Canadian privacy & access decisions

The complainant alleged that Rogers Communications Inc. improperly enrolled her in its Voice ID voiceprint authentication program without her consent and failed to allow her to opt out or delete her voiceprint. Rogers utilized a passive voiceprinting technology, "tuning," to create algorithmic voiceprints for customer authentication and fraud prevention. The Office of the Privacy Commissioner (OPC) found Rogers' purpose for collecting voiceprints to be appropriate, concluding this aspect of the complaint was not well-founded. However, the OPC determined that Rogers failed to obtain valid and meaningful express consent for the collection of sensitive biometric voiceprints, both during the "tuning" process and enrolment, as customers would not reasonably expect this. Furthermore, Rogers did not provide a clearly explained and easily accessible option for individuals to opt out and improperly retained voiceprints of opted-out individuals without any actual purpose. The OPC also identified deficiencies in Rogers' training materials and monitoring protocols for ensuring staff obtained valid consent. In response to OPC recommendations, Rogers committed to significant changes, including obtaining express consent before tuning, clearly informing customers of opt-out/deletion, deleting retained voiceprints, and improving training and monitoring. Consequently, the consent and retention aspects of the complaint were found to be well-founded and conditionally resolved.

• Whether the collection and use of voiceprints for authentication and fraud prevention constituted an appropriate purpose under PIPEDA s. 5(3)
• Whether Rogers obtained valid and meaningful consent for the collection of voiceprints (tuning and enrolment) under PIPEDA Principle 4.3 and s. 6.1
• Whether Rogers provided an adequate mechanism for the withdrawal of consent under PIPEDA Principle 4.3.8
• Whether Rogers' retention of voiceprints after opt-out was compliant with PIPEDA Principle 4.5.3
• Whether Rogers' training materials and protocols for obtaining consent were adequate

The complainant alleged that Trans Mountain Corporation (TMC) improperly withheld information under paragraphs 21(1)(a), 21(1)(b), and section 26 of the Access to Information Act, concerning documents related to specific Board of Directors meetings in 2019 for the Trans Mountain Project. During the investigation, TMC expanded its claims to include twelve additional exemptions, but failed to provide sufficient details or justification for any of the claimed exemptions or to properly consider severability. The Commissioner found that TMC had not applied the Act correctly and that further disclosure was warranted. Consequently, the Commissioner issued an initial report with an intended order for TMC to disclose all withheld information. TMC subsequently released portions of the records, which satisfied the complainant, making a formal order unnecessary.

• Whether s.21(1)(a) (advice or recommendations) applied to the withheld information
• Whether s.21(1)(b) (accounts of consultations or deliberations) applied to the withheld information
• Whether s.26 (information to be published) applied to the withheld information
• Whether s.13(1)(c) (confidential information from government bodies) applied to the withheld information
• Whether s.17 (safety of individuals) applied to the withheld information
• Whether s.18(a) (government financial, commercial, scientific or technical information) applied to the withheld information
• Whether s.18(b) (competitive position of government institutions) applied to the withheld information
• Whether s.20(1)(a) (third-party trade secrets) applied to the withheld information
• Whether s.20(1)(b) (confidential third-party financial, commercial, scientific or technical information) applied to the withheld information
• Whether s.20(1)(b.1) (third-party emergency management plans) applied to the withheld information
• Whether s.20(1)(c) (financial impact on a third party) applied to the withheld information
• Whether s.20(1)(d) (negotiations by a third party) applied to the withheld information
• Whether s.22 (testing or auditing procedures or techniques) applied to the withheld information
• Whether s.22.1(1) (draft internal audit reports and their working papers) applied to the withheld information
• Whether s.23 (solicitor-client and litigation privilege) applied to the withheld information
• Whether Trans Mountain Corporation met its burden of justifying the refusal to disclose information
• Whether Trans Mountain Corporation properly considered severability under s.25 of the Act
• Whether Trans Mountain Corporation's late introduction of additional exemptions and arguments was appropriate

