Canadian privacy & access decisions

The complainant alleged that Parks Canada improperly withheld records concerning the Grassy Mountain Coal Project. The withheld information was claimed to be exempt under provisions related to personal information, advice and recommendations, and litigation privilege. The Information Commissioner found that while some information initially withheld under paragraph 21(1)(a) should have been disclosed, it was released during the investigation. The Commissioner was satisfied that the remaining withheld information met the criteria for the other exemptions claimed. The complaint was ultimately found to be well-founded.

• Whether information was properly withheld under subsection 19(1) (personal information).
• Whether information was properly withheld under paragraph 21(1)(a) (advice or recommendations).
• Whether information was properly withheld under section 23 (litigation privilege).
• Whether the institution properly excluded records deemed not relevant based on the complainant's prior agreement.

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all records sought under the Privacy Act. The investigation found that IRCC did not initially conduct a reasonable search for records, particularly concerning visa cancellations and reissuing. However, IRCC subsequently expanded its search to include all relevant offices, and although no additional information was found, the OPC was satisfied that its obligations under the Act were met, resolving the complaint.

• Reasonableness of IRCC's search for records.
• Whether IRCC failed to disclose all responsive information.
• Adequacy of IRCC's search scope and tasked offices.

An individual complained that Canada Post was using personal information collected from the outside of delivered mail to create marketing lists rented to private sector companies. The Office of the Privacy Commissioner of Canada (OPC) found that Canada Post's collection and use of this information for marketing purposes contravened section 5 of the Privacy Act because individuals were not authorized to have their information indirectly collected and used this way. While Canada Post disagreed with the findings and did not agree to cease the practice, it committed to improving transparency about its data usage.

• Whether Canada Post's collection of personal information from mail for marketing purposes complies with section 4 of the Privacy Act.
• Whether Canada Post's use and disclosure of personal information for marketing purposes complies with sections 7 and 8 of the Privacy Act.
• Whether Canada Post's indirect collection of personal information for marketing purposes, without explicit authorization, contravenes section 5 of the Privacy Act.
• What constitutes valid authorization for indirect collection of personal information under the Privacy Act.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld records related to correspondence with a third party, citing personal information and third-party business and financial information exemptions. DFO and the third party conceded that two exemptions were improperly applied, and the Information Commissioner found that the remaining exemption for confidential third-party information was not met. The Commissioner ordered DFO to disclose the information.

• Application of subsection 19(1) (personal information)
• Application of paragraphs 20(1)(a) (trade secrets) and 20(1)(c) (financial impact on third party)
• Application of paragraph 20(1)(b) (confidential third-party financial, commercial, scientific or technical information)
• Confidentiality criteria for paragraph 20(1)(b)

This investigation concerned an individual's complaint that their Permanent Resident Card renewal application, submitted to Immigration, Refugees and Citizenship Canada (IRCC), was inappropriately disclosed to the Canada Border Services Agency (CBSA). The complainant alleged this disclosure was contrary to the purpose for which the information was collected and that it was used in support of a cessation application to terminate refugee protection. The OPC found that the disclosure was consistent with the purpose for which the information was obtained, as both departments share a mandate under the Immigration and Refugee Protection Act and information sharing for immigration legislation enforcement is considered a consistent use. Therefore, the complaints against both departments were found not well-founded.

• Whether IRCC was authorized to disclose the complainant's personal information to the CBSA.
• Whether the disclosure was for a purpose for which the information was obtained or a consistent use.
• The interpretation of "consistent use" under paragraph 8(2)(a) of the Privacy Act.
• The impact of the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB).