Canadian Privacy Decisions

This investigation concerned Yahoo! Canada's "Stay signed in" feature for its email service, which defaulted to keeping users logged in. The OPC found this practice posed significant privacy risks, especially on public or shared computers, as emails can contain highly sensitive personal information. Yahoo was found to have inadequate safeguards and failed to obtain meaningful consent for the disclosure of personal information that could result from this default setting. Yahoo committed to changing the feature to an opt-in basis and providing clearer warnings to users.

• Adequacy of safeguards against unauthorized access to sensitive email content.
• Whether "Stay signed in" default setting constitutes meaningful consent for disclosure of personal information.
• Clarity and prominence of privacy warnings associated with the "Stay signed in" feature.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act related to a follow-up investigation concerning a Code of Conduct decision against the complainant. The RCMP initially withheld information, but later released some of it, conceding it was not personal information. However, they continued to withhold other information under subsection 19(1). The OIC concluded that the remaining withheld information was indeed personal information concerning another individual and did not meet the exceptions in subsection 19(2), therefore the complaint was well founded.

• Application of subsection 19(1) (personal information) of the ATIA
• Whether withheld information constituted personal information of another individual
• Whether the exceptions in subsection 19(2) of the ATIA applied

The Office of the Privacy Commissioner of Canada (OPC) investigated a short-term lender, CashHere, after receiving an alert that it was collecting clients' online banking credentials (usernames, passwords, security questions and answers) as part of its payday loan application process. The OPC found that while the lender had a legitimate need to verify identity and income, collecting these highly sensitive credentials was not a purpose that a reasonable person would consider appropriate due to the significant privacy risks and the availability of less invasive alternatives. The investigation also uncovered a related entity, MoneyHome, engaging in similar practices.

• Appropriateness of collecting online banking credentials for loan applications
• Proportionality of privacy harms versus lender benefits
• Availability of less privacy-invasive means to verify identity and income
• Potential link between CashHere and MoneyHome

The complainant alleged that the Canadian Security Intelligence Service (CSIS) took an unreasonable amount of time to respond to an access to information request, specifically concerning a time extension for consultations. CSIS argued that the extension was necessary due to the sensitivity of the records, the need for on-site review, and limited workplace access, all exacerbated by the pandemic. The OIC found that CSIS made a reasonable effort to assess the extension period and concluded that the time taken was justified given the circumstances.

• Reasonableness of time extension for consultations under paragraph 9(1)(b) of the ATIA.
• Impact of the pandemic on the ability of institutions to complete consultations within the standard timeframes.
• Whether CSIS adequately demonstrated the necessity and duration of the time extension.

The Office of the Information Commissioner (OIC) received nine complaints concerning Global Affairs Canada's failure to meet deadlines or take unreasonable time extensions in responding to access requests. In four cases, the institution cited the COVID-19 pandemic as a significant factor. Global Affairs committed to finalizing all nine requests by October 15, 2021. The OIC found all nine complaints to be well founded.

• Timeliness of response to access to information requests
• Impact of COVID-19 on institution's ability to process requests
• Reasonableness of time extensions

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under paragraph 16(1)(a) of the Access to Information Act. The OIC found that the withheld information was obtained by the RCMP during a lawful investigation related to the suppression of crime and was created less than 20 years before the request. The OIC was also satisfied that the RCMP reasonably exercised its discretion in deciding to withhold the information.

• Whether the information was obtained or prepared by an investigative body in the course of a lawful investigation pertaining to the detection, prevention or suppression of crime.
• Whether the information came into existence less than twenty years prior to the request.
• Whether the RCMP reasonably exercised its discretion to withhold the information.

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information concerning a specific individual's business ownership under subsection 24(1) of the Access to Information Act. The OIC found that the requested information was about an identifiable taxpayer (not the complainant) and was obtained by the CRA for the purposes of administering the Income Tax Act. As section 241 of the Income Tax Act restricts the disclosure of such information, the OIC concluded the CRA properly withheld the records.

