Canadian Privacy Decisions

The complainant alleged that Public Safety Canada improperly withheld information related to user agreements for the national public alerting system, citing personal information and third-party emergency management plans. During the investigation, the complainant withdrew the need to investigate the personal information aspect. The Commissioner found that the agreements did not meet the criteria for third-party emergency management plans because they constituted negotiated terms rather than information supplied by a third party. The Commissioner also found that the institution's invocation of the exemption for facilitating an offence was not justified.

• Whether the information was 'supplied...by a third party' for the purposes of paragraph 20(1)(b.1) of the ATIA.
• Whether the information meets the criteria for third-party emergency management plans under paragraph 20(1)(b.1) of the ATIA.
• Whether the disclosure of a DocuSign envelope identification number could reasonably be expected to facilitate the commission of an offence under subsection 16(2) of the ATIA.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) failed to respond to an access request within the extended deadline. The request concerned "Activity Progress Reports" related to the Tk'emlups Indian Residential School Survivor Project or "missing children" programs. CIRNAC cited "resource limitations" for the delay. The Information Commissioner found the delay unacceptable, stating that resource constraints do not justify non-compliance with the Act, and ordered CIRNAC to provide a complete response within 36 business days.

• Failure to respond within statutory time limits
• Justification for delays due to resource limitations
• Definition of a complete response under the Act

The complainant alleged that the Vancouver Fraser Port Authority (VFPA) improperly withheld records related to noise and vibration studies under various sections of the Access to Information Act. The complainant also alleged the VFPA did not make reasonable efforts to assist them, providing illegible documents. The Commissioner found that while some information was properly withheld under exemptions like paragraph 18(b) concerning negotiations, much of the withheld information did not meet the exemption requirements. The Commissioner ordered the VFPA to disclose certain records and provide legible copies of maps, photos, and tables, which the VFPA agreed to implement.

• Improper withholding of records under multiple ATIA exemptions (e.g., s. 13(1), s. 18(b), s. 18(d), s. 19(1), s. 20(1)(b), s. 21(1)(a), s. 21(1)(d)).
• Failure to make reasonable efforts to assist the requester (ATIA s. 4(2.1)) by providing illegible documents.
• Burden of proof on the institution and third parties to justify exemptions.
• Reasonable exercise of discretion by the institution when withholding information.

The Office of the Privacy Commissioner of Canada (OPC) investigated Bell Canada after a complainant alleged Bell contravened PIPEDA by not responding to an access request within 30 days and denying access to cellphone logs. The OPC found Bell contravened PIPEDA by delaying its response to the access request and by denying the complainant access to his phone logs, which were determined to be his personal information. Bell also failed to be open about its policies regarding shared account information. Bell has agreed to provide the requested logs and implement recommendations to improve its procedures for handling shared account requests and its privacy communications.

• Timeliness of response to an access request
• Access to personal information held by a service provider on a shared account
• Definition of personal information in the context of phone logs
• Openness of an organization's privacy policies and practices

The complainant alleged that Library and Archives Canada (LAC) failed to respond to an access request within the 30-day timeframe. The request sought extensive information on Métis Nation land titles, treaties, and communications with Indigenous organizations. LAC determined the request was too broad and lacked specificity for their employees to identify records with reasonable effort, and thus did not meet the requirements of section 6 of the Access to Information Act. The Information Commissioner agreed that the request was too vague and did not require LAC to respond.

• Whether the access request provided sufficient detail to identify records with reasonable effort, as required by section 6 of the ATIA.
• Whether LAC made reasonable efforts to seek clarification from the complainant.
• Whether LAC was required to undertake extensive historical and legal research to identify responsive records.

The complainant alleged that Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) took an unreasonable time extension for an access request and improperly processed two requests as one. The request concerned updated consultation agreements and related internal government records. The Information Commissioner found the time extension for consultations with the Department of Justice unreasonable, citing excessive delays and lack of justification for the 90-day period. However, the Commissioner determined that CIRNAC was justified in processing the two requests as a single request.

• Reasonableness of time extension for consultations
• Justification for the length of the extension
• Proper processing of multiple requests within a single request

The complainant alleged that Employment and Social Development Canada (ESDC) did not conduct a reasonable search for records regarding complaints submitted to its Labour Program. ESDC initially missed key components of the request, resulting in an unreasonable search. Following the investigation, ESDC conducted additional searches, found more responsive records, and intends to provide them to the complainant. The Information Commissioner found the complaint well-founded and ordered ESDC to process and release the additional records.

• Reasonableness of the search conducted by the institution
• Completeness of the search in relation to the access request

The complainant alleged that the Privy Council Office (PCO) improperly withheld records concerning global warming or climate change, citing exemptions related to confidential government information, international affairs, national security, defence, and disclosure restrictions. The Information Commissioner found that PCO failed to demonstrate that the withheld information met the requirements for these exemptions, particularly regarding foreign government information and potential harm to Canada's international affairs or defence. Consequently, the complaint was found to be well-founded.

