Canadian privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld information related to cybersecurity and data breach risk assessments of the ArriveCAN application under subsection 16(2) and paragraph 20(1)(d) of the Access to Information Act. During the investigation, CBSA initially disclosed some records but continued to withhold others under subsection 16(2) and additionally claimed subsection 19(1). The Commissioner found that while some information met the requirements of subsection 16(2) (facilitating an offence), other portions did not. Furthermore, the Commissioner concluded that CBSA failed to properly exercise its discretion under subsection 19(2) regarding personal information, as it did not demonstrate efforts to seek consent or consider public availability. The complaint was found to be well founded. Although the Commissioner issued an initial report with orders, CBSA subsequently made further disclosures, and the complainant indicated satisfaction, making a formal order unnecessary.

• Whether s.16(2) ATIA (facilitating the commission of an offence) was properly applied to cybersecurity review information, including intranet/internal network addresses and specific vulnerabilities
• Whether s.16(2) ATIA was properly applied to statements related to asset identification and valuation, lists of components, summaries of changes, names of reference documents, and executive overviews
• Whether CBSA reasonably exercised its discretion under s.16(2) ATIA for information that met the exemption's requirements
• Whether s.19(1) ATIA (personal information) was properly applied to pictures and contact information of KPMG employees
• Whether CBSA made reasonable efforts to seek consent for disclosure of personal information under s.19(2)(a) ATIA
• Whether CBSA considered if personal information was publicly available under s.19(2)(b) ATIA
• Whether CBSA properly exercised its discretion under s.19(2) ATIA

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information under section 17 (safety of individuals) and subsection 19(1) (personal information) of the Access to Information Act. The request sought communications between specific CBC and Twitter employees since January 1, 2018. During the investigation, the CBC released some information previously withheld under subsection 19(1) and section 17, but also applied subsection 16(2) (facilitating the commission of an offence) to some remaining information. The Commissioner found that the CBC failed to demonstrate how disclosing the name and contact information of an information security team member would reasonably be expected to facilitate an offence, especially since some of this information was publicly available. Regarding section 17, while acknowledging that psychological harm could fall under the exemption, the Commissioner concluded that the CBC did not show the harm went beyond distress or that there was a reasonable expectation of harm if the information, including names and Twitter handles of journalists, were disclosed. The Commissioner ordered the CBC to disclose the information withheld under subsection 16(2) and section 17. The CBC notified the Commissioner that it would implement the order.

• Whether s.16(2) facilitating the commission of an offence was properly applied to the name and contact information of a CBC employee
• Whether there was a clear and direct linkage between disclosure and the alleged harm under s.16(2)
• Whether the information met the requirements of s.16(2)
• Whether s.17 safety of individuals was properly applied to the names and Twitter handles of CBC journalists
• Whether psychological harm is encompassed by s.17
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for journalists' identifying information
• Whether s.17 safety of individuals was properly applied to the name and contact information of a non-journalist CBC employee
• Whether the CBC demonstrated a reasonable expectation of harm under s.17 for the non-journalist employee's identifying information