Canadian privacy & access decisions

An individual complained that a private swimming pool required parents to consent to the use of their children's photos and videos for promotional purposes as a condition of service for swimming lessons. The complainant argued this violated PIPEDA's consent requirements, specifically Principle 4.3.3, which prohibits requiring consent for information beyond what is necessary for the service. The swimming pool contended that the photo policy was a reasonable business need for promotion and staff training, and that tracking individual consent would be burdensome. The OPC found that images of children in swim attire are sensitive personal information and that requiring consent for promotional photos and staff training videos was not strictly necessary for providing swimming lessons. The OPC concluded that this practice contravened PIPEDA Principles 4.3.3 and 4.3.6. The complaint was found to be well-founded and resolved after the swimming pool agreed to implement an opt-in photo policy.

• Whether requiring consent for promotional photos and videos of children as a condition of service for swimming lessons contravenes Principle 4.3.3 of PIPEDA
• Whether images of children in swim attire constitute sensitive personal information
• Whether the collection, use, or disclosure of images for promotional or staff training purposes is strictly necessary for the provision of swimming lessons
• Whether the organization offered individuals a choice regarding the collection, use, or disclosure of images for promotional or staff training purposes
• Whether the organization should have sought express consent for the collection, use, or disclosure of images of children

The complainant requested a full Issue Detail Report for a food complaint from the Canadian Food Inspection Agency (CFIA). The CFIA withheld information under subsections 19(1) (personal information), 20(1)(b) (confidential third-party information), and 20(1)(c) (financial impact on a third party) of the Access to Information Act. The complainant also alleged that the CFIA improperly used 'negative' (white) redactions, making it difficult to identify withheld portions. During the investigation, the complainant withdrew the allegation regarding subsection 19(1). The Commissioner found that the CFIA failed to meet its duty to assist by using negative redactions and recommended they cease this practice. For the third-party exemptions, the Commissioner determined that most of the information did not meet the requirements of paragraphs 20(1)(b) or 20(1)(c), as the institution and third party did not sufficiently establish confidentiality or reasonable expectation of harm. The Commissioner ordered the CFIA to disclose most of the withheld third-party information, with specific exceptions for supplier names, procedural details, and product weighing processes. The CFIA agreed to implement the order and recommendation.

• Whether the CFIA improperly withheld information under s.19(1) ATIA
• Whether the CFIA improperly withheld information under s.20(1)(b) ATIA
• Whether the CFIA improperly withheld information under s.20(1)(c) ATIA
• Whether the CFIA's use of negative (white) redactions was appropriate under s.4(2.1) ATIA (duty to assist)
• Whether the information is financial, commercial, scientific or technical for s.20(1)(b) ATIA
• Whether the information is confidential by an objective standard for s.20(1)(b) ATIA
• Whether the third party supplied the information to a government institution for s.20(1)(b) ATIA
• Whether the third party has consistently treated the information as confidential for s.20(1)(b) ATIA
• Whether disclosure could result in material financial loss or gain to the third party for s.20(1)(c) ATIA
• Whether there is a reasonable expectation of harm for s.20(1)(c) ATIA
• Whether disclosure could injure the competitive position of the third party for s.20(1)(c) ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records concerning expenses incurred for providing security to internationally protected persons visiting Canada. The request sought all records, including breakdowns by visitor, from January 1, 2015, to January 24, 2020. In response, the RCMP provided only a two-page summary of costs, arguing that most records would likely be exempt or excluded under the Act, and that generating a summary was more expedient than reviewing an estimated 150,000 pages. The Information Commissioner found that the RCMP did not demonstrate how the summary fulfilled its responsibility to retrieve and process all responsive records, nor did it adequately justify not identifying and locating the full records based on potential exemptions. Consequently, the Commissioner concluded that the RCMP did not conduct a reasonable search. The complaint was found to be well founded, and the RCMP was ordered to conduct a new search and provide a new response.

• Whether the institution conducted a reasonable search for records
• Whether providing a summary of records fulfills the obligation to search for 'all records'
• Whether the potential for exemptions justifies not identifying and locating all responsive records

The complainant requested records related to CSL Group Inc., specifically policy and workplace health and safety committee reports from 2012 to 2022. Employment and Social Development Canada (ESDC) withheld information under several provisions of the Access to Information Act and was also alleged to have conducted an unreasonable search for records. The Commissioner found that ESDC failed to justify most of its exemption claims, including those under s.16(1)(c), s.16(2), s.20(1)(b), s.20(1)(c), s.21(1)(b), and s.23. While some personal information and specific recommendations were properly withheld under s.19(1) and s.21(1)(a) respectively, ESDC's exercise of discretion for other s.21(1)(a) information was deemed unreasonable. Furthermore, ESDC failed to demonstrate that it conducted a reasonable search for responsive records. Consequently, the complaint was found to be well-founded. The Commissioner ordered ESDC to disclose most of the withheld information, re-exercise discretion for certain records, and conduct a new, reasonable search for responsive records. ESDC notified the Commissioner of its intent to comply with the order.

• Whether ESDC improperly withheld information under s.16(1)(c) ATIA (law enforcement, conduct of investigations)
• Whether ESDC improperly withheld information under s.16(2) ATIA (facilitating the commission of an offence)
• Whether ESDC improperly withheld information under s.19(1) ATIA (personal information)
• Whether the corporate address on page 136 constitutes personal information under s.19(1) ATIA
• Whether non-personal information on business cards on page 138 constitutes personal information under s.19(1) ATIA
• Whether ESDC reasonably exercised its discretion under s.19(2) ATIA regarding personal information
• Whether ESDC improperly withheld information under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b) ATIA
• Whether ESDC improperly withheld information under s.20(1)(c) ATIA (financial impact on a third party)
• Whether disclosure could reasonably be expected to have a material financial impact or injure competitive position under s.20(1)(c) ATIA
• Whether ESDC improperly withheld information under s.21(1)(a) ATIA (advice or recommendations)
• Whether the information constitutes advice or recommendations under s.21(1)(a) ATIA
• Whether ESDC reasonably exercised its discretion under s.21(1)(a) ATIA regarding advice or recommendations
• Whether ESDC improperly withheld information under s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information constitutes accounts of consultations or deliberations under s.21(1)(b) ATIA
• Whether ESDC improperly withheld information under s.23 ATIA (solicitor-client and litigation privilege)
• Whether the information is subject to solicitor-client privilege under s.23 ATIA
• Whether the information is subject to litigation privilege under s.23 ATIA
• Whether ESDC conducted a reasonable search for records