Canadian privacy & access decisions

A complaint was filed against Correctional Service Canada (CSC) by the spouse of an employee, alleging inappropriate collection and disclosure of personal information from their public Facebook page. The information was collected by an assistant warden to investigate the employee's use of 'other leave with pay (699)' during the COVID-19 pandemic. The OPC found that significant portions of the collected information were not directly related to an operating program or activity of CSC, thus contravening Section 4 of the Privacy Act. The OPC also noted that the exclusion for publicly available information under subsection 69(2) of the Privacy Act applies only to use and disclosure, not collection. CSC subsequently deleted the collected screenshots and committed to developing guidance for managers on collecting information in a labour relations context. The complainant also raised concerns about CSC's internal complaint process, which CSC acknowledged was mishandled.

• Whether the collection of personal information from a public Facebook page was directly related to an operating program or activity of CSC under Section 4 of the Privacy Act
• Whether the exclusion for publicly available information under subsection 69(2) of the Privacy Act applies to the collection of personal information
• Whether the subsequent disclosure of the collected information was appropriate
• Whether CSC's internal process for handling privacy complaints from the public was adequate

The complainant alleged that Transport Canada improperly withheld information under subsection 19(1) and paragraph 20(1)(b) of the Access to Information Act, related to applications and Minimum Safe Manning Documents for the motor vessel Spirit of Vancouver Island. The complaint regarding subsection 19(1) was later removed from the investigation's scope. During the investigation, Transport Canada also applied paragraph 20(1)(b.1) to one document. The Commissioner found that while portions of one document met the requirements of paragraph 20(1)(b.1), the titles and headings did not. Furthermore, neither Transport Canada nor the third party provided sufficient representations to justify withholding information under paragraph 20(1)(b), except for the titles and headings of the document also claimed under 20(1)(b.1). The Commissioner ordered Transport Canada to disclose all information withheld under paragraphs 20(1)(b) and 20(1)(b.1), with the exception of the main content of page 50, and to disclose the titles and headings on page 50. Transport Canada indicated it would "likely" comply with the order.

• Whether s.19(1) personal information was properly withheld
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information was properly withheld
• Whether s.20(1)(b.1) third-party emergency management plans information was properly withheld
• Whether the information concerned critical infrastructure information under s.20(1)(b.1)
• Whether the information was supplied in confidence under s.20(1)(b.1)
• Whether the information was supplied for the preparation, maintenance, testing or implementation of emergency management plans under s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(5) regarding s.20(1)(b.1)
• Whether Transport Canada reasonably exercised its discretion under s.20(6) regarding s.20(1)(b.1)
• Whether the information was financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information was confidential under s.20(1)(b)
• Whether the third party supplied the information to a government institution under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)

An employee of the Immigration and Refugee Board of Canada (IRB) complained that their intimate personal and sensitive medical information, contained in a Fitness to Work (FTW) report, was disclosed to their management team without consent and for no reasonable purpose. The OPC investigated whether the IRB respected section 8 of the Privacy Act, specifically regarding consent and consistent use. The IRB argued the disclosure was a consistent use, but the OPC found that while some information disclosure was consistent, the highly intimate personal and sensitive medical information was not. The OPC concluded that the IRB contravened the Act by disclosing information internally that fell outside what is permissible. Despite some new processes, the IRB did not fully acknowledge wrongdoing or agree to all recommendations, leading to a well-founded and unresolved finding.

• Whether the IRB obtained valid consent for the disclosure of the FTW report to the management team under section 8(1) of the Privacy Act
• Whether the disclosure of intimate personal and sensitive medical information in the FTW report to the management team was a 'consistent use' under section 8(2)(a) of the Privacy Act
• Whether the IRB adhered to the Treasury Board Secretariat's Occupational Health Evaluation Standard regarding disclosure of medical information to employers