Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against the Treasury Board of Canada Secretariat (TBS) regarding its personal information practices for monitoring employee on-site presence under the federal government's hybrid work model. The complainant alleged invasive collection, use, and disclosure of personal information, questioning TBS's compliance with sections 4, 6, 7, and 8 of the Privacy Act, as well as transparency, necessity, proportionality, and Privacy Impact Assessment (PIA) requirements. The OPC found that TBS's collection of aggregated data for organizational compliance was for non-administrative purposes, authorized by existing statutes, and appropriately de-identified to fall outside the scope of the Act for disclosure. For individual compliance, managers primarily relied on observation and self-reporting, supported by internal guidance. While TBS's practices were largely compliant, the OPC encouraged TBS to update its Personal Information Bank (PIB) description for Physical Access Controls (PSU 907) to explicitly reflect the potential use of access logs in formal investigations and to clearly communicate this to employees. Overall, the OPC concluded that TBS's personal information handling practices were compliant with the Privacy Act.

• Whether the collection of employees' personal information for on-site presence monitoring was related directly to TBS's operating programs or activities under section 4 of the Privacy Act.
• Whether TBS's retention and disposal practices for personal information collected for on-site presence monitoring complied with section 6 of the Privacy Act, specifically subsections 6(1) and 6(3).
• Whether TBS's use of personal information for on-site presence monitoring was a 'consistent use' authorized under section 7(a) of the Privacy Act.
• Whether TBS's disclosure of aggregated on-site presence data to senior management constituted personal information under section 3 of the Privacy Act and complied with section 8.
• Whether TBS's transparency and openness related to its hybrid compliance monitoring approach, including standard Personal Information Banks (PIBs), was adequate under sections 10 and 11 of the Privacy Act.
• Whether TBS's personal information practices for on-site presence monitoring complied with the necessity and proportionality data principles.
• Whether TBS was required to complete a Privacy Impact Assessment (PIA) for its verification regime.
• Whether managers' practices for monitoring individual compliance with the hybrid work model contravened the Privacy Act.

The World Anti-Doping Agency (WADA) entered into a compliance agreement with the Privacy Commissioner of Canada (OPC) to resolve an investigation into WADA's collection, use, and disclosure practices concerning athletes' personal information in its Anti-Doping Administration and Management System (ADAMS). The OPC launched an investigation after receiving a complaint, and WADA disputed the allegations and challenged the OPC's jurisdiction in Federal Court. Without admitting contravention or waiving jurisdictional rights, WADA agreed to remedial measures. These measures include ceasing to permit Anti-Doping Organizations (ADOs) to use ADAMS data for non-anti-doping purposes, updating the World Anti-Doping Code, and amending agreements with ADOs to restrict data use to anti-doping purposes only. WADA will also provide the OPC with a mechanism to ensure ADOs adhere to these restrictions. The investigation will be placed in abeyance and discontinued upon completion of the remedial measures.

• Whether WADA's collection, use, and disclosure practices of athletes' personal information in ADAMS comply with PIPEDA
• Whether the OPC has statutory, territorial, and/or subject matter jurisdiction over WADA
• Whether ADOs are permitted to use personal information in ADAMS for purposes other than anti-doping

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) took an unreasonable extension of time to respond to an access request for Microsoft Teams messages and related policies. ISED claimed a 390-day extension, citing the volume of records, complexity, and the need for senior-level review, as well as internal and external consultations. The Commissioner found that ISED failed to demonstrate a link between the reasons for the extension and its length, or that a serious attempt was made to determine the necessary length. Specifically, the 240-day extension for volume and interference was deemed excessive, and the 150-day extension for consultations lacked sufficient justification. The Commissioner concluded that the extension was invalid, leading to a deemed refusal of access. The complaint was found to be well-founded, and ISED was ordered to provide a complete response within 60 business days.

