Canadian privacy & access decisions

An anonymous applicant complained that the Impact Assessment Agency of Canada (IAAC) improperly withheld information related to its 2020-2021 inspection plan under various sections of the Access to Information Act. The Information Commissioner found that IAAC failed to demonstrate the reasonable expectation of harm or that the conditions for exemption were met for information withheld under sections 14 (federal-provincial affairs), 16(1)(c) (conduct of investigations), 16(2) (facilitating an offence), 20(1)(c) (financial impact on third party), and 24(1) (restricted by other law, specifically s.30(1) of the Impact Assessment Act). Claims under sections 20(1)(b) (third-party confidential information), 21(1)(a), (b), and (c) (advice, consultations, negotiations), and 23 (solicitor-client privilege) were partially upheld, with factual or general identifying information deemed disclosable. The Commissioner also determined that IAAC failed to consider its obligation to exercise discretion regarding disclosure under sections 20(6), 21, and 23. However, information withheld under section 21(1)(d) (personnel management plans) and section 68(a) (published material) was found to be properly exempted or excluded. Consequently, the complaint was well-founded, and IAAC was ordered to disclose the improperly withheld information and re-exercise its discretion for other parts.

• Whether the information met the requirements of s.13(1) ATIA
• Whether the information met the requirements of s.14 ATIA
• Whether the information met the requirements of s.16(1)(c) ATIA
• Whether the information met the requirements of s.16(2) ATIA
• Whether the information met the requirements of s.19(1) ATIA
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether the information was objectively confidential under s.20(1)(b) ATIA (not publicly available)
• Whether the information was objectively confidential under s.20(1)(b) ATIA (reasonable expectation of non-disclosure)
• Whether the relationship was fostered for public benefit by confidential communication under s.20(1)(b) ATIA
• Whether the information was supplied by a third party under s.20(1)(b) ATIA
• Whether the information was consistently treated as confidential by the third party under s.20(1)(b) ATIA
• Whether the disclosure of information could reasonably be expected to cause material financial impact or harm competitive position under s.20(1)(c) ATIA
• Whether IAAC reasonably exercised its discretion under s.20(6) ATIA
• Whether the information constituted advice or recommendations under s.21(1)(a) ATIA
• Whether factual or general identifying information was severable from advice or recommendations under s.21(1)(a) ATIA
• Whether the information constituted accounts of consultations or deliberations under s.21(1)(b) ATIA
• Whether factual or general identifying information was severable from accounts of consultations or deliberations under s.21(1)(b) ATIA
• Whether the information constituted positions or plans developed for negotiations under s.21(1)(c) ATIA
• Whether factual or general identifying information was severable from positions or plans developed for negotiations under s.21(1)(c) ATIA
• Whether the information constituted plans related to personnel management or administration not yet in operation under s.21(1)(d) ATIA
• Whether the information was subject to solicitor-client or litigation privilege under s.23 ATIA
• Whether IAAC reasonably exercised its discretion under s.21 ATIA and s.23 ATIA
• Whether the disclosure of information was restricted by s.30(1) of the Impact Assessment Act, thereby falling under s.24(1) ATIA
• Whether the information was published or available for purchase under s.68(a) ATIA

The Office of the Privacy Commissioner of Canada (OPC) and the UK Information Commissioner (ICO) jointly investigated a data breach at 23andMe Inc., a direct-to-consumer genetic testing company, which affected almost 7 million customers globally, including 319,000 in Canada. The investigation focused on the adequacy of 23andMe's security safeguards and its breach notification practices following a credential stuffing attack. The OPC found that 23andMe failed to implement appropriate safeguards, such as mandatory multi-factor authentication, robust compromised-password checks, and effective detection systems, given the highly sensitive nature of genetic and health information. Additionally, 23andMe's breach notifications to the OPC and affected individuals were deemed inadequate in content and timing, as they initially omitted crucial details like raw DNA data compromise and the data being offered for sale. However, 23andMe subsequently implemented significant security enhancements and updated its notification processes. Consequently, the OPC concluded both issues were well-founded but resolved due to the satisfactory corrective measures taken by the company. This report also highlighted the ongoing bankruptcy proceedings of 23andMe and the Commissioners' commitment to ensuring privacy obligations are met if customer data is transferred.

• Whether 23andMe had appropriate safeguards to protect highly sensitive personal information under its control, specifically against credential stuffing attacks.
• Whether 23andMe's prevention measures, including mandatory Multi-factor Authentication (MFA), compromised-password checks, and minimum password requirements, were adequate.
• Whether 23andMe's detection measures, including detection systems, digital fingerprinting, and device history, were adequate to identify ongoing attacks.
• Whether 23andMe adequately investigated anomalies and claims of breach prior to public disclosure.
• Whether 23andMe's breach response, including the timeliness of disabling active user sessions, disabling raw DNA download features, and implementing mandatory MFA, was adequate.
• Whether 23andMe adequately notified the OPC about the breach, including the completeness of information provided and timeliness.
• Whether 23andMe adequately notified affected individuals about the breach, including the completeness of information provided and timeliness.
• Whether the data breach created a real risk of significant harm to affected individuals, triggering notification obligations.
• Whether 23andMe's methodology for identifying and notifying individuals whose raw DNA was downloaded by the Threat Actor was adequate.

The complainant alleged that Canada Post improperly withheld information under subsections 19(1), 18.1(1), and paragraph 20(1)(b) of the Access to Information Act. The request sought a health and safety strategy report and related invoicing from DuPont Sustainable (DSS). The OIC found that Canada Post failed to demonstrate that the information withheld under paragraph 20(1)(b) met the requirements for confidentiality, third-party supply, or consistent confidential treatment. Similarly, for subsection 18.1(1), Canada Post did not show that the information constituted a trade secret or confidential financial/commercial information belonging to it, or that it was consistently treated as confidential. However, the OIC upheld the application of subsection 19(1) for personal contact information. The Information Commissioner ordered Canada Post to disclose the information improperly withheld under paragraph 20(1)(b) and subsection 18.1(1). Canada Post agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) ATIA (personal information) was properly applied to contact details
• Whether the information was about an individual
• Whether there was a serious possibility of identification
• Whether the information fell under exceptions to 'personal information' in the Privacy Act
• Whether s.19(2) ATIA circumstances (consent, public availability, consistency with Privacy Act s.8) existed
• Whether Canada Post reasonably exercised its discretion under s.19(2) ATIA
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied to invoice details
• Whether the information was financial, commercial, scientific or technical
• Whether the information was objectively confidential (not publicly available)
• Whether the information was objectively confidential (reasonable expectation of confidence)
• Whether the information was objectively confidential (relationship fostered for public benefit)
• Whether the information was supplied by a third party to a government institution
• Whether the third party consistently treated the information as confidential
• Whether s.18.1(1) ATIA (trade secrets or confidential financial, commercial, scientific or technical information of Canada Post) was properly applied to invoice and presentation content
• Whether the information constituted a 'trade secret'
• Whether the information was financial, commercial, scientific or technical information belonging to Canada Post
• Whether Canada Post consistently treated the information as confidential
• Whether s.18.1(2) ATIA (general administration exclusion) applied