The complainant alleged that the Department of Finance Canada (Finance) failed to respond to an access to information request within the statutory time limits. The request, submitted on July 22, 2020, sought records related to a backgrounder on COVID-19 support for students. Although Finance sought clarifications, it did not claim an extension, and the due date was October 16, 2020. The investigation revealed that the delay was primarily due to Finance's internal Federal-Provincial Relations and Social Policy Branch failing to provide records to the ATIP office in a timely manner. The Commissioner found that Finance was deemed to have refused access under subsection 10(3) of the Act due to the prolonged delay. The Commissioner ordered Finance to provide a final response forthwith, and Finance agreed to implement the order.

• Whether the Department of Finance Canada failed to respond to an access request within the time limits set out in the Access to Information Act
• Whether the institution was deemed to have refused access pursuant to subsection 10(3) of the Act

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to respond to four access to information requests within the 30-day statutory time limit. The OIC investigation confirmed that the RCMP did not issue responses by the deadlines for any of the four requests, leading to a deemed refusal of access under subsection 10(3) of the Act. The RCMP attributed the delays to operational challenges due to the COVID-19 pandemic, including difficulties in obtaining records from its Offices of Primary Interest (OPIs) and the need for legal consultations regarding potential Cabinet confidences. However, the Information Commissioner found these explanations insufficient to justify the significant, prolonged delays, noting that the issues identified were not new and had been the subject of previous commitments. Consequently, the Commissioner found all four complaints to be well founded and ordered the Minister of Public Safety and Emergency Preparedness to provide final responses to each request forthwith. The RCMP subsequently informed the OIC that the complainant agreed to consolidate the requests, and a response would be provided by March 18, 2022.

• Whether the institution responded to the access requests within the 30-day time limit under s.7 ATIA
• Whether the institution's reasons for delay (COVID-19 operational challenges, OPI delays, potential Cabinet confidences) justified the failure to respond within the statutory timeframe

A federal institution applied to the Information Commissioner for approval to decline to act on an access to information request, arguing it was both vexatious and an abuse of the right of access. The request sought materials for a specific course offered during a particular period. The institution contended the request was repetitive, noting the requester had submitted over 900 requests, many of which were identical or substantially similar, and had already received the requested records and complained to the OIC regarding previous responses. The requester acknowledged some repetitiveness but denied any intent to be vexatious or abusive. The Commissioner found that while the volume of requests alone does not constitute abuse, the duplicative nature of the current request, which sought no new information and was entirely captured by previous requests, did. The Commissioner concluded that the repeated requests for substantively the same information, despite previous OIC investigations and available recourse to the Federal Court, constituted a misuse and abuse of the Access to Information Act. Consequently, the Commissioner granted the institution's application.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request was an abuse of the right of access under s.6.1(1) ATIA
• Whether the volume of requests alone substantiates a finding of abuse
• Whether the duplicative nature of the request, given previous requests, constitutes abuse

An unnamed federal institution sought the Information Commissioner's approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The request was for all internal correspondence of the institution over a seven-year period, which the institution believed constituted an abuse of the right of access. The institution demonstrated that it had made reasonable efforts to assist the requester in narrowing the scope, but the requester declined to engage. The Commissioner found that the request's extraordinarily broad scope, combined with the institution's small size and limited resources, would severely impede its ability to fulfill its mandate and respond to other access requests. Based on these factors, the Commissioner concluded that the request was indeed an abuse of the right of access. The application was granted, allowing the institution to decline to act on the request.

• Whether the institution fulfilled its duty to assist under subsection 4(2.1) ATIA
• Whether the access request constitutes an abuse of the right of access under subsection 6.1(1) ATIA

An unnamed federal institution applied to the Information Commissioner for approval to decline to act on an access request, alleging it was vexatious and an abuse of the right of access. The institution stated the requester had submitted 893 requests over 17 years, many closely related, due to dissatisfaction with how the institution handled their affairs. The Commissioner considered the definition of "vexatious" and "abuse of right," drawing on jurisprudence from other Canadian jurisdictions. The Commissioner found 11 of the requester's prior requests were duplicative or substantially similar, rejecting the requester's arguments for their necessity. Ultimately, the Commissioner concluded that the request was both vexatious and an abuse of the right of access, citing the large volume of requests, their repetitive nature, and recurring complaints to the OIC. The application was granted, allowing the institution to decline to act on the request.