• Whether the 240-day extension under s.9(1)(a) ATIA for volume and interference was reasonable
• Whether the 150-day extension under s.9(1)(b) ATIA for consultations was reasonable
• Whether ISED made a serious effort to assess the necessary length of the extension of time
• Whether there was a link between the reasons for the extension and its length
• Whether the calculation of the length of the extension was sufficiently rigorous, logical, and supportable
• Whether ISED was in deemed refusal under s.10(3) ATIA

An unnamed federal institution applied to the Information Commissioner for approval to decline to act on an access request, arguing it constituted an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The request sought extensive records related to rare diseases and medications, spanning from the earliest records to the present, across multiple departments and communication types. The institution contended the request was overly broad, would overburden its small staff, and required manual review of an unmanageable volume of records. The Commissioner found that the request, particularly its fifth part, was indeed overly broad and that responding to it would overburden the institution, which has only 15 employees and processes a modest number of pages annually. Despite the requester's offer to provide a more specific list of diseases, the Commissioner concluded that the institution had made reasonable efforts to assist and that the request would still be unduly burdensome. Consequently, the Commissioner granted the institution's application to decline to act on the request.

• Whether the access request is an abuse of the right of access under s.6.1(1) ATIA
• Whether the request is overly broad
• Whether acting on the request would overburden the institution
• Whether the institution met its duty to assist the requester under s.4(2.1) ATIA
• Whether the circumstances warrant granting approval to decline to act on the request

The complainant sought records related to the Canada Student Service Grant from Employment and Social Development Canada (ESDC), alleging improper withholding of information under several exemptions and an unreasonable search for records. The Commissioner found that ESDC improperly withheld information claimed under paragraphs 20(1)(b) and 20(1)(c), determining that the institution failed to demonstrate the information's confidentiality, its financial/commercial/scientific/technical nature, or a reasonable expectation of harm from disclosure. For information withheld under paragraphs 21(1)(a) and 21(1)(b), the Commissioner concluded that factual information and final decisions did not meet the exemption requirements and that ESDC failed to reasonably exercise its discretion for other information that did meet the requirements. Similarly, while the majority of information claimed under section 23 met the requirements for solicitor-client privilege, some portions did not, and privilege was waived for other parts by the Privy Council Office. However, the Commissioner found that ESDC conducted a reasonable search for records, despite the complainant's concerns about missing emails, handwritten notes, and cabinet confidences. Consequently, the complaint was found to be well founded regarding the improper application of exemptions and the failure to exercise discretion. The Commissioner ordered ESDC to disclose specific information and to re-exercise its discretion for other information withheld under sections 21 and 23. ESDC notified the Commissioner of its intent to comply with the order, though it also indicated a desire to apply additional exemptions not raised during the investigation, which the Commissioner rejected.

• Whether ESDC improperly withheld information under s.16(2) ATIA
• Whether ESDC improperly withheld information under s.19(1) ATIA
• Whether the information met the requirements of s.20(1)(b) ATIA (confidential financial, commercial, scientific or technical information)
• Whether the information met the requirements of s.20(1)(c) ATIA (material financial impact or harm to competitive position)
• Whether the information met the requirements of s.21(1)(a) ATIA (advice or recommendations)
• Whether the information met the requirements of s.21(1)(b) ATIA (accounts of consultations or deliberations)
• Whether the information met the requirements of s.23 ATIA (solicitor-client and litigation privilege)
• Whether ESDC reasonably exercised its discretion to disclose information under s.20(5) ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.21 ATIA
• Whether ESDC reasonably exercised its discretion to disclose information under s.23 ATIA
• Whether ESDC conducted a reasonable search for records
• Whether PCO waived solicitor-client privilege over certain information

The Office of the Privacy Commissioner of Canada (OPC) investigated the Canada Border Services Agency's (CBSA) contracting practices for the ArriveCAN application, focusing on measures to protect travellers' personal information handled by contractors. An individual's complaint and a parliamentary committee's motion prompted the review into whether contractors accessed personal information without required security clearances, potentially contravening sections 7 and 8 of the Privacy Act. The OPC found that while contracts included appropriate security clauses, there were issues with the accuracy and timeliness of security assessments (SRCLs) and overly broad task descriptions in Task Authorizations (TAs). Although vendors met organizational security requirements, one contractor worked for 18 months with an expired security clearance, exposing the CBSA to increased privacy risks. The CBSA implemented adequate administrative and technical safeguards, such as segregated environments and strict access controls, but six contractors were granted access to personal information not strictly necessary for their duties. Despite these shortcomings, the investigation found no evidence that personal information was actually used or disclosed in contravention of the Act. Consequently, the complaint was found to be not well-founded, but the OPC issued recommendations to the CBSA to strengthen its contracting and privacy practices, which the agency accepted.

