Canadian privacy & access decisions

The complainant alleged that Parks Canada improperly withheld information under various sections of the Access to Information Act in response to a request for records related to Benga Mining or the Grassy Mountain Coal Project. The institution withheld information under subsection 19(1) (personal information), paragraphs 21(1)(a), (b), (c) (advice, consultations, plans), and section 23 (litigation privilege). During the investigation, Parks Canada disclosed a portion of the record initially withheld under paragraph 21(1)(a) due to the passage of time. The Commissioner found that the remaining information withheld under subsection 19(1), paragraph 21(1)(a), and section 23 met the criteria for exemption and that the institution had reasonably exercised its discretion. The Commissioner also addressed the complainant's concern about records marked as "not relevant," finding that Parks Canada was justified in not processing these records given the complainant's prior agreement to narrow the scope of the request. Despite upholding the institution's application of most exemptions, the complaint was found to be well-founded because the institution initially improperly withheld information under paragraph 21(1)(a) that was later released.

• Whether s.19(1) personal information exemption was properly applied
• Whether discretion under s.19(2) was reasonably exercised
• Whether s.21(1)(a) advice or recommendations exemption was properly applied
• Whether discretion under s.21(1)(a) was reasonably exercised
• Whether s.21(1)(b) accounts of consultations or deliberations exemption was properly applied
• Whether s.21(1)(c) positions or plans developed for negotiations exemption was properly applied
• Whether s.23 litigation privilege exemption was properly applied
• Whether discretion under s.23 was reasonably exercised
• Whether Parks Canada was justified in not processing records deemed 'not relevant' based on complainant's prior agreement

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) failed to disclose all information sought under the Privacy Act, specifically regarding the cancellation and reissuing of visas for the complainant and her children. The investigation found that IRCC initially narrowed the scope of the request without the complainant's approval and did not conduct a sufficiently broad search for records. The OPC determined that IRCC did not initially conduct a reasonable search for records. However, during the investigation, IRCC expanded its search to include additional offices and a specific former employee's correspondence. Although no additional records were found, IRCC's subsequent efforts satisfied the OPC that it had met its obligations under the Act.

• Whether IRCC conducted a reasonable search for records responsive to the access request
• Whether IRCC improperly reduced the scope of the request without the complainant's approval
• Whether IRCC tasked all appropriate Offices of Primary Interest (OPIs) in its initial search

An individual complained that Canada Post (CPC) was using personal information gathered from the outside of delivered envelopes and parcels to create mail marketing lists, which it then rented to the private sector. The Office of the Privacy Commissioner (OPC) investigated whether CPC's Smartmail Marketing Program (SMM Program) complied with the Privacy Act. The OPC found that CPC's collection of personal information for the SMM Program was directly related to an operating program (s.4) and that its use and disclosure were for an original purpose of collection (s.7 and s.8), thus compliant with these sections. However, the OPC determined that the SMM Program constituted an "administrative purpose" under the Act, and CPC had failed to obtain individuals' authorization for the indirect collection of their personal information, contravening section 5. CPC disagreed with this finding and refused to implement the OPC's recommendation to cease the practice without authorization, proposing only enhanced transparency measures which the OPC deemed insufficient. Consequently, the complaint was found to be well-founded and not resolved.

• Whether Canada Post's collection of personal information for marketing mail list services complies with section 4 of the Privacy Act (related directly to an operating program or activity).
• Whether Canada Post's use and disclosure of personal information for marketing mail list services complies with sections 7 and 8 of the Privacy Act (for the purpose obtained or consistent use, or with consent).
• Whether Canada Post's collection of personal information for marketing mail list services complies with section 5 of the Privacy Act (direct collection for administrative purpose, or with authorization).
• Whether the use of an individual's information to provide mail marketing services constitutes an "administrative purpose" under section 3 of the Privacy Act.
• Whether individuals implicitly authorized Canada Post to indirectly collect their personal information for the SMM Program by accepting mail delivery or through the availability of an opt-out mechanism.
• Whether the exceptions under subsection 5(3) of the Privacy Act apply.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsections 19(1), 20(1)(a), 20(1)(b), and 20(1)(c) of the Access to Information Act in response to a request for correspondence between DFO and Deep Water Recovery. During the investigation, the application of subsection 19(1) was removed from the scope of the complaint, and both DFO and the third party conceded that paragraphs 20(1)(a) and 20(1)(c) should not have been applied. The investigation therefore focused on paragraph 20(1)(b). The Commissioner found that neither DFO nor Deep Water Recovery demonstrated that the information met all the requirements for confidentiality under paragraph 20(1)(b), specifically that the information was not publicly available and that there was a reasonable expectation of confidentiality. Consequently, the Commissioner concluded that the information did not meet the requirements of paragraph 20(1)(b). The complaint was found to be well founded, and DFO was ordered to disclose the information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.20(1)(a) third-party trade secrets exemption was properly applied
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether the information was available from sources otherwise accessible by the public (confidentiality criterion)
• Whether the information was communicated with a reasonable expectation that it would not be disclosed (confidentiality criterion)
• Whether the information was communicated in a relationship fostered for public benefit by its confidentiality (confidentiality criterion)
• Whether the OIC's notice to third parties under s.36.3 breached natural justice and procedural fairness

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) inappropriately disclosed his Permanent Resident Card (PRC) renewal paperwork to the Canada Border Services Agency (CBSA), which was then used in a cessation application, contrary to the purpose for which it was collected. The OPC investigated whether IRCC was authorized to disclose this personal information to the CBSA under paragraph 8(2)(a) of the Privacy Act, which permits disclosure for a consistent use. IRCC and CBSA argued that their information sharing for the administration and enforcement of the Immigration and Refugee Protection Act (IRPA) constitutes a consistent use. The OPC found that the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB) explicitly stated that information might be shared with CBSA for investigations related to immigration legislation. Therefore, the OPC concluded that the disclosure was for a consistent use, and the complaints against both departments were not well-founded.

• Whether IRCC's disclosure of the complainant's personal information to CBSA was authorized under paragraph 8(2)(a) of the Privacy Act
• Whether the use of the personal information by CBSA in a cessation application was consistent with the purpose for which it was collected by IRCC
• Whether the complainant could reasonably expect the disclosure of his PRC renewal application to CBSA for immigration investigations