Canadian Privacy Decisions

The complainant alleged that National Defence improperly withheld information concerning the Intelligence Advisory Committee under exemptions related to international affairs/national security (subsection 15(1)) and personal information (subsection 19(1)). While the institution disclosed some information during the investigation, the Information Commissioner found that the remaining withheld information did not meet the requirements of subsection 15(1), as the potential harm from disclosure was not apparent. The Commissioner recommended full disclosure, but National Defence disagreed and chose not to implement the recommendation.

• Whether withheld information meets the criteria for exemption under subsection 15(1) of the ATIA.
• Whether the institution demonstrated a reasonable expectation of harm from disclosing the remaining information.
• Whether the institution reasonably exercised its discretion to withhold information.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Aylo (formerly MindGeek) concerning its handling of user-uploaded intimate content. The OPC found that MindGeek failed to obtain valid consent for the collection, use, and disclosure of personal information, particularly highly sensitive intimate images. The OPC also determined that MindGeek did not provide an accessible or effective process for individuals to remove their non-consensual content from its websites. Furthermore, the investigation concluded that MindGeek lacked accountability for the personal information under its control. The complaint was found to be well-founded and remains unresolved.

• Validity of consent for collecting and using intimate images
• Effectiveness and accessibility of content takedown processes
• Accountability for personal information under control
• Jurisdiction over international operations

A representative acting for the executor of an estate requested personal information about a deceased individual from the Department of National Defence (DND). DND determined the representative was not entitled to the information under paragraph 10(b) of the Privacy Regulations because they did not sufficiently demonstrate a connection between the information sought and the administration of the estate. While DND processed the request informally and disclosed some information under another provision of the Act, they did not clearly state the grounds for refusal. The OPC found the complaint not well-founded as the representative failed to adequately articulate and substantiate the estate's purposes and how the records would serve them.

• Whether the representative was authorized to make a request on behalf of the deceased under paragraph 10(b) of the Privacy Regulations for the purpose of administering the estate.
• Whether the representative sufficiently demonstrated a connection between the information sought and the administration of the deceased's estate.
• Whether DND properly notified the representative of the refusal and the basis for it.
• Whether DND properly handled the request informally.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for "School Narratives" and supporting documents. CIRNAC officials identified that records existed but refused to process them, citing confidentiality and a lengthy processing time. The Information Commissioner found the complaint well-founded, ordering CIRNAC to retrieve and process all responsive records and provide a new response to the request.

• Reasonableness of the search conducted by the institution
• Institution's refusal to process identified records
• Complainant's right of access to records under the control of a government institution

This special report details an investigation into cyber attacks that compromised sensitive personal information held by the Canada Revenue Agency (CRA) and Employment and Social Development Canada (ESDC). Attackers used stolen credentials to access online accounts, leading to unauthorized disclosures, modifications, and identity theft. The investigation found that both departments failed to implement adequate authentication, security decision-making, and monitoring practices, contravening sections 8 and 6(2) of the Privacy Act. While both departments accepted recommendations for improvement, some weaknesses persist.

• Inadequate identity and credential assurance measures
• Insufficiently informed and accountable security decision-making
• Lack of effective monitoring and timely breach containment
• Contravention of Privacy Act sections 8 (disclosure) and 6(2) (accuracy)

This special report from the OPC investigated the RCMP's Project Wide Awake initiative, which uses third-party services to collect open-source information. The investigation found that the RCMP did not conduct adequate due diligence to ensure that the personal information collected via the Babel X service and its data providers was compliant with Canadian privacy laws. Additionally, the RCMP failed to meet its transparency obligations under the Privacy Act by providing inadequate descriptions of its open-source information collection practices and purposes in its Personal Information Banks.

• Compliance with collection provisions of the Privacy Act
• Adequacy of due diligence regarding third-party data collection practices
• Adequacy of transparency obligations under the Privacy Act
• Sufficiency of Personal Information Bank descriptions

The complainant alleged that National Defence failed to conduct a reasonable search for records related to a selection process for Steward/Command Master Sailor. The Office of the Information Commissioner (OIC) investigation found that not all relevant offices were tasked and the search criteria were unclear. National Defence was ordered to complete the retrieval of all responsive records and provide a new response to the access request.

• Reasonable search
• Completeness of search
• Clarity of tasking for record retrieval