Canadian privacy & access decisions

The complainant alleged that the Office of the Auditor General of Canada (OAG) improperly determined that witness statements and documentation supporting a harassment investigation final report were not under its control, thus denying access. The OIC investigated whether the records, though not in the OAG's physical possession, were under its control according to the Supreme Court's interpretation of the Access to Information Act. The OIC considered several factors, including whether the records related to an institutional matter, if the OAG had a legally enforceable right to access them, and if communication of their content required OAG authorization. The OIC found that the records were indeed under the OAG's control. Consequently, the OAG retrieved and processed the records, issuing an interim release to the complainant, who expressed satisfaction. The complaint was found to be well founded.

• Whether records not in physical possession of the institution are under its control
• Whether the records relate to an institutional matter
• Whether the institution has a legally enforceable right of access to the records
• Whether the communication of the content of the records requires the authorization of an officer or employee of an institution
• Whether the institution relied on the records when preparing other government records
• Whether a senior official of the institution should reasonably expect to obtain a copy of the records upon request

The complainant alleged that the Federal Economic Development Agency for Southern Ontario (FedDev Ontario) improperly withheld information under subsections 19(1), 20(1)(b), 20(1)(c), and 20(1)(d) of the Access to Information Act. The request sought information related to funding applications from The Corporation of the Town of Niagara-on-the-Lake. During the investigation, the complainant narrowed the scope, no longer requiring investigation into s.19(1) or specific financial columns for non-funded third parties. The OIC sought representations from FedDev Ontario and relevant third parties, but neither provided evidence to support the applied exemptions. The Commissioner found that the institution failed to demonstrate that the information met the requirements for confidentiality, that it was 'supplied' by a third party, or that disclosure would cause a reasonable expectation of harm to financial interests or negotiations. Consequently, the complaint was found to be well founded, and FedDev Ontario was ordered to disclose the withheld information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether the information was financial, commercial, scientific or technical
• Whether the information was confidential
• Whether the information was supplied by a third party
• Whether the third party consistently treated the information as confidential
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether disclosure could result in material financial loss or gain to the third party
• Whether there was a reasonable expectation of harm under s.20(1)(c)
• Whether s.20(1)(d) interference with contractual or other negotiations of a third party exemption was properly applied
• Whether a third party is or will be conducting contractual or other negotiations
• Whether disclosure could interfere with those negotiations
• Whether there was a reasonable expectation of harm under s.20(1)(d)

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to conduct a reasonable search for records related to pay equity for unionized CSIS employees. The request sought communications between CSIS and other federal government departments and agencies on this topic. CSIS initially searched its Human Resource Compensation Branch but refused to search its Departmental Legal Services Unit (DLSU), arguing that DLSU records were under the control of the Department of Justice, not CSIS. The Office of the Information Commissioner found that CSIS's refusal to task its DLSU was premature and that records physically located with the DLSU could still be under CSIS's control, especially given the solicitor-client relationship and the subject matter relating directly to CSIS's mandate. The Commissioner concluded that CSIS failed to conduct a reasonable search by not retrieving and reviewing these records to determine control. The complaint was found to be well founded, and the Commissioner recommended that CSIS retrieve, review, and respond to the records from its DLSU, but CSIS declined to implement the recommendations.

• Whether CSIS conducted a reasonable search for records
• Whether records physically located with CSIS's Departmental Legal Services Unit (DLSU) are under the control of CSIS
• Whether CSIS's refusal to task its DLSU for records constitutes a failure to conduct a reasonable search

A truck driver complained that Trimac Transportation Services Inc. (Trimac) installed a dash camera in his vehicle that continuously recorded audio and video without his consent, particularly concerned with audio recording. The OPC investigated two main issues: the appropriateness of the audio recording functionality and whether employee consent was required. The OPC found that Trimac's continuous audio recording, even when drivers were off-duty, was disproportionately privacy-intrusive, despite legitimate business needs. Trimac also initially failed to be transparent about the disciplinary purposes of the system, meaning it could not rely on the employment relationship exception to consent. Trimac agreed to implement recommendations to limit audio recording to on-duty hours and restrict access to recorded clips, and has since clarified the system's disciplinary uses to employees. The OPC found the audio recording issue well-founded and conditionally resolved, and the consent issue well-founded and resolved.

• Whether road safety, asset protection, and employee performance management are appropriate purposes for the continuous collection of in-cabin audio via the System, including when drivers are off-duty and not driving, under subsection 5(3) of PIPEDA.
• Whether the collection of sensitive personal information (in-cabin audio) was justified given the legitimate need, effectiveness, less privacy-invasive means, and proportionality.
• Whether employee consent was required for the collection of personal information via the System, specifically whether Trimac could rely on the exception to consent under subsection 7.3 of PIPEDA.
• Whether Trimac was sufficiently transparent about the disciplinary purposes of its dash camera system to rely on the subsection 7.3 exception to consent.

The complainant alleged that Export Development Canada (EDC) improperly withheld information related to financial assistance provided to Canadian companies in Honduras. The request sought a summary of all financial assistance over $50,000 from 2009 to 2019. EDC claimed exemptions under subsections 18.1(1) (confidential financial, commercial, scientific or technical information of EDC) and 24(1) (disclosure restricted by another law) of the Access to Information Act. The Information Commissioner found that EDC failed to demonstrate that the information "belonged to" it for the purpose of s.18.1(1), as it was shared with and retained by customers. For s.24(1), EDC invoked section 24.3 of the Export Development Act, but the Commissioner determined that the information was "created" by EDC, not "obtained" by it, thus falling outside the scope of the exemption. The Commissioner ordered EDC to disclose policy types, policy numbers, and maximum liability amounts. EDC partially implemented the order, disclosing only policy types, and indicated its intention to seek a Federal Court review regarding the interpretation of the Export Development Act.

• Whether the information "belongs to" EDC for the purpose of s.18.1(1) ATIA
• Whether EDC consistently treated the information as confidential for the purpose of s.18.1(1) ATIA
• Whether the information was "obtained by" EDC or "created by" EDC for the purpose of s.24.3(1) of the Export Development Act
• Whether the information falls under s.24(1) ATIA due to s.24.3(1) of the Export Development Act

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld information related to the "Autopsy of a Murder" exhibit under several sections of the Access to Information Act. The withheld records included contracts, photographs, and inventory lists. The institution claimed exemptions under paragraphs 18(b) and 18(d) for competitive position and financial interests, subsection 19(1) for personal information, and paragraphs 20(1)(c) and 20(1)(d) for third-party financial impact and negotiations. The Commissioner found that the institution failed to provide sufficient evidence to demonstrate a reasonable expectation of harm for the exemptions under section 18 and 20. Regarding subsection 19(1), the Commissioner determined that the photographs of human remains either did not identify an individual or related to individuals deceased for over 20 years, thus not qualifying as personal information. The complaint was found to be well-founded, and the Commissioner ordered the disclosure of all information at issue.

• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.18(d) ATIA (government financial interests, undue benefit to an individual) was properly applied
• Whether s.19(1) ATIA (personal information) was properly applied to photographs of human remains
• Whether s.19(1) ATIA (personal information) was properly applied to signatures (removed from scope)
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied
• Whether s.20(1)(d) ATIA (negotiations by a third party) was properly applied
• Whether the Coroner's office had a right to make representations as a third party under s.35(2)(c) ATIA

On November 30, 2018, Marriott International, Inc. announced a data security breach involving unauthorized access to a Starwood Hotels database, which it had acquired in 2016. The breach, spanning over four years, affected up to 12.8 million Canadian records, including passport and payment card details. The OPC launched an investigation into Luxury Hotels Canada, Marriott's Canadian operating company, following eleven complaints. The investigation found Marriott's security safeguards, accountability measures, and information retention practices to be inadequate, contravening PIPEDA Principles 4.7, 4.1.4, and 4.5. Specifically, Marriott failed to detect the breach sooner due to insufficient logging, monitoring, and multi-factor authentication, and retained personal information longer than necessary. While Marriott's notification to affected individuals was deemed adequate, the OPC had outstanding concerns regarding remote access, unencrypted data storage, and retention periods. The findings are well-founded and conditionally resolved, as Marriott committed to implementing the OPC's recommendations, including engaging an external assessor and reviewing its privacy framework.

• Whether personal information held by Marriott was protected by security safeguards appropriate to the sensitivity of the information as required by Principle 4.7 (Safeguards).
• Whether Marriott demonstrated due diligence and took steps to fulfil its responsibilities to implement policies and practices to protect personal information under Principle 4.1.4 (Accountability) when acquiring control of the Starwood network.
• Whether Marriott retained personal information for longer than necessary, relevant to Principle 4.5 (Limiting use, disclosure and retention).
• Whether the mitigation measures offered by Marriott to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with Principle 4.7 (Safeguards).

