Canadian privacy & access decisions

The complainant alleged that the Canada Mortgage and Housing Corporation (CMHC) improperly withheld information under several sections of the Access to Information Act related to the Canada Mortgage Bonds (CMB) program and National Housing Act Mortgage-Backed Securities (NHA MBS) programs. During the investigation, CMHC disclosed some information previously withheld under paragraphs 18(a), 18(b), 21(1)(a), and 21(1)(b), citing the passage of time. The OIC found that CMHC appropriately applied paragraph 68(a) to exclude information available for purchase and that CMHC's application of paragraphs 18(a) and 21(1)(a) was justified, including a reasonable exercise of discretion. However, CMHC failed to demonstrate that the information withheld under paragraph 20(1)(b) met the exemption's requirements, particularly because the relevant third parties (Cornerstone and AKA) did not provide representations to support the claim. Consequently, the Information Commissioner ordered CMHC to disclose the information withheld under paragraph 20(1)(b). CMHC agreed to implement the order.

• Whether s.18(a) ATIA (government financial, commercial, scientific or technical information) was properly applied
• Whether CMHC reasonably exercised its discretion under s.18(a) ATIA
• Whether s.18(b) ATIA (competitive position of government institutions, negotiations by government institutions) was properly applied
• Whether s.20(1)(a) ATIA (third-party trade secrets) was properly applied
• Whether s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information) was properly applied
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied
• Whether CMHC reasonably exercised its discretion under s.21(1)(a) ATIA
• Whether s.21(1)(b) ATIA (accounts of consultations or deliberations) was properly applied
• Whether s.68(a) ATIA (material available for purchase) applied to exclude information

The complainant alleged that Agriculture and Agri-Food Canada (AAFC) improperly withheld information under subsection 19(1) (personal information) and paragraph 20(1)(b) (confidential third-party information) of the Access to Information Act. The request sought communications with the National Farm Animal Care Council (NFACC) regarding a Five-Year Review Summary Report and proposed amendments to the Code of Practice for the Care and Handling of Pigs. During the investigation, AAFC disclosed some records, and the complainant narrowed the scope of the complaint. The Information Commissioner found that the information remaining under subsection 19(1) was properly withheld as personal information. However, the Commissioner determined that the information withheld under paragraph 20(1)(b) did not meet the criteria for exemption, specifically, it was not financial, commercial, scientific, or technical. The complaint was found to be well founded, and AAFC was ordered to disclose the information withheld under paragraph 20(1)(b). AAFC subsequently notified the Commissioner that it would not implement the order and intended to apply to the Federal Court.

• Whether records were under the control of the institution
• Whether information met the criteria for exemption under s.19(1) ATIA (personal information)
• Whether the institution reasonably exercised its discretion under s.19(2) ATIA
• Whether information met the criteria for exemption under s.20(1)(b) ATIA (confidential third-party financial, commercial, scientific or technical information)
• Whether the information was financial, commercial, scientific, or technical

The complainant alleged that the Social Sciences and Humanities Research Council (SSHRC) improperly withheld information under paragraph 20(1)(b) of the Access to Information Act. The request sought records related to a virtual town hall meeting and other contacts between SSHRC and Memorial University of Newfoundland and Labrador (MUN) officials. SSHRC withheld technical information for WebEx meetings and data on MUN's application and success rates for SSHRC funding programs, citing confidentiality. The Commissioner found that while the WebEx access information was technical, neither SSHRC nor MUN demonstrated that it met the confidentiality criteria, particularly given the large number of potential attendees and lack of measures to prevent sharing. Furthermore, the Commissioner determined that MUN's application and success rates were not financial, commercial, scientific, or technical information, and SSHRC later confirmed some of this information was publicly available. Consequently, the Commissioner concluded that the information did not meet the requirements for exemption under paragraph 20(1)(b).

