Canadian privacy & access decisions

The complainant alleged that National Defence (DND) failed to respond to an access request within the statutory 30-day period, as required by section 7 of the Access to Information Act. The request sought records related to Dr. Ross Harvey's review of Suffield Experimental Station/Defence Research Establishment Suffield reports, specifically his recommendations and their implementation by DRES management. DND extended the response period by 120 days, making the new deadline August 31, 2023, but failed to respond by this date. The investigation found that DND did not meet its obligation, leading to a deemed refusal of access under subsection 10(3) of the Act. The Commissioner noted ongoing internal discussions within DND regarding severances, which delayed the processing and release of records. The Commissioner concluded that DND's lack of responsiveness contravened its obligations and undermined the access system. The complaint was found to be well founded, and DND was ordered to complete the retrieval of records and provide a full response.

• Whether National Defence responded to the access request within the statutory time limits under section 7 of the ATIA
• Whether National Defence's extension of the response period under paragraph 9(1)(a) was properly followed
• Whether National Defence is deemed to have refused access under subsection 10(3) due to failure to respond
• Whether National Defence's ongoing internal review processes justified the delay in responding

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence related to a specific standing offer and company. PHAC extended the response time by 255 days, citing subsections 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner investigated whether the extension under 9(1)(a) was reasonable, noting that PHAC initially identified 2,962 pages, later corrected to 1,805 pages. While acknowledging the volume and potential interference with operations, the Commissioner found that PHAC failed to justify the reasonableness of the 180-day extension taken under 9(1)(a), particularly regarding its estimated review rate of 500 pages per 30 days. Consequently, the Commissioner concluded that the extension was invalid, and PHAC was deemed to have refused access under subsection 10(3) of the Act. The complaint was found to be well founded, and PHAC was ordered to provide a complete response within 60 business days.

• Whether the extension of time taken under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the request was for a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period under paragraph 9(1)(a)
• Whether the institution provided convincing explanation for its estimated monthly review rate of 500 pages
• Whether the institution applied sufficient rigour and logic in determining the duration of the extension
• Whether the institution is deemed to have refused access under subsection 10(3)

The complainant alleged that Housing, Infrastructure and Communities Canada (Infrastructure Canada) improperly withheld information under subsections 19(1), 20(1)(b), 20(1)(c), and 24(1) of the Access to Information Act. The request sought payment documents from Signature on the Saint Lawrence Group (SSLG) to Infrastructure Canada. During the investigation, the complainant narrowed the scope, no longer requiring investigation into GST/PST numbers, banking information, and information withheld under subsection 19(1). The Commissioner found that Infrastructure Canada and SSLG successfully demonstrated that information related to pricing and contractual relationships met the requirements of paragraph 20(1)(c). However, they failed to justify the withholding of other information under paragraphs 20(1)(b), 20(1)(c), or subsection 24(1). The Commissioner ordered Infrastructure Canada to disclose the remaining information, excluding that related to pricing and contractual relationships. Infrastructure Canada agreed to implement the order, and the complaint was found to be well founded.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(c) financial impact on a third party was properly withheld
• Whether s.24(1) disclosure restricted by another law was properly withheld
• Whether disclosure of financial information provides insight into pricing and contractual relationships
• Whether disclosure of financial information would give SSLG’s competitors an advantage
• Whether the argument that disclosure could be seen negatively by project owners on future bids was speculative
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential by an objective standard under s.20(1)(b)
• Whether the information was supplied by a third party to a government institution under s.20(1)(b)
• Whether the third party has consistently treated the information as confidential under s.20(1)(b)
• Whether the content of the record is not available from sources otherwise accessible to the public
• Whether the information originates and is communicated in a reasonable expectation of confidence
• Whether the information was communicated in a relationship between government and the third party that is either a fiduciary relationship or one that is not contrary to the public interest, and that will be fostered for the public benefit by confidential communication
• Whether the confidentiality clause in the Project Agreement is determinative for objective confidentiality
• Whether the information contained within the invoices was supplied by a third party to Infrastructure Canada
• Whether section 295 of the Excise Tax Act applies to the Procurement Business Number under s.24(1)