• Whether the access request is vexatious under s.6.1(1) ATIA
• Whether the access request constitutes an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the request is duplicative or substantially similar to previous requests
• Whether the volume of requests, combined with other factors, supports a finding of abuse of right

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act, alleging the request was vexatious, an abuse of the right to make a request, and in bad faith. The institution stated the requester was a former employee who had submitted over a dozen requests under the ATIA and Privacy Act within a year, following their dismissal. The Commissioner assessed the institution's claims regarding vagueness, repetitiveness, abusive language, and safety concerns, finding insufficient evidence to support the vexatious claim. The Commissioner also found no evidence that the request diminished the rights of other requesters or impacted the institution's other duties, thus rejecting the abuse of right claim. Finally, the Commissioner determined that the institution failed to prove the request was made in bad faith, noting that pursuing legal rights does not equate to bad faith. The Commissioner also found the institution did not demonstrate it fulfilled its duty to assist the requester. Consequently, the application was denied, and the institution was required to process the request.

• Whether the access request is vexatious under s.6.1(1) ATIA
• Whether the request is vague
• Whether the request is repetitive with previous requests
• Whether the requester used abusive language
• Whether there are concerns for the safety of employees related to the request
• Whether the access request is an abuse of the right to make a request under s.6.1(1) ATIA
• Whether the request diminishes the right of access of other requesters
• Whether the request affects the institution's ability to perform its other duties and responsibilities
• Whether the access request is made in bad faith under s.6.1(1) ATIA
• Whether the institution fulfilled its duty to assist the requester under s.4(2.1) ATIA

The complainant filed a complaint with the Office of the Information Commissioner (OIC) regarding an access request. The institution provided documentation showing that the complaint was submitted more than seven weeks after the 60-day statutory deadline set out in section 31 of the Access to Information Act. The complainant acknowledged the delay, explaining that the institution's response to their request had been "misplaced" after receipt, and asked the Commissioner to exercise "residual discretion" to extend the deadline. The Commissioner considered the complainant's representations and the documentary evidence. Citing Federal Court of Appeal jurisprudence, the Commissioner concluded that she does not have the authority to extend statutory timeframes for filing complaints. Therefore, the complaint was rejected as it did not meet the requirements of section 31.

• Whether the complaint was filed within the 60-day statutory timeframe under section 31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint

The complainant alleged that Public Services and Procurement Canada (PSPC) improperly processed an access request for a list of COVID-19 related contracts, specifically claiming the institution concealed records. The Office of the Information Commissioner (OIC) investigated the processing of the request, noting that a separate investigation had already found PSPC's delay in responding to be well-founded. This investigation focused on whether PSPC obstructed the right of access by concealing records. The OIC found that PSPC's internal processes, such as grouping requests and issues with obtaining records from the office of primary interest (OPI), led to significant delays. While acknowledging serious failures in processing, the Commissioner found no evidence of intent to conceal records or commit an offense under section 67.1 of the Act. The complaint was ultimately found to be well founded due to PSPC's failure to provide timely access and assist the requester.

• Whether PSPC processed the access request in accordance with the Access to Information Act
• Whether PSPC obstructed the right of access by concealing records
• Whether PSPC met its obligations under subsection 4(2.1) of the ATIA to assist the requester and provide timely access
• Whether there was evidence of an offense under subsection 67.1(1) of the ATIA (obstructing right of access)

The complainant alleged that the Treasury Board of Canada Secretariat (TBS) improperly withheld information under several sections of the Access to Information Act in response to a request for records about increased sick leave prior to retirement. During the investigation, the complainant narrowed the scope of the complaint, dropping the s.19(1) personal information claim and focusing on specific pages. The OIC found that TBS failed to demonstrate a reasonable expectation of harm for its s.18(b) claim, noting the statistical and dated nature of the information and the ongoing nature of negotiations. TBS also failed to substantiate its s.21(1)(a) claim for advice or recommendations. For s.21(1)(c) and s.21(1)(d), the OIC concluded that the information consisted of statistics, not positions, plans for negotiations, or plans related to personnel management. The Information Commissioner recommended full disclosure of the pages at issue, but TBS declined to implement the recommendations. The complaint was found to be well founded.

