Canadian privacy & access decisions

A federal institution applied to the Information Commissioner under subsection 6.1(1) of the Access to Information Act, seeking approval to decline to act on an access request. The institution argued that the request constituted an abuse of the right of access. However, the Commissioner found that the institution's submissions and evidence were insufficient to demonstrate that the access request met the criteria for abuse of right. The Commissioner noted that the institution appeared to confuse the issue of whether records were under its control with the question of abuse of right, and also failed to demonstrate any attempt to assist the requester. Consequently, the Commissioner decided that the application did not merit further consideration and denied the institution's request.

• Whether the access request constituted an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution provided sufficient evidence to support its s.6.1 application
• Whether the institution attempted to assist the requester

The complainant alleged that National Defence (DND) improperly withheld information under subsections 15(1) and 19(1) of the Access to Information Act, concerning historical records of the Intelligence Advisory Committee. During the investigation, DND issued two supplementary responses, disclosing additional information, and the complainant narrowed the complaint to specific pages withheld under subsection 15(1). DND proposed a third supplementary response, agreeing to disclose more information but maintaining some redactions under subsection 15(1). The Information Commissioner concluded that the remaining withheld information did not meet the requirements of subsection 15(1), particularly regarding the absence of apparent harm from disclosure. The Commissioner recommended DND disclose all remaining information withheld under subsection 15(1). However, DND notified the Commissioner that it would not implement this recommendation. Consequently, the complaint was found to be well-founded.

• Whether information was properly withheld under s.15(1) ATIA (international affairs and national security)
• Whether information was properly withheld under s.19(1) ATIA (personal information)
• Whether disclosure of the remaining information could reasonably be expected to harm international affairs, defence, or national security
• Whether DND provided sufficient evidence of harm to justify the s.15(1) exemption
• Whether DND reasonably exercised its discretion to withhold the information

The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.

• Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
• Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
• Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
• Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
• Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
• Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
• Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.

A representative, on behalf of a deceased member's estate executor, requested personal information from the Department of National Defence (DND) related to an investigation into allegations against the deceased. DND processed the request informally and disclosed some information under subparagraph 8(2)(m)(i) of the Privacy Act, but did not explicitly state its refusal to process the request formally under paragraph 10(b) of the Privacy Regulations. The OPC investigated whether the representative was entitled to make the request for the purpose of administering the estate. The OPC found that while the representative was authorized to administer the estate, they did not sufficiently demonstrate a connection between the requested information and the administration of the estate. Therefore, the complaint was not well-founded, as the representative failed to meet the requirements of paragraph 10(b) of the Regulations.

• Whether the representative was authorized to make a request on behalf of the deceased under paragraph 10(b) of the Regulations
• Whether the request related only to the administration of the deceased's estate under paragraph 10(b) of the Regulations
• Whether DND complied with section 16 of the Privacy Act regarding refusal notifications
• Whether DND properly processed the request informally without explicit written consent and notification of rights

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to conduct a reasonable search for records in response to an access request for Canada's School Narratives and supporting documents related to the Independent Assessment Process. CIRNAC officials acknowledged the existence of responsive records but refused to process them, citing confidentiality, the extensive time required (12 months), and existing priorities. They also expressed concerns about potential privacy violations and breaches of undertakings if the records were processed. The Information Commissioner found CIRNAC's refusal to process the records unacceptable, concluding that the institution denied the complainant's right of access. The Commissioner ordered CIRNAC to retrieve all responsive records, process them, and provide a complete response to the request within 60 business days. CIRNAC subsequently agreed to implement the order.

