Canadian privacy & access decisions

An anonymous applicant complained that Public Services and Procurement Canada (PSPC) improperly withheld information under paragraphs 18(b) and 20(1)(b) of the Access to Information Act. The request sought annual rent figures for leases exceeding $500,000 signed by PSPC in specific cities between 2018 and 2022. PSPC and several third parties argued that disclosure would harm PSPC's competitive position and negotiations, and constitute confidential third-party financial information, also suggesting paragraphs 20(1)(c) and 20(1)(d). The Commissioner found PSPC's and the third parties' arguments for all claimed exemptions to be speculative, failing to demonstrate a reasonable expectation of probable harm or objective confidentiality. Specifically, the rent figures were not considered "supplied by" the third parties for the purpose of s.20(1)(b). Consequently, the complaint was found to be well founded, and the Commissioner ordered PSPC to disclose the records in full. PSPC subsequently gave notice that it would comply with the order.

• Whether PSPC improperly withheld information under paragraph 18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to harm the competitive position of PSPC under s.18(b) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with contractual or other negotiations of PSPC under s.18(b) ATIA
• Whether PSPC's representations on harm under s.18(b) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(b) ATIA
• Whether annual rent figures constitute financial, commercial, scientific or technical information under s.20(1)(b) ATIA
• Whether annual rent figures are confidential by an objective standard under s.20(1)(b) ATIA
• Whether annual rent figures are publicly available
• Whether the circumstances give rise to a reasonable expectation that annual rent figures would not be disclosed
• Whether the relationship between PSPC and third parties would be fostered for public benefit by confidentiality of annual rent figures
• Whether annual rent figures were "supplied by" the third party to PSPC under s.20(1)(b) ATIA
• Whether third parties consistently treated annual rent figures as confidential under s.20(1)(b) ATIA
• Whether PSPC improperly withheld information under paragraph 20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to result in material financial loss or gain to a third party under s.20(1)(c) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to prejudice a third party's competitive position under s.20(1)(c) ATIA
• Whether third parties' representations on harm under s.20(1)(c) were speculative
• Whether PSPC improperly withheld information under paragraph 20(1)(d) ATIA
• Whether disclosure of annual rent figures could reasonably be expected to interfere with the contractual or other negotiations of a third party under s.20(1)(d) ATIA
• Whether third parties' representations on interference under s.20(1)(d) were speculative
• Whether the complaint was well founded under s.30(1)(a) ATIA
• Whether an order for disclosure should be issued under s.36.1 ATIA

The complainant alleged that Indigenous Services Canada (ISC) failed to conduct a reasonable search for records related to a video posted on Facebook. The request specifically excluded draft copies, media articles, and French records where English equivalents existed. During the investigation, it was discovered that ISC's Communications and Public Affairs unit had removed records deemed to be drafts, including logistics, filming arrangements, and approvals, based on their interpretation of the exclusion criteria. This led to an incomplete initial search. Following the OIC's intervention, ISC located an additional 1,087 pages of records. The Commissioner found that while the appropriate offices were tasked, the initial removal of records based on an incorrect interpretation of "drafts" rendered the search unreasonable. The complaint was found to be well-founded, and ISC was ordered to process the newly found records and provide a supplementary response.

• Whether Indigenous Services Canada conducted a reasonable search for records
• Whether the institution's interpretation of 'draft copies' exclusion was appropriate

The Office of the Privacy Commissioner of Canada (OPC) investigated complaints against Loblaw Companies Ltd. (Loblaw) regarding its PC Optimum Loyalty Program, focusing on the handling of privacy challenges and the retention of personal information. The investigation found that Loblaw contravened PIPEDA Principle 4.10 by failing to adequately address privacy challenges and respond to account deletion requests in a timely manner, though this issue was resolved during the investigation as Loblaw enhanced its procedures. The OPC also found that Loblaw contravened PIPEDA Principle 4.5.3 by not sufficiently anonymizing personal information retained from closed PC Optimum accounts, meaning there was a serious possibility of re-identification. Loblaw disagreed with this finding but agreed to engage an independent third party to assess its anonymization process and implement recommendations. A preliminary matter regarding requiring physical card holders to create an online account for deletion was found not well-founded. The overall outcome reflects a mix of resolved and conditionally resolved well-founded findings.