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information under paragraphs 18(b) and 19(1) of the Access to Information Act. The request sought documents detailing the total remuneration of the 250 highest-paid unionized employees of CBC's French services for two fiscal years. The CBC withheld approximately 25 exact individual salaries per fiscal year, citing paragraph 18(b) related to competitive position. The investigation found that disclosing these specific salaries could reasonably injure the CBC's competitive position in the limited and competitive French broadcasting market, as it could be used in salary negotiations and impact employee retention. The Commissioner concluded that the CBC properly applied paragraph 18(b) and reasonably exercised its discretion by balancing its mandate with the need to manage resources in a competitive market. Given the applicability of paragraph 18(b), the Commissioner did not assess the application of subsection 19(1). The complaint was therefore not well founded.

• Whether s.18(b) ATIA (competitive position) was properly applied to withhold exact individual salaries
• Whether disclosing the information could reasonably be expected to injure the competitive position of the institution
• Whether the institution reasonably exercised its discretion in deciding to withhold the information under s.18(b)
• Whether s.19(1) ATIA (personal information) was properly applied to withhold exact individual salaries

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Advanced Access to Information and Privacy consultant. ESDC had withheld portions of the records under various exemptions, including personal information (s.19(1)), third-party financial harm (s.20(1)(c)), consultations or deliberations (s.21(1)(b)), solicitor-client privilege (s.23), and statutory prohibitions (s.24(1)). The Commissioner found that ESDC improperly applied s.19(1) to certain information in a consultant's CV related to their position, function, and responsibilities, as this fell under exceptions to the definition of personal information. ESDC also failed to demonstrate reasonable efforts to seek consent for the release of other personal information. For s.20(1)(c), the Commissioner found that ESDC and third parties did not provide sufficient evidence to support the exemption for most of the withheld contract details, except for hourly rates. Regarding s.21(1)(b), ESDC failed to show that some withheld information constituted accounts of consultations or deliberations. The Commissioner upheld ESDC's application of s.23 and s.24(1). The complaint was found to be well founded, and ESDC was ordered to disclose the improperly withheld information and to make reasonable efforts to seek consent for other personal information.

• Whether s.19(1) ATIA (personal information) was properly applied to information in a consultant's CV related to position, function, and responsibilities
• Whether information related to position, function, and responsibilities falls under exceptions to the definition of personal information (Privacy Act s.3(j) and s.3(k))
• Whether ESDC made reasonable efforts to seek consent for the release of personal information under s.19(2)(a) ATIA
• Whether ESDC reasonably exercised discretion under s.19(2)(b) ATIA regarding publicly available personal information
• Whether ESDC reasonably exercised discretion under s.19(2)(c) ATIA regarding public interest in disclosure of personal information
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to hourly rates
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to names and details of candidates
• Whether s.20(1)(c) ATIA (financial impact on a third party) was properly applied to contract details (number of hours, days per week, maximum value of amendments, reference to third-party contract)
• Whether there was a reasonable expectation of material financial loss or harm to competitive position under s.20(1)(c) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied to specific pages of records
• Whether information withheld under s.21(1)(b) constituted factual information
• Whether ESDC reasonably exercised discretion under s.21(1)(b) ATIA
• Whether s.23 ATIA (solicitor-client and litigation privilege) was properly applied
• Whether ESDC reasonably exercised discretion under s.23 ATIA
• Whether s.24(1) ATIA (disclosure restricted by another law) was properly applied to supplier business numbers under s.241 of the Income Tax Act

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 16 projects related to 12 third parties under paragraph 20(1)(c) of the Access to Information Act. ISED and several third parties argued that disclosure could lead to material financial impact or harm competitive position. The Commissioner found that neither ISED nor the third parties demonstrated a clear and direct connection between the disclosure of the specific repayment figures and a reasonable expectation of harm. The Commissioner also considered, but rejected, the applicability of paragraph 20(1)(d) for one third party, finding insufficient evidence of interference with negotiations. Consequently, the Commissioner ordered ISED to disclose all the withheld "Repayments to Date" figures. ISED agreed to implement the order.

• Whether s.20(1)(c) ATIA (financial impact on a third party or harm to competitive position) was properly applied to "Repayments to Date" figures
• Whether there was a clear and direct connection between disclosure and a risk of harm well beyond the merely possible for s.20(1)(c)
• Whether s.20(1)(d) ATIA (interference with contractual or other negotiations of a third party) was properly applied to "Repayments to Date" figures
• Whether there was a clear and direct connection between disclosure and a risk of harm well beyond the merely possible for s.20(1)(d)