• Whether the CBSA authorized contractors to access personal information collected through ArriveCAN without the required security clearance, in contravention of sections 7 and 8 of the Privacy Act
• Whether ArriveCAN contracts and Task Authorizations (TAs) contained appropriate clauses to ensure the protection of travellers’ personal information that contractors had access to
• Whether security requirements identified in contracts and TAs were accurate and specific
• Whether the CBSA complied with organizational security screening requirements for vendors
• Whether the CBSA complied with personnel security screening requirements for contractors
• Whether the CBSA implemented adequate administrative safeguards to protect personal information accessed by contractors
• Whether the CBSA implemented adequate technical safeguards to protect personal information accessed by contractors
• Whether the CBSA restricted contractor permissions and access to personal information to what was strictly necessary

An anonymous applicant complained that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(b) of the Access to Information Act. The request sought annual rent figures for leases exceeding $500,000 signed by PSPC in specific cities between 2018 and 2022. PSPC and several third parties argued that disclosure would harm PSPC's competitive position and negotiations, and constitute confidential third-party financial information, also suggesting paragraphs 20(1)(c) and 20(1)(d). The Commissioner found PSPC's and the third parties' arguments for all claimed exemptions to be speculative, failing to demonstrate a reasonable expectation of probable harm or objective confidentiality. Specifically, the rent figures were not considered "supplied by" the third parties for the purpose of s.20(1)(b). Consequently, the complaint was found to be well founded, and the Commissioner ordered PSPC to disclose the records in full. PSPC subsequently gave notice that it would comply with the order.

• Whether PSPC improperly withheld information under paragraph 18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to harm the competitive position of PSPC under s.18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with contractual or other negotiations of PSPC under s.18(b) ATIA
• Whether PSPC's representations on harm under s.18(b) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(b) ATIA
• Whether annual rent figures constitute financial, commercial, scientific or technical information under s.20(1)(b) ATIA
• Whether annual rent figures are confidential by an objective standard under s.20(1)(b) ATIA
• Whether annual rent figures are publicly available
• Whether the circumstances give rise to a reasonable expectation that annual rent figures would not be disclosed
• Whether the relationship between PSPC and third parties would be fostered for public benefit by confidentiality of annual rent figures
• Whether annual rent figures were "supplied by" the third party to PSPC under s.20(1)(b) ATIA
• Whether third parties consistently treated annual rent figures as confidential under s.20(1)(b) ATIA
• Whether PSPC improperly withheld information under paragraph 20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to prejudice a third party's competitive position under s.20(1)(c) ATIA
• Whether third parties' representations on harm under s.20(1)(c) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(d) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with the contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether third parties' representations on interference under s.20(1)(d) were speculative
• Whether the complaint was well founded under s.30(1)(a) ATIA
• Whether an order for disclosure should be issued under s.36.1 ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to a video posted on Facebook. The request specifically excluded draft copies, media articles, and French records where English equivalents existed. During the investigation, it was discovered that ISC's Communications and Public Affairs unit had removed records deemed to be drafts, including logistics, filming arrangements, and approvals, based on their interpretation of the exclusion criteria. This led to an incomplete initial search. Following the OIC's intervention, ISC located an additional 1,087 pages of records. The Commissioner found that while the appropriate offices were tasked, the initial removal of records based on an incorrect interpretation of "drafts" rendered the search unreasonable. The complaint was found to be well-founded, and ISC was ordered to process the newly found records and provide a supplementary response.