• Whether the information requested was properly withheld under subsection 24(1) of the ATIA (disclosure restricted by another law).
• Whether the information constituted taxpayer information as defined by the Income Tax Act.
• Whether section 241 of the Income Tax Act restricted the disclosure of the requested information.

The complainant alleged that Health Canada did not conduct a reasonable search for records concerning producers and users of medical cannabis. Responsive records were drawn from one database, but Health Canada argued retrieving additional records from a second database would be unreasonable due to the manual labour involved. The Information Commissioner agreed that the search was reasonable given the effort required.

• Reasonableness of search

The complainant alleged that Transport Canada improperly relied on section 26 of the Access to Information Act to refuse access to annual statistics regarding the processing of access to information and privacy requests. The Office of the Information Commissioner found that Transport Canada met the criteria for applying section 26 and had properly considered all relevant factors in its decision.

• Applicability of section 26 of the ATIA (Refusal of access if information to be published)
• Proper exercise of discretion by the institution

The Information Commissioner investigated a complaint that Canadian Heritage (PCH) had suspended processing access requests due to the COVID-19 pandemic. PCH was unable to access its premises or systems from March 16, 2020, to July 10, 2020, resulting in a backlog of 224 requests. The Commissioner found the complaint well-founded, stating PCH's failure to respond breached requesters' rights under the Act.

• Impact of COVID-19 pandemic on processing access requests
• Institution's ability to access premises and remote systems
• Failure to respond to access requests within statutory timelines

The complainant disputed Transport Canada's decision to withhold information regarding vehicle safety recall completion rates, citing exemptions under sections 14, 20, and 21 of the Access to Information Act. The Information Commissioner found that neither Transport Canada nor the third party met their burden to prove the exemptions applied to the records. The Commissioner recommended that Transport Canada release all withheld information, except for specific personal details. Transport Canada agreed to implement these recommendations.

• Application of section 14 of the ATIA (intergovernmental relations)
• Application of section 20 of the ATIA (third-party information)
• Application of section 21 of the ATIA (confidential deliberations)
• Burden of proof on the institution to justify exemptions

The complainant requested information regarding a High Frequency Rail Proposal from VIA Rail Canada. VIA Rail withheld the information citing several exemptions under the Access to Information Act. The Office of the Information Commissioner found that VIA Rail failed to prove the exemptions applied and did not perform a proper severance analysis to release non-exempt portions of the records. Consequently, the complaint was found to be well founded.

• Whether VIA Rail Canada properly applied exemptions under sections 18 and 21 of the ATIA.
• Whether VIA Rail Canada conducted an adequate severance exercise.
• Whether VIA Rail Canada exercised due diligence in responding to the access request.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from an employee of a federal institution who alleged a breach of privacy. The employee's personal information regarding her transgender identity and the reasons for her transfer were disclosed to her new supervisor and colleagues without her consent, despite assurances of confidentiality. The OPC found this disclosure contravened the Privacy Act.

• Disclosure of personal information without consent
• Confidentiality of transgender status
• Application of the Privacy Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1971 within the statutory time limits. PCO cited its "no late file" policy as the reason for closing the file when consultations with other institutions were not completed on time. The Information Commissioner found that PCO's failure to respond constituted a deemed refusal under the Act.

• Failure to respond within ATIA time limits
• Validity of "no late file" policy
• Deemed refusal under subsection 10(3) of the ATIA

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1962 within the statutory time limits. PCO claimed an extension and then closed the file, stating it had not received recommendations from other government institutions, based on its “no late file” policy. The Information Commissioner found that the Act does not authorize this reason for non-response and that PCO was in deemed refusal.

• Failure to respond to an access request within the statutory time limits
• Validity of PCO's "no late file" policy
• Application of subsection 10(3) of the Access to Information Act (deemed refusal)