possible for s.20(1)(d)

A federal institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act to decline to act on an access request, arguing it was vexatious and an abuse of the right of access. The request sought records related to disclosures under the Public Servants Disclosure and Protection Act, submitted by or provided to the requester. The institution contended that the request was part of a pattern of repetitive and duplicative requests for substantively the same information, much of which the requester already possessed or had provided to the institution. The Commissioner found that the institution successfully demonstrated that the request constituted an abuse of the right of access, noting the repeated requests for identical information and the requester's refusal to narrow the scope. The Commissioner also determined that the institution had fulfilled its duty to assist obligations by attempting to clarify and refine the request. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request is an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution fulfilled its duty to assist obligations under s.4(2.1) ATIA
• Whether the request is vexatious under s.6.1(1) ATIA

The Information Commissioner ceased investigation into complaint 5819-02602. The complainant had indicated a desire to pursue the matter solely as a point of principle, despite the underlying issue for which the information was sought having already been settled. The Commissioner determined that the complainant's apparent lack of interest in actually obtaining the records, coupled with the request to continue the investigation based purely on principle, rendered the complaint trivial. Consequently, the investigation was ceased under paragraph 30(4)(a) of the Access to Information Act, which permits the Commissioner to discontinue an investigation if the complaint is deemed trivial, frivolous, vexatious, or made in bad faith.

• Whether the complaint was trivial, frivolous, vexatious, or made in bad faith under paragraph 30(4)(a) of the Access to Information Act

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information related to the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations. The CRA had released a list of company names but withheld the total CEWS amounts received by each company, citing subsections 24(1), 16(1)(c), and 19(1) of the Access to Information Act. The Office of the Information Commissioner (OIC) focused its investigation on subsection 24(1), which mandates refusal of disclosure if restricted by a Schedule II provision. The OIC found that the withheld information constituted "taxpayer information" as defined by section 241 of the Income Tax Act, a Schedule II provision, because it related to identifiable taxpayers and was obtained or prepared by CRA for administering the Income Tax Act. Since subsection 24(1) was found to apply, the OIC did not assess the applicability of subsections 16(1)(c) and 19(1) to the same information. The Commissioner concluded that the information was properly withheld, and the complaint was not well founded.

• Whether the withheld information constitutes "taxpayer information" under section 241 of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts disclosure of the information under subsection 24(1) of the ATIA
• Whether subsection 24(1) ATIA was properly applied to withhold the information
• Whether paragraph 16(1)(c) ATIA applies to the information (not considered)
• Whether subsection 19(1) ATIA applies to the information (not considered)

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request by the extended due date. The request sought all documents related to the Copyright Media Clearance Program for a specific period. PSPC had extended the response deadline by 420 days, but failed to provide a response by the new due date. The OIC found that PSPC did not meet its obligation to respond within the time limits, leading to a deemed refusal of access. Despite PSPC citing resource limitations and COVID-19 related difficulties, the Commissioner concluded that these were not valid reasons for continued delay. The Commissioner ordered PSPC to provide a final response within 10 days, but PSPC indicated it would not fully implement the order, proposing a phased approach with a later completion date.

• Whether the institution responded to the access request by the extended due date under subsection 9(1) of the Access to Information Act
• Whether the institution is deemed to have refused access under subsection 10(3) of the Access to Information Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records related to its "E Norther" file and National Administrative Records Management System (NARMS). Specifically, the complainant identified the RCMP's Legal Services Unit as a potential source of records, but the RCMP initially refused to search this area, claiming the records would not be under its control. The OIC's investigation found that any such records would likely be under the RCMP's control. The RCMP subsequently agreed to task its Legal Services Unit, which led to the identification and release of additional records to the complainant. The Commissioner concluded that the RCMP's initial search was not reasonable and ordered the RCMP to confirm with an outstanding Office of Primary Interest (OPI) and process any further responsive records. The RCMP later confirmed that the outstanding OPI had responded and an additional response was sent to the complainant.

• Whether the Royal Canadian Mounted Police conducted a reasonable search for records
• Whether records held by the RCMP's Departmental Legal Services Unit were under the control of the RCMP

The complainant alleged that the Immigration and Refugee Board of Canada (IRB) failed to conduct a reasonable search for records in response to a request for "all final decisions rendered pursuant to section 37 of the Immigration and Refugee Protection Act (IRPA) from January 2018 until June 2020." The IRB provided only written decisions, stating that audio recordings are only provided when specifically requested. However, the OIC found that the IRB's ATIP office had erroneously informed its Office of Primary Interest that only written decisions were sought, thereby reducing the scope of the request without the complainant's approval. The Commissioner determined that "all final decisions" includes audio recordings, as a record under the Act means any documentary material regardless of medium or form. Consequently, the Commissioner found that the IRB did not perform a reasonable search.

