Canadian Privacy Decisions

The complainant alleged that the Office of the Auditor General of Canada (OAG) had incorrectly stated that witness statements and documentation supporting a harassment investigation report were not under its control. The OIC investigated whether these records were under the OAG's control, considering factors such as whether they related to an institutional matter and if the OAG had a legally enforceable right to access them. Ultimately, the OIC found that the records were indeed under the OAG's control, making the complaint well-founded.

• Determination of 'control' over records not in physical possession of an institution.
• Whether the OAG had a legally enforceable right of access to the investigation records.
• Whether the content of the records required OAG authorization for communication.
• Whether the OAG relied on the records when preparing other government records.

The complainant alleged that the Federal Economic Development Agency for Southern Ontario (FedDev Ontario) improperly withheld information related to funding applications from The Corporation of the Town of Niagara-on-the-Lake. The exemptions cited were for personal information, and confidential third-party financial, commercial, scientific, or technical information, and information affecting third-party negotiations. Neither the institution nor the third parties provided sufficient evidence to justify withholding the information. The Information Commissioner found the complaint well-founded and ordered the release of the records.

• Whether the withheld information met the requirements for exemption under subsection 19(1) (personal information) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(c) (financial impact on a third party) of the ATIA.
• Whether the withheld information met the requirements for exemption under paragraph 20(1)(d) (negotiations by a third party) of the ATIA.

The complainant alleged that the Canadian Security Intelligence Service (CSIS) did not conduct a reasonable search for records related to pay equity for unionized employees. CSIS argued that records held by its Departmental Legal Services Unit (DLSU) were under the control of the Department of Justice. The Information Commissioner found that CSIS had failed to establish it conducted a reasonable search, as records held by its DLSU might be under CSIS's control. The Commissioner recommended CSIS retrieve and review these records, but CSIS refused to implement the recommendations.

• Reasonableness of the search conducted by CSIS
• Determination of 'control' over records held by the Departmental Legal Services Unit
• Relationship between CSIS and the Department of Justice regarding information holdings

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from a Trimac truck driver concerned about audio and video recording in his truck cabin. The OPC found that while Trimac had legitimate safety and asset protection goals, the continuous audio recording was too intrusive, especially when drivers were off-duty. Trimac was also not initially transparent about using the data for disciplinary purposes, failing to meet consent requirements under PIPEDA. Trimac has since implemented changes, limiting audio recording to on-duty hours and improving data access controls. The OPC found the complaint conditionally resolved regarding the intrusive nature of the recording and resolved regarding the consent issue, accepting Trimac's remedial actions.

• Appropriateness of continuous audio recording in truck cabins, including during off-duty hours.
• Whether Trimac provided adequate information about the use of collected data for disciplinary purposes.
• The proportionality of privacy intrusion versus business benefits.
• The requirement for employee consent for data collection in an employment context.

The complainant requested a summary of financial assistance provided by Export Development Canada (EDC) to Canadian companies in Honduras over $50,000 from 2009 to 2019. EDC withheld information under exemptions related to confidential business information and disclosure restricted by another law. The Information Commissioner found that EDC failed to demonstrate that the information belonged to EDC as required for the first exemption and that the information was "obtained by" EDC as required for the second exemption. The Commissioner ordered EDC to disclose policy types, policy numbers, and maximum liability amounts.

• Applicability of exemption s. 18.1(1) (confidential financial, commercial, scientific or technical information of EDC)
• Meaning of "belongs to" in s. 18.1(1) ATIA
• Interpretation of EDC's Disclosure Policy for confidentiality
• Applicability of exemption s. 24(1) (disclosure restricted by another law) citing s. 24.3(1) of the Export Development Act
• Distinction between information "obtained by" and "created by" EDC under s. 24.3(1) of the Export Development Act

The complainant alleged that the Old Port of Montreal Corporation Inc. improperly withheld records related to the loan of objects for an exhibit under several exemptions in the Access to Information Act. The exemptions claimed included those related to competitive advantage, government financial interests, personal information, and third-party financial interests and negotiations. The institution failed to provide sufficient representations to support the application of these exemptions. The OIC found that photographs of human remains could not be withheld under the personal information exemption, as the individuals were either not identifiable or had been deceased for over 20 years. The OIC ordered the disclosure of all information at issue, and the institution agreed to comply.

• Burden of proof for exemptions
• Definition of personal information for deceased individuals
• Adequacy of representations to support exemptions
• Status of the Coroner's office as a third party

Following a data breach involving the Starwood hotel database, the Office of the Privacy Commissioner of Canada (OPC) investigated Marriott International, Inc. The investigation found that Marriott's security safeguards, accountability measures, and information retention practices were inadequate at the time of the breach, leading to unauthorized access to personal information. While Marriott has taken remedial actions and the complaint is conditionally resolved, the OPC highlighted failures in access controls, antivirus software, logging and monitoring, and information storage. The OPC also found Marriott contravened accountability principles by not adequately assessing security risks during its acquisition of Starwood and retaining personal information longer than necessary.

• Adequacy of security safeguards for personal information
• Marriott's accountability and due diligence during the acquisition of Starwood
• Timeliness of information retention and deletion practices
• Adequacy of notification and mitigation measures for affected individuals

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information regarding the total remuneration of its highest-paid unionized employees. The CBC claimed exemptions under paragraph 18(b) (competitive position) for specific salary figures. The Information Commissioner found that disclosing these exact salaries could indeed harm the CBC's competitive position in a limited market, and that the CBC reasonably exercised its discretion in withholding the information. Therefore, the complaint was found not well founded.

• Proper application of paragraph 18(b) of the Access to Information Act
• Reasonable expectation of harm to the institution's competitive position
• Reasonable exercise of discretion by the institution to withhold information

The complainant alleged that Employment and Social Development Canada (ESDC) improperly withheld information related to a contract for an Access to Information consultant. ESDC claimed exemptions for personal information, financial impact on third parties, consultations or deliberations, solicitor-client privilege, and restrictions by other laws. The Information Commissioner found that ESDC improperly withheld information concerning the consultant's job duties and experience, some third-party financial details, and certain accounts of deliberations. The Commissioner ordered ESDC to disclose this information and to re-evaluate consent for some personal information.

• Proper application of subsection 19(1) (personal information)
• Proper application of paragraph 20(1)(c) (financial impact on third party)
• Proper application of paragraph 21(1)(b) (accounts of consultations or deliberations)
• Reasonable exercise of discretion for exemptions

The complainant alleged that Innovation, Science and Economic Development Canada (ISED) improperly withheld "Repayments to Date" figures for 12 third parties under paragraph 20(1)(c) of the Access to Information Act. The institution and several third parties argued that disclosure could harm competitive positions or financial interests. The Information Commissioner found that neither ISED nor the third parties met the burden of proving that disclosure would cause harm beyond the merely possible. The Commissioner ordered ISED to disclose the information.

• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(c) of the ATIA regarding financial impact on a third party.
• Whether the "Repayments to Date" figures met the requirements for exemption under paragraph 20(1)(d) of the ATIA regarding interference with third-party negotiations.
• Whether the third parties or the institution met their burden of proof to demonstrate that disclosure would cause harm beyond the merely possible.
• Whether the disclosure of the information was in the public interest.