Canadian privacy & access decisions

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly refused to process an access request for all emails of a named employee. PSPC argued that the request lacked sufficient detail because it did not specify a subject matter or timeframe. The Information Commissioner found that PSPC failed to demonstrate that an experienced institutional employee could not identify the relevant records with reasonable effort, even without a specified subject or timeframe. The Commissioner concluded that PSPC's refusal to process the request was unreasonable and that the institution was deemed to have refused access due to not responding by the legislated due date. Given the estimated 50,000 pages of responsive records, the Commissioner ordered PSPC to provide a complete response by July 9, 2029, and recommended training for employees on information management. PSPC agreed to implement both the order and the recommendation, leading to a well-founded complaint.

• Whether the access request met the requirements of section 6 of the ATIA
• Whether the request provided enough detail for experienced institutional employees to identify relevant records with a reasonable effort
• Whether PSPC's refusal to process the request was reasonable
• Whether PSPC was deemed to have refused access under subsection 10(3) of the ATIA

A federal institution sought the Information Commissioner's approval under subsection 6.1(1) of the Access to Information Act to decline to act on two access requests, arguing they constituted an abuse of the right of access. The institution claimed the requests would overburden its operations, were repetitive, and were directed towards an improper purpose, such as gaining an advantage in ongoing legal proceedings. Specifically, it estimated the first request would yield one million pages and take ten years to process, and the second request sought records related to the extension claimed for the first. The Commissioner found the institution failed to provide sufficient evidence to substantiate its claims regarding the volume of records, the impact on its resources, or the alleged repetitive nature of the requests. The Commissioner also determined there was no concrete evidence that the requests were made for an improper purpose. Consequently, the Commissioner denied the institution's application, meaning the institution must process the access requests. The Commissioner encouraged both parties to continue collaborating to reduce the volume of responsive records.

• Whether the access requests constitute an abuse of the right to make a request under subsection 6.1(1) of the Access to Information Act
• Whether the requests would overburden the institution's operations
• Whether the institution provided sufficient evidence to support its estimated volume of records for the first access request (A-2024-00006)
• Whether the institution provided sufficient evidence to support its estimated volume of records for the second access request (A-2024-00068)
• Whether the institution sufficiently explained the impact of processing the requests on its offices of primary interest (OPIs) and ATIP office
• Whether the requests would hinder other requesters' right of access
• Whether the requests are repetitive
• Whether the items within the first access request are overlapping
• Whether records previously in the requester's possession (either provided to the institution or obtained through prior legal proceedings) makes the request repetitive
• Whether the availability of alternative means of accessing information (e.g., legal proceedings) makes the request repetitive
• Whether the requests are directed towards a purpose other than obtaining documents or information
• Whether the requests were intended to overwhelm the institution's resources or gain an advantage in legal proceedings

The complainant alleged that the Port Alberni Port Authority (PAPA) improperly withheld information under several sections of the Access to Information Act in response to a request for documents related to the lease or sale of its assets. The investigation focused on withheld company names and financial amounts. PAPA claimed exemptions under paragraphs 18(a), 18(b), 18(c), subsection 19(1), and paragraphs 20(1)(b) and 20(1)(c). The Commissioner found that PAPA failed to demonstrate that the withheld information met the requirements for any of the claimed exemptions. Specifically, PAPA did not show that the financial information had substantial value, that its disclosure would harm its competitive position or interfere with negotiations, or that the information was scientific/technical from government research. The Commissioner also determined that a company name was not personal information and that the third-party commercial information was not objectively confidential nor was a clear link established between disclosure and financial harm. Consequently, the Commissioner ordered PAPA to disclose the redacted information. PAPA agreed to implement the order, and the complaint was found to be well founded.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) applied to the withheld amounts related to equipment rental
• Whether the withheld financial information had substantial value under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions or negotiations by government institutions) applied to the withheld amounts related to equipment rental
• Whether disclosure of the information would reasonably be expected to harm PAPA's competitive position or interfere with negotiations under s.18(b) ATIA
• Whether s.18(c) ATIA (government scientific or technical information obtained from research) applied to any withheld information
• Whether the withheld information was scientific or technical, obtained through government research, and if its disclosure would jeopardize publication rights under s.18(c) ATIA
• Whether s.19(1) ATIA (personal information) applied to the name of a company
• Whether the company name constituted personal information under s.19(1) ATIA
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) applied to the third party's name and leased premises information
• Whether the third-party information was confidential by an objective standard under s.20(1)(b) ATIA
• Whether s.20(1)(c) ATIA (financial impact on a third party) applied to portions of a lease agreement and specific amounts
• Whether disclosure of the information would reasonably be expected to cause material financial loss or gain to the third party or injure its competitive position under s.20(1)(c) ATIA

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly withheld information in response to a request for the recovery strategy for the whitebark pine. The OIC investigated ECCC's application of several exemptions, including those related to personal information, third-party commercial information, federal-provincial affairs, and advice/recommendations. The Commissioner found that ECCC failed to make reasonable efforts to seek consent for personal information and did not demonstrate that third-party information met the exemption requirements. Additionally, ECCC improperly withheld factual information under advice/recommendations exemptions and did not reasonably exercise discretion for some information withheld under federal-provincial affairs. The Commissioner ordered ECCC to seek consent for personal information, disclose certain third-party and factual information, and re-exercise discretion for specific records. ECCC agreed to comply with the order, leading to a well-founded complaint.