• Whether Crown-Indigenous Relations and Northern Affairs Canada conducted a reasonable search for records
• Whether the institution's refusal to process identified records constitutes a denial of the right of access

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into the Royal Canadian Mounted Police's (RCMP) collection of open-source information under Project Wide Awake (PWA), triggered by a complaint from MP Charlie Angus. The investigation focused on the RCMP's use of third-party services, specifically Babel Street's Babel X, for collecting personal information from various online sources. The OPC found that the RCMP failed to conduct adequate due diligence to ensure that the personal information collected via Babel X and its data providers complied with Canadian privacy laws, particularly PIPEDA. Furthermore, the OPC determined that the RCMP did not meet its transparency obligations under Section 11 of the Privacy Act, as its Personal Information Bank (PIB) descriptions were inadequate in detailing the types and purposes of open-source information collected. The RCMP did not agree to implement the OPC's recommendations, including ceasing collection from problematic Babel X sources until a thorough review was completed and updating its PIB descriptions with sufficient granularity. Consequently, both issues were found to be well-founded and unresolved.

• Whether the RCMP's collection of personal information via Social Studio complied with Section 4 of the Privacy Act.
• Whether the RCMP's collection of personal information via Babel X complied with Section 4 of the Privacy Act.
• Whether the RCMP conducted adequate due diligence on the lawfulness of collection practices of Babel X and its data providers.
• Whether Section 4 of the Privacy Act permits the collection of personal information from a third-party agent that collected, used, or disclosed the information in contravention of a law that third party is subject to.
• Whether the RCMP's publicly available descriptions of its open-source information gathering are granular enough to meet transparency obligations under Section 11 of the Privacy Act.
• Whether the RCMP's published descriptions clarify limits on purposes for collection under Section 11 of the Privacy Act.
• Whether the RCMP's descriptions of open-source information collection and related purposes are adequate under Section 11 of the Privacy Act.

The Office of the Privacy Commissioner of Canada (OPC) conducted a special investigation into cyber attacks that led to unauthorized disclosures and modifications of personal information held by the Canada Revenue Agency (CRA) and Employment and Social Development Canada (ESDC). Attackers used credential stuffing and identity theft to access and alter sensitive financial, banking, and employment information of tens of thousands of Canadians through the CRA's sign-in portal and ESDC's GC Key service. The OPC found that both CRA and ESDC contravened sections 6(2) and 8 of the Privacy Act due to inadequate safeguards. Key deficiencies included under-assessment of identity authentication levels, inadequately informed and accountable security decision-making, and a lack of effective monitoring. The OPC issued six recommendations to CRA and ESDC, covering improved authentication practices, coordinated security decision-making, and enhanced monitoring. Both departments accepted the recommendations, with ESDC's acceptance of one recommendation conditional on funding. The OPC concluded the matters for CRA and ESDC as well-founded and conditionally resolved, while other departments using GC Key had varying outcomes.

• Whether Canada Revenue Agency (CRA) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether Employment and Social Development Canada (ESDC) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
• Whether CRA contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether ESDC contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
• Whether CRA and ESDC adequately assessed the level of identity authentication warranted for their online services.
• Whether CRA and ESDC's identity assurance practices adequately protected against identity theft.
• Whether CRA and ESDC's credential assurance practices adequately protected against credential stuffing.
• Whether CRA and ESDC had adequately informed and accountable security decision-making processes.
• Whether interdepartmental information sharing and accountability systems were adequate to protect personal information.
• Whether CRA and ESDC conducted comprehensive vulnerability assessments and penetration testing.
• Whether CRA and ESDC had effective monitoring to detect and promptly contain the ongoing breach.
• Whether other federal departments using the GC Key service experienced fraudulent access or modification of personal information.

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to a selection process for a Steward/Command Master Sailor to the Commander of the Royal Canadian Navy. Initially, DND tasked two program areas, which reported no relevant records. The OIC, based on complainant representations, requested DND re-task these areas with specific keywords and task five named individuals. DND's subsequent search was incomplete, failing to task all individuals and use the correct date range, though it did yield seven pages of emails. Despite DND's claims of having provided all records, the OIC found that more records existed and DND had not provided a supplementary disclosure. The Commissioner concluded that DND had not conducted a reasonable search and ordered it to complete the retrieval of all responsive records, including tasking specified individuals, and to provide a new response within 36 business days.

• Whether National Defence conducted a reasonable search for records
• Whether all relevant Offices of Primary Interest were tasked
• Whether taskings included all pertinent keywords
• Whether all specified individuals were tasked
• Whether the correct date range was used in searches