• Whether Loblaw adequately addresses privacy challenges raised by individuals concerning account deletion (PIPEDA Principle 4.10)
• Whether Loblaw retains personal information of PC Optimum members for longer than necessary after account closure (PIPEDA Principle 4.5.3)
• Whether Loblaw collected unnecessary personal information by requiring physical card holders to create an online account to delete their PC Optimum account (PIPEDA Principle 4.4)
• Whether Loblaw established retention schedules for customer support logs (PIPEDA Principle 4.5.2)
• Whether Loblaw retains universal login credentials (PCids) for longer than necessary for members with no other associated accounts (PIPEDA Principle 4.5.3)
• Whether Loblaw's anonymization process for retained Historical Transaction Data, Loyalty Data, and Usage Data ensures no serious possibility of re-identification
• Whether Loblaw's retention of public IP address data after account closure is sufficiently anonymized
• Whether Loblaw's practice of retaining email domain portions after account closure is sufficiently anonymized
• Whether manual processing errors in Loblaw's de-identification process were adequately detected and addressed
• Whether Loblaw ensured identifiers were removed from back-up systems as part of its anonymization process
• Whether Loblaw considered the impact of other factors affecting re-identification risk, such as separately retained PCid data

An inmate complained that Correctional Service Canada (CSC) failed to retain video footage of use of force incidents involving them, which they requested access to under the Privacy Act. CSC's policy was to retain relevant footage for two years, but otherwise, it was automatically deleted after six days. The OPC's investigation found that CSC had disposed of footage that it was obligated to retain under Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations. This failure meant the complainant could not access the sensitive recordings. The OPC recommended that CSC ensure all relevant footage is retained for the prescribed two-year period. CSC agreed to monthly attestations from the institution and quarterly random audits across its Pacific Region, with findings reported to the OPC. The complaint was found to be well-founded and conditionally resolved.

• Whether CSC failed to retain personal information used for an administrative purpose as required by Subsection 6(1) of the Privacy Act and Paragraph 4(1)(a) of the Privacy Regulations
• Whether the complainant was denied a reasonable opportunity to obtain access to their personal information due to non-retention

The complainant alleged that the Privy Council Office (PCO) improperly withheld information under subsections 16(2) and 19(1) of the Access to Information Act. The request sought records concerning a meeting between Clerk John Hannaford and the official languages commissioner. The Commissioner found that PCO appropriately applied subsection 16(2) to a phone number, concluding that its disclosure could reasonably facilitate the commission of an offence and that PCO's exercise of discretion was reasonable. However, the Commissioner determined that PCO improperly applied subsection 19(1) to a signature and two initials, as PCO failed to demonstrate why this information, used in the performance of official duties, was not excluded from the definition of personal information by paragraph 3(j) of the Privacy Act. The Office of the Privacy Commissioner concurred with this assessment. Despite being given an opportunity to release the information informally, PCO did not respond. The Commissioner ordered PCO to disclose the signature and initials, which PCO ultimately agreed to do after obtaining consent from the individuals involved, while still maintaining its disagreement with the Commissioner's position.

• Whether the disclosure of a phone number could reasonably be expected to facilitate the commission of an offence under s.16(2) ATIA
• Whether the institution reasonably exercised its discretion in applying s.16(2) ATIA
• Whether a signature and initials on official documents constitute personal information under s.19(1) ATIA
• Whether the signature and initials are excluded from the definition of personal information by paragraph 3(j) of the Privacy Act
• Whether the institution sufficiently justified the application of s.19(1) ATIA

An anonymous applicant complained that Transport Canada improperly withheld records related to a workplace fatality under sections 19(1), 20(1)(b), and 20(1)(c) of the Access to Information Act, and failed to conduct a reasonable search. During the investigation, Transport Canada also invoked sections 16(1)(c) and 16(2), and the reasonable search complaint was resolved. The Commissioner found that most personal information was properly withheld under section 19(1), and Transport Canada's exercise of discretion under section 19(2) was reasonable. However, the Commissioner rejected the application of sections 16(1)(c), 20(1)(c), and 24(1), finding no reasonable expectation of harm or that the information did not meet the exemption criteria. While section 16(2) was upheld for URLs and passwords, Transport Canada failed to demonstrate it had exercised its discretion. Section 20(1)(b) was upheld in part, with significant portions of information ordered disclosed as they did not meet all the exemption's requirements. Consequently, the complaint was found well-founded, and Transport Canada was ordered to disclose specific information and re-exercise its discretion for other records.

