Canadian privacy & access decisions

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to respond to an access request for records concerning the procurement of new handguns for the military within the 30-day statutory time limit. PSPC received the request on June 4, 2021, and the response was due by July 5, 2021, but no response was provided. PSPC cited a backlog, operational challenges, heavy workloads, staff turnover, and competing priorities as reasons for the delay, and indicated a plan to respond by February 28, 2025. The Commissioner found that PSPC's reasons, including staffing shortages and the need for inter-institutional consultations, did not absolve it of its statutory obligation to provide a timely response. The Commissioner concluded that PSPC failed to meet its obligations under the Act and was deemed to have refused access. The complaint was found to be well founded, and PSPC was ordered to provide a complete response within 36 business days, an order which PSPC indicated it would not fully implement.

• Whether the institution responded to the access request within the 30-day time limit set out in section 7 of the Access to Information Act
• Whether the institution's reasons for delay (backlog, operational challenges, staff turnover, competing priorities, inter-institutional consultations) absolved it of its statutory obligation to respond within the time limit

The complainant alleged that National Defence (DND) failed to respond to an access request within the 30-day statutory period, leading to a deemed refusal. The request sought records related to strategic communications campaigns concerning perceptions about drones. DND argued that the request did not meet the requirements of section 6 of the Access to Information Act, claiming it lacked sufficient detail to identify records with reasonable effort. The Information Commissioner found that the request, which included a timeframe and subject, provided sufficient detail for an experienced employee to identify the records. The Commissioner also rejected DND's arguments that parts of the request were hypothetical or related to external academic papers. Consequently, DND was found to be in a state of deemed refusal. The complaint was well founded, and DND was ordered to provide a complete response to the access request.

• Whether National Defence responded to the access request within the 30-day period set out in section 7 of the Act
• Whether the access request met the requirements of section 6 of the Act to provide sufficient detail to identify records with reasonable effort
• Whether the request for 'strategic communications campaign(s)' was too broad
• Whether parts of the request were related to a hypothetical strategic communications plan
• Whether parts of the request were related to an academic paper not available within DND/CAF

The complainant alleged that the Canadian Security Intelligence Service (CSIS) failed to sufficiently identify redacted portions of records and the basis for withholding information in response to an access request for historical information about Warren Hart. CSIS used negative (white) redactions and cited exemptions only in the response letter, arguing that marking redactions on the records could cause harm. The Information Commissioner found that CSIS did not provide a cogent explanation for how clearly marked redactions and exemptions would reveal protected information. The Commissioner concluded that CSIS failed to meet its obligations regarding severance and the duty to assist. CSIS was recommended to provide a new response with clearly identified redactions and specific exemption provisions, and to cease using negative redactions and citing exemptions only in response letters. CSIS agreed to implement these recommendations.

• Whether CSIS sufficiently identified redacted portions of records
• Whether CSIS sufficiently identified the basis for withholding information
• Whether the use of negative (white) redactions by CSIS was appropriate
• Whether citing exemptions only in response letters by CSIS was appropriate
• Whether CSIS's practice contravened the duty to assist under subsection 4(2.1) ATIA
• Whether CSIS's practice contravened the severance requirement under section 25 ATIA
• Whether clearly marking redactions and exemptions on records would reveal protected information or cause harm

The complainant alleged that National Defence (DND) failed to conduct a reasonable search for records related to unidentified aerial phenomena (UAP) held by two named individuals. The investigation revealed that DND's Office of Primary Interest misread the request, limiting the search to only 'reports of UAP' instead of the broader 'general subject of UAP', and also unnecessarily restricted its search to keywords. The Office of the Information Commissioner (OIC) requested DND to perform an additional search, which resulted in the retrieval of 11 additional pages of records. The Commissioner concluded that DND did not conduct a reasonable search. The complaint was found to be well founded, and DND was ordered to provide access to the additional records.

• Whether National Defence conducted a reasonable search for records
• Whether the Office of Primary Interest misread the access request
• Whether limiting the search to keywords constituted a reasonable search

An individual complained that Transport Canada collected his personal information for the "Incentives for Zero-Emission Vehicles Program" (iZEV) without a publicly available Personal Information Bank (PIB) description, as required by the Privacy Act. Transport Canada launched the iZEV program in May 2019 but did not submit a PIB description to the Treasury Board Secretariat (TBS) for approval until 19 months later. The OPC found that both Transport Canada and TBS contributed to the contravention, as TBS failed to approve and publish the PIB description in a timely manner. Although Transport Canada eventually published the PIB, TBS declined to implement the OPC's recommendations for service standards, citing complexity, but outlined internal process improvements. The OPC acknowledged TBS's efforts to address the backlog.

• Whether Transport Canada failed to ensure personal information collected for the iZEV program was included in a publicly available PIB description as required by section 10 of the Privacy Act
• Whether Transport Canada obtained TBS approval for a new PIB before implementing the iZEV program as required by subsection 71(4) of the Privacy Act and the TBS Directive on Privacy Impact Assessment
• Whether TBS fulfilled its responsibility under section 11 of the Privacy Act to ensure timely publication of PIB descriptions
• Whether the lack of a timely PIB approval process by TBS impacts the operability of the PIB regime under the Privacy Act

Twenty complainants, current or former federal government employees, alleged that the Treasury Board of Canada Secretariat (TBS) improperly disclosed their personal information. TBS mistakenly sent two emails to 400 applicants for the Severe Phoenix Impacts program using the 'cc' field instead of 'bcc', revealing email addresses (some with names) and the fact they had filed a claim for Phoenix-related damages. The OPC found that the disclosure was not authorized under the Privacy Act, making the complaints well-founded. While TBS acknowledged the error, it initially deemed the breach non-material, a conclusion the OPC disagreed with, emphasizing the importance of contextual factors in assessing harm. TBS agreed to implement two of the OPC's three recommendations, but not the one concerning incorporating the findings on materiality into its policy instruments. The OPC concluded the complaints were well-founded and conditionally resolved in part, expressing ongoing concern about TBS's assessment of breach materiality.

• Whether the disclosure of personal information via email was authorized under the Privacy Act
• Whether the privacy breach was 'material' in nature according to TBS's guidelines
• Whether TBS's assessment of the breach's materiality was appropriate
• Whether the context of the personal information disclosed should be considered when assessing the risk of injury or harm