• Whether the withheld information is financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the WebEx access information is confidential under s.20(1)(b) ATIA
• Whether MUN's application and success rates are confidential under s.20(1)(b) ATIA
• Whether the information was consistently treated as confidential by the third party
• Whether the relationship between the institution and third party was fostered for public benefit by confidential communication

The complainant alleged that the Canadian Institutes of Health Research (CIHR) improperly withheld information under subsections 18(a), 19(1), and 20(1)(b) of the Access to Information Act, concerning an individual's role on the Pfizer Lyme Disease Advisory Board and their research project. During the investigation, the complainant narrowed the scope to three specific sections of records withheld under paragraph 20(1)(b). The OIC sought representations from the third party (Nominated Principal Investigator via Queen's University), who had no concerns with disclosure. CIHR subsequently conceded that the threshold for paragraph 20(1)(b) had not been met and indicated preparedness to release the information. The Commissioner found that the information at issue, describing aspects of a proposed research network, was not financial, commercial, scientific, or technical as required by paragraph 20(1)(b). Therefore, the Commissioner concluded that the exemption did not apply. The complaint was found to be well founded, and CIHR was ordered to disclose the information.

• Whether the withheld information was financial, commercial, scientific, or technical under s.20(1)(b) ATIA
• Whether the information was confidential under s.20(1)(b) ATIA
• Whether the information was supplied by a third party to a government institution under s.20(1)(b) ATIA
• Whether the third party consistently treated the information as confidential under s.20(1)(b) ATIA

A federal institution applied to the Information Commissioner for approval to decline to act on two access to information requests, arguing they were vexatious and an abuse of the right of access under subsection 6.1(1) of the Access to Information Act. The institution claimed the requester submitted a high volume of requests, refused to narrow their scope, and engaged in intimidating communications, thereby diverting public resources and harassing the department. The Commissioner found that the institution failed to fulfill its duty to assist the requester under subsection 4(2.1) of the Act, as its communication was solely aimed at reducing scope without offering other assistance. Furthermore, the Commissioner determined that the institution did not provide clear and compelling evidence to support its claims that the requests were vexatious or an abuse of the right of access. The Commissioner denied the institution's application, requiring it to process the access requests.

• Whether the institution fulfilled its duty to assist obligations under subsection 4(2.1) of the Act
• Whether the access requests were vexatious under subsection 6.1(1) of the Act
• Whether the access requests constituted an abuse of the right to make a request under subsection 6.1(1) of the Act

The Office of the Privacy Commissioner of Canada (OPC) investigated Agronomy Company of Canada Ltd. following a complaint alleging inadequate safeguards, lack of accountability, and invalid consent for personal information collection and use, stemming from a data breach. A malicious actor gained access to Agronomy's systems, exfiltrating sensitive personal information of 845 individuals, including SINs, financial details, and identification documents, before deploying ransomware. The OPC found Agronomy failed to implement appropriate safeguards, citing a lack of multifactor authentication, network segregation, data encryption, and detection tools, which contributed to the breach. Furthermore, Agronomy lacked a comprehensive privacy policy, a designated privacy officer, and adequate staff training, indicating a failure in accountability. While these two aspects were found well-founded, Agronomy committed to significant improvements, leading to a conditionally resolved outcome. However, the OPC found the complaint regarding invalid consent for credit services not well-founded, as the complainant had signed a clearly labelled credit application and utilized the extended credit.

• Whether Agronomy implemented appropriate safeguards to adequately protect personal information under its control, as per PIPEDA Principle 4.7.
• Whether Agronomy's technical safeguards (multifactor authentication, network segregation, data encryption, detection and response tools) were appropriate for the sensitivity of the information.
• Whether Agronomy's organizational safeguards (incident response protocols, information management, security documentation, staff training) were adequate.
• Whether Agronomy was accountable for personal information under its control, including designating an individual for PIPEDA compliance and implementing policies and practices, as per PIPEDA Principle 4.1.
• Whether Agronomy obtained valid and meaningful consent for the collection and use of personal information for credit services, particularly sensitive information, as per PIPEDA Principle 4.3.