• Whether Indigenous Services Canada conducted a reasonable search for records
• Whether the institution's interpretation of 'draft copies' exclusion was appropriate

The Office of the Privacy Commissioner of Canada (OPC) investigated complaints against Loblaw Companies Ltd. (Loblaw) regarding its PC Optimum Loyalty Program, focusing on the handling of privacy challenges and the retention of personal information. The investigation found that Loblaw contravened PIPEDA Principle 4.10 by failing to adequately address privacy challenges and respond to account deletion requests in a timely manner, though this issue was resolved during the investigation as Loblaw enhanced its procedures. The OPC also found that Loblaw contravened PIPEDA Principle 4.5.3 by not sufficiently anonymizing personal information retained from closed PC Optimum accounts, meaning there was a serious possibility of re-identification. Loblaw disagreed with this finding but agreed to engage an independent third party to assess its anonymization process and implement recommendations. A preliminary matter regarding requiring physical card holders to create an online account for deletion was found not well-founded. The overall outcome reflects a mix of resolved and conditionally resolved well-founded findings.

• Whether Loblaw adequately addresses privacy challenges raised by individuals concerning account deletion (PIPEDA Principle 4.10)
• Whether Loblaw retains personal information of PC Optimum members for longer than necessary after account closure (PIPEDA Principle 4.5.3)
• Whether Loblaw collected unnecessary personal information by requiring physical card holders to create an online account to delete their PC Optimum account (PIPEDA Principle 4.4)
• Whether Loblaw established retention schedules for customer support logs (PIPEDA Principle 4.5.2)
• Whether Loblaw retains universal login credentials (PCids) for longer than necessary for members with no other associated accounts (PIPEDA Principle 4.5.3)
• Whether Loblaw's anonymization process for retained Historical Transaction Data, Loyalty Data, and Usage Data ensures no serious possibility of re-identification
• Whether Loblaw's retention of public IP address data after account closure is sufficiently anonymized
• Whether Loblaw's practice of retaining email domain portions after account closure is sufficiently anonymized
• Whether manual processing errors in Loblaw's de-identification process were adequately detected and addressed
• Whether Loblaw ensured identifiers were removed from back-up systems as part of its anonymization process
• Whether Loblaw considered the impact of other factors affecting re-identification risk, such as separately retained PCid data

An inmate complained that Correctional Service Canada (CSC) failed to retain video footage of use of force incidents involving them, which they requested access to under the Privacy Act. CSC's policy was to retain relevant footage for two years, but otherwise, it was automatically deleted after six days. The OPC's investigation found that CSC had disposed of footage that it was obligated to retain under Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations. This failure meant the complainant could not access the sensitive recordings. The OPC recommended that CSC ensure all relevant footage is retained for the prescribed two-year period. CSC agreed to monthly attestations from the institution and quarterly random audits across its Pacific Region, with findings reported to the OPC. The complaint was found to be well-founded and conditionally resolved.

• Whether CSC failed to retain personal information used for an administrative purpose as required by Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations
• Whether the complainant was denied a reasonable opportunity to obtain access to their personal information due to non-retention

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under subsections 16(2) and 19(1) of the Access to Information Act. The request sought records concerning a meeting between Clerk John Hannaford and the official languages commissioner. The Commissioner found that PCO appropriately applied subsection 16(2) to a phone number, concluding that its disclosure could reasonably facilitate the commission of an offence and that PCO's exercise of discretion was reasonable. However, the Commissioner determined that PCO improperly applied subsection 19(1) to a signature and two initials, as PCO failed to demonstrate why this information, used in the performance of official duties, was not excluded from the definition of personal information by paragraph 3(j) of the Privacy Act. The Office of the Privacy Commissioner concurred with this assessment. Despite being given an opportunity to release the information informally, PCO did not respond. The Commissioner ordered PCO to disclose the signature and initials, which PCO ultimately agreed to do after obtaining consent from the individuals involved, while still maintaining its disagreement with the Commissioner's position.

• Whether the disclosure of a phone number could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether the institution reasonably exercised its discretion in applying s.16(2) ATIA
• Whether a signature and initials on official documents constitute personal information under s.19(1) ATIA
• Whether the signature and initials are excluded from the definition of personal information by paragraph 3(j) of the Privacy Act
• Whether the institution sufficiently justified the application of s.19(1) ATIA