The complainant alleged that National Defence (DND) took an unreasonable extension of time to respond to an access request for information related to military equipment, weaponry, and ammunition sent to Ukraine from 2019 to 2022. DND initially extended the response time by 3,210 days, citing the large volume of records and interference with operations. The Commissioner found that while the request involved a large number of records and would interfere with operations, DND did not demonstrate that the extended period was reasonable, as it lacked sufficient rigor in its calculation and planned consecutive, rather than concurrent, processing steps. Consequently, DND was deemed to have refused access to the records. During the investigation, the complainant narrowed the scope of the request, reducing the record count by approximately 20,000 pages. DND then indicated it could respond within six months, which the complainant found acceptable. The Commissioner ordered DND to provide a complete response by November 25, 2024, and DND agreed to implement the order.

• Whether the extension of time taken by National Defence under subsection 9(1) of the Access to Information Act was unreasonable
• Whether the access request was for a large number of records or required searching through a large number of records under paragraph 9(1)(a)
• Whether meeting the 30-day time limit would unreasonably interfere with the institution’s operations under paragraph 9(1)(a)
• Whether the extension of time was for a reasonable period, having regard to the circumstances, under paragraph 9(1)(a)
• Whether National Defence was deemed to have refused access to the requested records pursuant to subsection 10(3)

The complainant alleged that the Impact Assessment Agency of Canada (IAAC) took an unreasonable extension of time to respond to an access request for communications related to designated projects in Western Canada. IAAC had extended the response time by 880 days, citing paragraphs 9(1)(a), (b), and (c) of the Access to Information Act. The Commissioner found that while the request involved a large volume of records, IAAC failed to demonstrate that the 820-day extension taken under paragraph 9(1)(a) was reasonable, particularly regarding its estimated monthly review rate. Consequently, the Commissioner concluded that IAAC was deemed to have refused access under subsection 10(3) of the Act. The Commissioner ordered IAAC to provide a complete response to the access request by April 23, 2025. IAAC's President confirmed that the agency would implement the order, outlining steps to increase processing capacity and optimize ATIP processes.

• Whether the extension of time taken under s.9(1)(a) was for a reasonable period
• Whether the request was for a large number of records
• Whether meeting the 30-day deadline would unreasonably interfere with the institution’s operations
• Whether the institution is deemed to have refused access under s.10(3)

The complainant alleged that the Canada Border Services Agency (CBSA) improperly withheld the complete source code for the ArriveCAN application under subsection 16(2) of the Access to Information Act. CBSA argued that disclosing the source code could reasonably be expected to facilitate the commission of an offence by allowing malicious actors to hack the application, impersonate it, or expose security vulnerabilities, thereby risking personal information. The OIC found that at the time of the request in September 2022, when ArriveCAN was mandatory and collected sensitive personal data, the disclosure of the source code could indeed facilitate an offence. The Commissioner also concluded that CBSA reasonably exercised its discretion by weighing the public interest in disclosure against the risks. Furthermore, the OIC accepted CBSA's argument that severance of the source code was not reasonable due to the unknown locations of potential vulnerabilities. Consequently, the complaint was deemed not well founded.

• Whether disclosure of the ArriveCAN source code could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether CBSA reasonably exercised its discretion in deciding not to disclose the information under s.16(2) ATIA
• Whether severance of the source code was reasonable under s.25 ATIA

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld their DNA profile, generated from a biological sample, under subsection 24(1) of the Access to Information Act. The RCMP argued that section 6.6 of the DNA Identification Act, which is listed in Schedule II of the Access to Information Act, prohibits the disclosure of information contained in the DNA data bank. The Commissioner found that the DNA Identification Act indeed restricts the communication of such information, except in specific, limited circumstances not applicable to an access to information request. Therefore, the Commissioner concluded that the RCMP correctly applied subsection 24(1) to withhold the complainant's DNA profile. The complaint was found to be not well founded.

• Whether the information requested (complainant's DNA profile) is subject to subsection 24(1) of the Access to Information Act
• Whether section 6.6 of the DNA Identification Act prohibits the disclosure of the requested information
• Whether the DNA Identification Act is listed in Schedule II of the Access to Information Act