• Whether the institution conducted a reasonable search for records
• Whether audio recordings fall within the scope of "all final decisions"

The complainant alleged that the Public Health Agency of Canada (PHAC) took an unreasonable extension of time to respond to an access request for all correspondence, including emails, MS Teams messages, texts, and phone messages, sent and received by Iain Stewart between June 14 and June 21, 2021. PHAC notified the complainant of a 1,950-day extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. The Commissioner found that PHAC demonstrated the request involved a large volume of records (30,000 pages) and that meeting the 30-day deadline would unreasonably interfere with its operations, particularly given its role in the COVID-19 pandemic response and increased ATIP workload. The Commissioner also found that consultations were necessary and could not be completed within 30 days. Despite the lengthy extension, the Commissioner concluded that PHAC's calculation was reasonable given the circumstances, including the complexity of the records and the institution's processing capacity. Therefore, the complaint was not well founded.

• Whether the extension of time under s.9(1)(a) was unreasonable
• Whether the request was for a large number of records or required searching through a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the extension of time under s.9(1)(a) was for a reasonable period, given the circumstances
• Whether the extension of time under s.9(1)(b) was unreasonable
• Whether the institution needed to carry out consultations on the requested records
• Whether the consultations could reasonably be completed within 30 days
• Whether the extension of time under s.9(1)(b) was for a reasonable period, given the circumstances
• Whether the time extension was validly claimed

An anonymous applicant complained that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Total Repayment figures" related to several projects under the Technology Partnerships Canada (TPC) program, involving 21 third parties. ISED initially relied on paragraph 20(1)(c) of the Access to Information Act, while some third parties also raised paragraphs 20(1)(b) and 20(1)(d). The Commissioner found that the information was financial and commercial but not objectively confidential under paragraph 20(1)(b), as there was no reasonable expectation of non-disclosure for public funds, nor would confidentiality foster public benefit. For paragraph 20(1)(c), the Commissioner determined that neither ISED nor the third parties demonstrated a clear and direct connection between disclosure and a reasonable expectation of material financial harm or injury to competitive position, deeming their arguments speculative. Similarly, for paragraph 20(1)(d), insufficient evidence was provided to show that disclosure would interfere with contractual negotiations. Consequently, the complaint was found to be well-founded, and the Commissioner ordered ISED to disclose all the Total Repayments figures at issue.

• Whether the Total Repayment figures are financial or commercial information under s.20(1)(b) ATIA
• Whether the Total Repayment figures are confidential under s.20(1)(b) ATIA
• Whether the circumstances of communication gave rise to a reasonable expectation of non-disclosure for the Total Repayment figures under s.20(1)(b) ATIA
• Whether confidential communication of the Total Repayment figures would foster the relationship between third parties and ISED for public benefit under s.20(1)(b) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to injure the competitive position of a third party under s.20(1)(c) ATIA
• Whether a clear and direct connection between disclosure and harm was demonstrated for s.20(1)(c) ATIA
• Whether arguments of public misunderstanding justify withholding information under s.20(1)(c) ATIA
• Whether disclosure of the Total Repayment figures could reasonably be expected to interfere with contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether a clear and direct connection between disclosure and interference (obstruction) was demonstrated for s.20(1)(d) ATIA

The OPC initiated a complaint against MGM Resorts International after media reports revealed a 2019 data breach affecting millions, including Canadians, for which MGM had not reported to the OPC. The investigation focused on whether MGM complied with mandatory breach reporting obligations under PIPEDA. The OPC found that MGM contravened PIPEDA by failing to promptly assess whether the breach posed a real risk of significant harm (RROSH) to affected Canadians and by not reporting the breach or notifying individuals as soon as feasible. MGM had delayed its assessment for Canadians for several months compared to its U.S. customers. In response to OPC recommendations, MGM committed to amending its privacy breach response framework to ensure timely RROSH assessments, reporting to the Commissioner, and notifying affected individuals for future breaches involving Canadians. The matter was found to be well-founded and conditionally resolved.

• Whether MGM had the obligation to report the breach to the OPC and notify affected Canadians
• Whether the MGM breach met the RROSH reporting and notification threshold
• Whether the personal information involved was sensitive
• Whether there was a high probability of misuse of the personal information
• Whether MGM notified the OPC and affected Canadians as soon as feasible