• Whether s.19(1) personal information exemption was properly applied to the name and contact information of an individual
• Whether ECCC made reasonable efforts to seek consent under s.19(2)(a) for personal information
• Whether the personal information was publicly available under s.19(2)(b)
• Whether disclosure of personal information would be consistent with s.8 of the Privacy Act under s.19(2)(c)
• Whether the information met the requirements of s.20(1)(b) for confidential third-party financial, commercial, scientific or technical information
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether the information met the requirements of s.21(1)(b) for accounts of consultations or deliberations
• Whether factual information was improperly withheld under s.21(1)(b)
• Whether ECCC reasonably exercised discretion under s.21(1)(b) for information Parks Canada indicated could be disclosed
• Whether ECCC reasonably exercised discretion under s.21(1)(b) for other information
• Whether the information met the requirements of s.21(1)(a) for advice or recommendations
• Whether factual information was improperly withheld under s.21(1)(a)
• Whether ECCC reasonably exercised discretion under s.21(1)(a)
• Whether the information met the requirements of s.14 for federal-provincial affairs
• Whether ECCC reasonably expected harm to federal-provincial affairs from disclosure of information on page 2947
• Whether ECCC reasonably exercised discretion under s.14

The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP) following the loss of an unencrypted USB storage device containing sensitive personal information of 1,741 individuals. The investigation focused on whether the RCMP contravened section 8 of the Privacy Act regarding disclosure, the appropriateness of its breach response, and the sufficiency of its safeguards for USB devices. The OPC found that the RCMP contravened section 8 due to unauthorized disclosure, as the device was lost, unencrypted, and its contents were copied and offered for sale. While the RCMP's notification to affected individuals and mitigation steps were generally appropriate after discovery, the initial reporting of the loss was significantly delayed. Furthermore, the RCMP failed to implement adequate safeguards, as its own policies for procurement, inventory, and encryption of USB devices were not followed, and security awareness training was insufficient. Despite the RCMP accepting the OPC's recommendations to strengthen safeguards, audit procedures, and awareness programs, it refused to commit to specific timelines for implementation. Consequently, the complaint was found to be well-founded and unresolved.

• Whether the RCMP disclosed personal information in contravention of section 8 of the Privacy Act
• Whether the RCMP's response to the privacy breach was appropriate in the circumstances
• Whether the RCMP's measures to protect personal information contained on USB storage devices were sufficient
• Whether RCMP personnel failed to report the loss of the USB storage device to authorities in a timely manner
• Whether the RCMP's policies and procedures for procurement, inventory, and encryption of USB devices were followed and enforced
• Whether the RCMP's security and privacy awareness training for members was effective and sufficient
• Whether the RCMP's policy compliance monitoring for USB device use was adequate

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld information related to cybersecurity and data breach risk assessments of the ArriveCAN application under subsection 16(2) and paragraph 20(1)(d) of the Access to Information Act. During the investigation, CBSA initially disclosed some records but continued to withhold others under subsection 16(2) and additionally claimed subsection 19(1). The Commissioner found that while some information met the requirements of subsection 16(2) (facilitating an offence), other portions did not. Furthermore, the Commissioner concluded that CBSA failed to properly exercise its discretion under subsection 19(2) regarding personal information, as it did not demonstrate efforts to seek consent or consider public availability. The complaint was found to be well founded. Although the Commissioner issued an initial report with orders, CBSA subsequently made further disclosures, and the complainant indicated satisfaction, making a formal order unnecessary.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied to cybersecurity review information, including intranet/internal network addresses and specific vulnerabilities
• Whether s.16(2) ATIA was properly applied to statements related to asset identification and valuation, lists of components, summaries of changes, names of reference documents, and executive overviews
• Whether CBSA reasonably exercised its discretion under s.16(2) ATIA for information that met the exemption's requirements
• Whether s.19(1) ATIA (personal information) was properly applied to pictures and contact information of KPMG employees
• Whether CBSA made reasonable efforts to seek consent for disclosure of personal information under s.19(2)(a) ATIA
• Whether CBSA considered if personal information was publicly available under s.19(2)(b) ATIA
• Whether CBSA properly exercised its discretion under s.19(2) ATIA

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information under section 17 (safety of individuals) and subsection 19(1) (personal information) of the Access to Information Act. The request sought communications between specific CBC and Twitter employees since January 1, 2018. During the investigation, the CBC released some information previously withheld under subsection 19(1) and section 17, but also applied subsection 16(2) (facilitating the commission of an offence) to some remaining information. The Commissioner found that the CBC failed to demonstrate how disclosing the name and contact information of an information security team member would reasonably be expected to facilitate an offence, especially since some of this information was publicly available. Regarding section 17, while acknowledging that psychological harm could fall under the exemption, the Commissioner concluded that the CBC did not show the harm went beyond distress or that there was a reasonable expectation of harm if the information, including names and Twitter handles of journalists, were disclosed. The Commissioner ordered the CBC to disclose the information withheld under subsection 16(2) and section 17. The CBC notified the Commissioner that it would implement the order.

• Whether s.16(2) facilitating the commission of an offence was properly applied to the name and contact information of a CBC employee
• Whether there was a clear and direct linkage between disclosure and the alleged harm under s.16(2)
• Whether the information met the requirements of s.16(2)
• Whether s.17 safety of individuals was properly applied to the names and Twitter handles of CBC journalists
• Whether psychological harm is encompassed by s.17
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for journalists' identifying information
• Whether s.17 safety of individuals was properly applied to the name and contact information of a non-journalist CBC employee
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for the non-journalist employee's identifying information