Canadian privacy & access decisions

The complainant alleged that National Defence failed to conduct a reasonable search for records related to a selection process for Steward/Command Master Sailor. The Office of the Information Commissioner (OIC) investigation found that not all relevant offices were tasked and the search criteria were unclear. National Defence was ordered to complete the retrieval of all responsive records and provide a new response to the access request.

• Reasonable search
• Completeness of search
• Clarity of tasking for record retrieval

The complainant alleged that Indigenous Services Canada (ISC) did not conduct a reasonable search for records related to the Non-Insured Health Benefits Mental Health Counselling benefit, including a "detailed review" and related proposals and reviews. ISC initially claimed the "detailed review" was verbal and no records existed. However, further investigation revealed ISC had not conducted an adequate search, and a subsequent search located at least 170 pages of responsive documents. The Information Commissioner found the complaint well-founded and ordered ISC to complete the retrieval and processing of all responsive records and provide a new response to the complainant.

• Reasonableness of the search conducted by the institution
• Existence of records for "detailed review" mentioned in an internal briefing note
• Scope and completeness of the search efforts

The complainant alleged that Health Canada improperly withheld records related to Dukoral under various ATIA exemptions, including personal information, third-party commercial information, and solicitor-client privilege. While some exemptions like solicitor-client privilege were upheld, the Commissioner found that Health Canada did not sufficiently demonstrate that information withheld under commercial and advice/recommendations exemptions met the required criteria. The Commissioner ordered Health Canada to disclose specific information previously withheld.

• Confidential third-party commercial, financial, scientific or technical information (s. 20(1)(b))
• Financial impact on a third party (s. 20(1)(c))
• Advice or recommendations (s. 21(1)(a))
• Solicitor-client privilege (s. 23)

Immigration, Refugees and Citizenship Canada (IRCC) contravened the Privacy Act when an employee inadvertently sent 497 emails containing personal information to the wrong email addresses. The investigation found that IRCC had insufficient administrative and procedural controls to prevent such errors. While IRCC took steps to notify affected individuals and mitigate harm, the Office of the Privacy Commissioner recommended improvements to prevent future breaches. IRCC accepted these recommendations and implemented enhanced measures, leading the OPC to consider the matter resolved.

• Whether IRCC contravened section 8 of the Privacy Act by disclosing personal information to unintended recipients.
• Adequacy of IRCC's administrative and procedural controls to prevent accidental disclosures.
• Effectiveness of IRCC's measures to mitigate the impact of the breach on affected individuals.
• Sufficiency of IRCC's actions to reduce the risk of recurrence.