• Whether Transport Canada improperly withheld information under s.19(1) ATIA (personal information).
• Whether Transport Canada reasonably exercised its discretion under s.19(2) ATIA regarding personal information.
• Whether Transport Canada improperly withheld information under s.16(1)(c) ATIA (conduct of investigations).
• Whether disclosure of information could reasonably be expected to harm the conduct of lawful investigations under s.16(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.16(2) ATIA (facilitating the commission of an offence).
• Whether Transport Canada reasonably exercised its discretion under s.16(2) ATIA regarding information that could facilitate an offence.
• Whether Transport Canada improperly withheld information under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information).
• Whether the information met the "financial, commercial, scientific or technical" requirement of s.20(1)(b) ATIA.
• Whether the information was "confidential" by an objective standard under s.20(1)(b) ATIA.
• Whether the information was "supplied by" a third party under s.20(1)(b) ATIA.
• Whether the third party "consistently treated the information as confidential" under s.20(1)(b) ATIA.
• Whether Transport Canada improperly withheld information under s.20(1)(c) ATIA (financial impact on a third party).
• Whether disclosure could reasonably be expected to result in material financial loss or gain to the third party under s.20(1)(c) ATIA.
• Whether disclosure could reasonably be expected to injure the competitive position of the third party under s.20(1)(c) ATIA.
• Whether Transport Canada improperly withheld information under s.24(1) ATIA (disclosure restricted by another law).
• Whether the information related to a "secret process or trade secret" under s.24(1) ATIA.
• Whether Transport Canada conducted a reasonable search for records.

The Office of the Privacy Commissioner (OPC) received complaints regarding the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees. These disclosures occurred when HR-generated spreadsheets, intended for specific operational purposes like shift scheduling, contained excessive personal data or were shared with unauthorized employees. The CBSA's internal investigation uncovered four additional similar breaches. The OPC found that these incidents contravened section 8 of the Privacy Act regarding disclosure limitations. However, the CBSA took appropriate steps to notify affected individuals, contain the impact of the breaches, and implement both short-term and long-term measures to prevent recurrence, including new data request procedures and a future information management system. Consequently, the complaints were deemed well-founded and resolved.

• Whether the CBSA's disclosure of employee personal information via spreadsheets contravened section 8 of the Privacy Act
• Whether the inclusion of excess information in spreadsheets constituted unauthorized disclosure
• Whether the use of personal email addresses for work-related data sharing contravened the Privacy Act
• Whether the CBSA took adequate steps to address the incidents, including notification to affected individuals
• Whether the CBSA's measures to reduce the risk of recurrence were reasonable

An anonymous applicant complained that the Privy Council Office (PCO) improperly withheld records related to meetings of the Joint Intelligence Committee and Intelligence Advisory Committee from 1972. PCO initially claimed exemptions under subsections 13(1), 15(1), 16(1)(a), 16(1)(b), 16(1)(c), and 19(1) of the Access to Information Act. During the investigation, PCO conceded that some exemptions were improperly applied and released additional information, and the complainant narrowed the scope of the complaint. The Information Commissioner found that PCO failed to demonstrate that most of the remaining withheld information met the requirements for exemption under subsections 13(1) and 15(1), often citing a lack of evidence for confidentiality or a reasonable expectation of harm, especially given the historical nature and public availability of similar records. For a British Joint Intelligence Committee Draft Paper title, while s.13(1) applied, PCO did not reasonably exercise its discretion under s.13(2) as the title was publicly available. Consequently, the Commissioner ordered PCO to disclose numerous pages in their entirety and to re-exercise discretion for specific information. The complaint was found to be well-founded, and PCO agreed to implement the orders.

• Whether information regarding visits of Intelligence Community members from other countries met the requirements of s.13(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.13(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.13(1) ATIA.
• Whether information regarding other specified countries met the requirements of s.13(1) ATIA.
• Whether mention of a conference met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.13(1) ATIA.
• Whether PCO reasonably exercised discretion under s.13(2) ATIA for the title of a British Joint Intelligence Committee Draft Paper.
• Whether information on pages 212 and 215 met the requirements of s.13(1) ATIA.
• Whether the title of a British Joint Intelligence Committee Draft Paper met the requirements of s.15(1) ATIA.
• Whether information regarding the visits of Intelligence Community members from other countries met the requirements of s.15(1) ATIA.
• Whether information concerning the Tripartite Alert Circuit met the requirements of s.15(1) ATIA.
• Whether the titles of liaison officers from other countries met the requirements of s.15(1) ATIA.
• Whether discussion of the Special Research Bureau (SRB) Program Forecast met the requirements of s.15(1) ATIA.
• Whether information regarding other countries (activities, bi-national relationships, threats, UK JIC) met the requirements of s.15(1) ATIA.
• Whether reference to a Joint Intelligence Report met the requirements of s.15(1) ATIA.
• Whether remarks concerning an individual from a foreign country met the requirements of s.15(1) ATIA.
• Whether mention of a conference met the requirements of s.15(1) ATIA.
• Whether PCO improperly withheld information under s.16(1)(a) ATIA.
• Whether PCO improperly withheld information under s.16(1)(b) ATIA.
• Whether PCO improperly withheld information under s.16(1)(c) ATIA.
• Whether PCO improperly withheld information under s.19(1) ATIA.