• Whether information regarding foreign governments was obtained in confidence and disclosure would cause harm (subsection 13(1) ATIA).
• Whether disclosure of names of CSIS and CSE employees could reasonably be expected to cause harm (subsection 15(1) ATIA).
• Whether disclosure of dissemination markings could reasonably be expected to cause harm to international affairs (subsection 15(1) ATIA).
• Whether disclosure of limited information regarding foreign governments could reasonably be expected to cause harm to international affairs (subsection 15(1) ATIA).

The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search for records concerning allegations of an individual's ethics and associations. The investigation found that not all responsible offices were initially tasked, and a later search located 142 pages of responsive records. The Information Commissioner ordered PCO to provide a response to the access request within 36 business days.

• Reasonableness of search
• Completeness of search
• Identification of all relevant offices of primary interest

The complainant alleged that the Privy Council Office (PCO) did not conduct a reasonable search for records related to the management of the government's parliamentary agenda. The OIC investigation found that the initial search was inadequate, as additional relevant records were located during the investigation. The Commissioner ordered PCO to provide a supplementary response to the access request.

• Reasonableness of the search conducted by the institution
• Completeness of the search for specific parliamentary agenda records
• Identification and retrieval of all responsive records

The complainant requested records concerning a collision between a vessel and a seaplane. Transport Canada withheld information citing several exemptions, including conduct of investigations, personal information, third-party commercial/financial information, third-party negotiations, and accounts of deliberations. The Information Commissioner found that Transport Canada failed to justify the application of most exemptions and did not properly consider its discretion to disclose information for public interest reasons. Consequently, the Commissioner ordered Transport Canada to disclose most of the withheld information.

• Proper application of exemptions for conduct of investigations (s.16(1)(c) ATIA)
• Proper application of exemptions for personal information (s.19(1) ATIA)
• Proper application of exemptions for third-party commercial/financial information (s.20(1)(b) ATIA)
• Proper application of exemptions for third-party negotiations (s.20(1)(d) ATIA)
• Proper application of exemptions for accounts of deliberations (s.21(1)(b) ATIA)
• Institution's discretion to disclose information for public interest reasons (s.20(6) ATIA)

The complainant alleged that Library and Archives Canada (LAC) improperly withheld records concerning NORAD intelligence from 1958-1963, citing exemptions related to confidential information from government bodies and international affairs. During the investigation, LAC made two supplementary releases. The OIC found that while NORAD qualified as an international organization of states for the purpose of exemption 13(1)(b), not all the information LAC initially withheld met the exemption criteria. However, an order was deemed unnecessary as LAC had released further information and the remaining withheld records met the exemption requirements.

• Whether NORAD qualifies as an 'international organization of states' under subsection 13(1)(b) of the ATIA.
• Whether the withheld information was obtained in confidence from NORAD.
• Whether LAC properly applied exemptions under subsection 13(1) and subsection 15(1) of the ATIA.
• Whether LAC reasonably exercised its discretion to withhold information under subsection 13(2).

This investigation examined Staples Canada's practices concerning the removal of personal information from returned laptops resold through its Openbox program. The Office of the Privacy Commissioner of Canada (OPC) found that Staples had deficiencies in its policies, procedures, and employee training regarding data wiping. Specifically, the OPC determined that Staples did not consistently ensure full data sanitization according to manufacturer guidelines, leading to residual personal information being found on some devices. Staples agreed to implement corrective measures, including updating procedures, enhancing training, and engaging third-party spot checks.

• Adequacy of safeguards for personal information on returned electronic devices
• Sufficiency of Staples' policies and procedures for data wiping
• Effectiveness of employee training on data sanitization
• Compliance with PIPEDA Principles 4.7.1 and 4.7.3

This investigation concerned a privately owned swimming pool's policy requiring parents to consent to the use of photos and videos of their children for promotional purposes as a condition of enrolling them in swimming lessons. The OPC found that this requirement contravened PIPEDA principles regarding consent for the collection, use, and disclosure of personal information. The swimming pool has agreed to implement an opt-in photo policy, resolving the complaint.

• Whether requiring consent for promotional photos/videos as a condition of service violates PIPEDA.
• Whether photos/videos of children in swim attire are sensitive personal information.
• Whether the swimming pool's stated business needs justified the mandatory consent policy.
• Whether consent was sought appropriately for staff training purposes.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records concerning annual expenses incurred to provide security for internationally protected persons visiting Canada. The RCMP provided a two-page summary instead of retrieving the requested records, arguing that most would be exempt. The Information Commissioner found the search unreasonable, ordering the RCMP to conduct a new search and respond to the request.

• Reasonableness of search
• Failure to retrieve and process records
• Provision of summary in lieu of records