• Whether s.18(b) ATIA (negotiations by government institutions) was properly applied to statistical and dated information about sick leave usage
• Whether there was a reasonable expectation of harm to negotiations from disclosing sick leave usage data
• Whether s.21(1)(a) ATIA (advice or recommendations) was properly applied to a briefing note on sick leave usage
• Whether the information constituted advice or recommendations under s.21(1)(a)
• Whether s.21(1)(c) ATIA (positions or plans developed for negotiations) was properly applied to statistics and analyses about sick leave usage
• Whether the information consisted of positions or plans developed for negotiations under s.21(1)(c)
• Whether s.21(1)(d) ATIA (plans related to personnel management or administration) was properly applied to statistics and analyses about sick leave usage
• Whether the information consisted of plans related to personnel management or administration under s.21(1)(d)

The complainant alleged that the Department of Justice Canada (Justice) improperly withheld information related to cases filed with the Tax Court of Canada involving section 245 of the Income Tax Act. The request sought the name, file number, and pleadings of these cases. Justice initially provided a two-page printout and later, during the OIC's investigation, retrieved the full pleadings, exempting all information under section 23 (solicitor-client and litigation privilege) of the Access to Information Act. Justice argued that identifying the responsive records relied on privileged information in its iCase database, which contained legal counsel's views on potential legal issues. The Information Commissioner found that Justice failed to establish that the identification of these publicly available pleadings required legal advice or was subject to litigation privilege. The Commissioner concluded that the information used to generate the list was not privileged and that publicly available pleadings do not become privileged simply because they were identified through an internal, privileged system. The complaint was found to be well founded, and the Commissioner recommended full disclosure, but Justice refused to implement the recommendation.

• Whether the two-page printout generated from the iCase database was subject to solicitor-client privilege under s.23 ATIA
• Whether the two-page printout generated from the iCase database was subject to litigation privilege under s.23 ATIA
• Whether the pleadings identified through the iCase database were subject to solicitor-client privilege under s.23 ATIA
• Whether the pleadings identified through the iCase database were subject to litigation privilege under s.23 ATIA
• Whether the identification of responsive records hinged on information subject to legal advice privilege
• Whether the identification of responsive records hinged on information subject to litigation privilege
• Whether populating the 'issues' field in iCase with 'GAAR' reveals privileged information
• Whether a list generated to identify publicly available records is subject to solicitor-client privilege
• Whether a list generated to identify publicly available records is subject to litigation privilege

An anonymous complainant alleged that the Treasury Board of Canada Secretariat (TBS), as the administrator of the federal access to information system, failed to provide adequate support to government institutions during the COVID-19 pandemic. The complainant argued that this failure impeded the right of access to government information and was contrary to the principles of openness and transparency. The OIC's investigation reviewed over 5,000 pages of emails and guidance documents from TBS, covering the period from mid-March 2020 to June 22, 2020. The investigation found that TBS actively reminded institutions of their obligations, clarified responsibilities, and addressed misinterpretations. TBS also collected and shared data on institutions' operational capacities and provided tailored support to those facing significant challenges. Given TBS's limited authority over institutions' day-to-day operations, the Commissioner concluded that the support provided was adequate. Therefore, the complaint was not well founded.

• Whether the Treasury Board of Canada Secretariat provided adequate support to government institutions during the COVID-19 pandemic
• Whether the alleged lack of support impeded the right of access to government information
• Whether the alleged lack of support was contrary to the principles of openness and transparency