Canadian privacy & access decisions

An institution applied to the Information Commissioner for approval to decline processing an access request, arguing it was an abuse of the right of access. The Commissioner agreed, finding that the institution had demonstrated the request was an abuse of access rights and that declining to act was warranted. Consequently, the application was granted.

• Whether the access request constituted an abuse of the right of access.

The complainant alleged that Library and Archives Canada (LAC) took an unreasonably long extension of time to respond to a request for RCMP records concerning Project Anecdote. LAC claimed an extension of over 65 years, citing the large volume of records (780,000 pages) requiring digitization and review, as well as consultations. The Information Commissioner found that LAC failed to demonstrate the reasonableness of the extension, as it did not justify the calculation method, the sole reliance on one employee, or the concurrent nature of tasks. Therefore, the extension was deemed invalid and LAC was considered to have refused access.

• Reasonableness of time extension under subsection 9(1)(a) due to volume of records
• Reasonableness of time extension under subsection 9(1)(b) due to consultations
• Calculation of extension based on specific tasks and resources
• LAC's failure to demonstrate that the extension was for the shortest possible duration

The complainant alleged that Ingenium improperly withheld records related to an exhibit loan under several Access to Information Act provisions. During the investigation, Ingenium decided to no longer rely on some exemptions and agreed to disclose more information. The Commissioner found that photographs withheld under section 14 (federal-provincial affairs) and paragraph 68(c) (material placed by others) were not properly excluded or exempted. The Commissioner ordered Ingenium to disclose the records.

• Whether photographs were properly excluded under paragraph 68(c) of the ATIA.
• Whether photographs were properly exempted under section 14 of the ATIA (federal-provincial affairs).
• The application of the ATIA versus Quebec privacy legislation and Charter values.
• The interpretation of "material placed by others" under paragraph 68(c).

The OPC investigated a complaint that the Canada Revenue Agency (CRA) failed to ensure the accuracy of a taxpayer's personal information used for administrative decisions. An imposter used the complainant's compromised CRA My Account to fraudulently receive COVID-19 benefits and Employment Insurance. The investigation found that the CRA's inadequate safeguards allowed unauthorized access and modification, contravening section 6(2) of the Privacy Act. The CRA has since implemented corrective measures.

• Adequacy of safeguards to protect against unauthorized access and modification of personal information.
• Reasonable steps taken by the CRA to ensure the accuracy of personal information used for administrative decisions.
• Timeliness of notification and privacy breach reporting.
• Impact of identity theft on tax reassessments.

The OPC investigated a complaint that Brinks Home failed to implement adequate safeguards, leading to the compromise of customer personal information via its online portal. While the OPC found Brinks Home had failed to adequately protect customer information, the issue was resolved through corrective actions and the subsequent sale of customer accounts. The OPC also determined that Brinks Home was not required to report the breach to the OPC or notify affected individuals because it did not present a real risk of significant harm.

• Adequacy of safeguards for personal information
• Compliance with mandatory breach reporting requirements
• Assessment of real risk of significant harm (RROSH)
• Employee error leading to unauthorized access

The Office of the Privacy Commissioner of Canada investigated a complaint from a federal government employee who alleged that her personal information was repeatedly disclosed to another employee with the same name, and that administrative errors occurred in their files. The OPC found that the institution contravened the Privacy Act by improperly disclosing the complainant's personal information and by failing to ensure the accuracy of information used for administrative purposes. The complaint was found to be well-founded but conditionally resolved after the institution committed to implementing corrective measures.

• Unauthorized disclosure of personal information under section 8 of the Privacy Act.
• Failure to ensure the accuracy and completeness of personal information used for administrative purposes under subsection 6(2) of the Privacy Act.
• Lack of employee awareness regarding privacy breach reporting procedures.
• Systemic nature of errors due to employees having the same name.

The complainant alleged that the 1,000-day time extension taken by Health Canada to respond to an access request was unreasonable. The request concerned information about an application for religious exemption to serve ayahuasca. Health Canada claimed the extension was necessary due to the large volume and complexity of the records, which required extensive internal consultations. The Commissioner found that Health Canada met the requirements for claiming the extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act. Therefore, the complaint was determined not to be well founded.

• Reasonableness of a 1,000-day time extension claimed by Health Canada
• Whether the large volume of records unreasonably interfered with Health Canada's operations
• Whether necessary consultations could reasonably be completed within 30 days
• Whether the duration of the extension was reasonable under the circumstances

The complainant alleged that the Canada Border Services Agency (CBSA) did not conduct a reasonable search for records concerning cybersecurity and data breach risks associated with the ArriveCan application. The complainant specifically questioned the absence of information related to certain companies and expenses. The Office of the Information Commissioner (OIC) investigated CBSA's search process and concluded that the relevant branch searched appropriate repositories and provided responsive records. Therefore, the OIC found the search to be reasonable and the complaint not well-founded.

• Whether the institution conducted a reasonable search for records.
• Definition of a reasonable search under the Access to Information Act.
• Adequacy of search efforts by the Information, Science and Technology Branch.