Canadian privacy & access decisions

The Information Commissioner initiated a complaint against Canadian Heritage (PCH) after reports indicated the institution had suspended processing access requests due to the COVID-19 pandemic. The investigation revealed that PCH's Access to Information and Privacy Secretariat could not access its work premises or departmental network remotely between March 16, 2020, and July 10, 2020. This resulted in a backlog of 224 access requests. The Commissioner found that PCH's failure to respond to these requests was not justified by any of the circumstances outlined in subsection 9(1) of the Act, thereby breaching requesters' quasi-constitutional rights of access. The complaint was deemed well-founded, and the Commissioner made six recommendations to the Minister of Canadian Heritage, who agreed to implement corrective measures.

• Whether the institution's suspension of access request processing constituted a breach of the Access to Information Act
• Whether the institution's failure to respond to requests was justified under subsection 9(1) of the Act

The complainant challenged Transport Canada's decision to withhold information concerning vehicle safety recall completion rates, citing sections 14, 20, and 21 of the Access to Information Act. The Office of the Information Commissioner (OIC) requested submissions from the complainant, Transport Canada, and a third party. The Commissioner determined that neither Transport Canada nor the third party had adequately demonstrated that the claimed exemptions applied to the information in question. Consequently, the Commissioner recommended that Transport Canada disclose all previously withheld information, excluding any personal information. Transport Canada confirmed its intention to implement these recommendations. The complaint was found to be well founded.

• Whether s.14 ATIA (federal-provincial affairs) applied to the withheld information
• Whether s.20 ATIA (third-party information) applied to the withheld information
• Whether s.21 ATIA (advice and recommendations) applied to the withheld information
• Whether Transport Canada and the third party met their burden of proof for the claimed exemptions

The complainant challenged VIA Rail's decision to withhold information concerning a High Frequency Rail Proposal. VIA Rail had applied multiple exemptions under the Access to Information Act. The Information Commissioner found that VIA Rail failed to demonstrate that the withheld information properly fell within the scope of the claimed exemptions. Furthermore, VIA Rail did not perform a severance exercise to release non-exempt portions of the records. The Commissioner recommended that VIA Rail conduct a severance exercise, disclose all information not meeting exemption criteria, and properly exercise discretion for any remaining exempt information. Consequently, the complaint was deemed well founded.

• Whether the information fell within the scope of the exemptions claimed under s.18 ATIA
• Whether the information fell within the scope of the exemptions claimed under s.21 ATIA
• Whether VIA Rail conducted a proper severance exercise to disclose non-exempt information

The Office of the Privacy Commissioner of Canada (OPC) investigated a major data breach at Desjardins that affected close to 9.7 million individuals in Canada and abroad between 2017 and 2019. The breach was caused by a malicious employee who exfiltrated sensitive personal information, including names, dates of birth, social insurance numbers, and transaction histories. The OPC found that Desjardins contravened PIPEDA's principles regarding accountability, retention periods, and security safeguards. Specifically, Desjardins had inadequate organizational policies and procedures, critical gaps in employee training and awareness, ineffective access controls and data segregation, and insufficient oversight and monitoring. Additionally, Desjardins failed to handle personal information in accordance with retention and destruction requirements, retaining some inactive files for decades. While the complaints were found to be well-founded, Desjardins' mitigation measures offered to affected individuals were deemed adequate. Desjardins committed to implementing the OPC's recommendations to address the identified weaknesses.

• Whether personal information held by Desjardins was protected throughout its life cycle by security safeguards appropriate to the sensitivity of the information as required by PIPEDA Safeguards Principle 4.7.
• Whether Desjardins fulfilled its responsibilities to implement procedures to protect personal information and train its staff, as set out in Accountability Principle 4.1.
• Whether the personal information of individuals was handled in accordance with the retention and destruction requirements as set out in PIPEDA Principle 4.5, limiting use, disclosure and retention.
• Whether the mitigation measures offered by Desjardins to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with PIPEDA Safeguards Principle 4.7.

An employee complained that a federal government institution breached her privacy by disclosing her transgender identity and the reasons for her transfer to her new manager and colleagues without her consent. The complainant had explicitly requested confidentiality due to prior workplace harassment related to her gender identity, and the employer had assured her of discretion. The institution's internal review confirmed that managers disclosed this sensitive information, believing it necessary to support the employee and her new supervisor, but acknowledged this was an error and contrary to internal policies. The OPC found that the disclosure was made without consent, contravening section 8(1) of the Privacy Act. The institution recognized the breach and committed to improving policies and providing transgender awareness education. The OPC recommended updating policies to prevent similar incidents, and the institution created new guidance for its staff.

• Whether information about an individual's transgender identity is personal information requiring protection under the Privacy Act
• Whether the institution disclosed the complainant's personal information without consent
• Whether the disclosure was contrary to section 8(1) of the Privacy Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request for minutes of the Joint Intelligence Committee from 1971 within the time limits stipulated by the Access to Information Act. PCO had claimed an extension, partly for consultations with other government institutions. When these consultations were not completed by the deadline, PCO informed the complainant it would not process the request, citing its 'no late file' policy. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations. Consequently, PCO was deemed to have refused the request under subsection 10(3) of the Act. The Commissioner recommended that PCO respond to the request and revise its policy to comply with the Act. PCO agreed to implement both recommendations, and the complaint was found to be well founded.

• Whether the institution failed to respond to an access request within the time limits set out in the Access to Information Act
• Whether the institution's 'no late file' policy, which led to closing a file due to outstanding consultations, is compliant with the Act
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1968. PCO claimed an extension, partly for consultations, but then closed the file under its 'no late file' policy when consulted institutions did not respond by the deadline. The OIC found that the Act does not permit an institution to cease processing a request due to delayed consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Information Commissioner recommended PCO respond to the request and revoke its 'no late file' policy. PCO agreed to revoke the policy and committed to responding by a revised date.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to close the file due to delayed responses from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1962. PCO claimed an extension, partly for consultations, but then closed the file, citing its 'no late file' policy and the lack of recommendations from other government institutions. The Office of the Information Commissioner found that the Act does not permit an institution to cease processing a request due to outstanding consultations, concluding that PCO was in deemed refusal under subsection 10(3) of the Act. The Commissioner recommended PCO respond to the request by a specific date and revoke or revise its 'no late file' policy to comply with the Act. PCO committed to a revised response date and confirmed the revocation of its policy. The complaint was found to be well founded.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution was authorized to cease processing an access request due to outstanding recommendations from consulted institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The Office of the Privacy Commissioner of Canada (OPC), along with its provincial counterparts in Alberta and British Columbia, conducted a joint investigation into The Cadillac Fairview Corporation Limited (CFCL) regarding its use of Anonymous Video Analytics (AVA) technology in mall directories and mobile device geolocation tracking. For the AVA technology, the Offices found that CFCL collected and used personal information, including sensitive biometric numerical representations of faces, without valid consent. CFCL also improperly retained approximately 5 million such representations and video/audio recordings. The Offices concluded that CFCL contravened PIPEDA and provincial privacy acts regarding consent and retention for AVA. In response, CFCL ceased using the AVA technology, deleted the improperly retained data, and committed to staff training, leading to a "well-founded and resolved" outcome for this issue. For mobile device geolocation tracking, the Offices found that data collected from anonymous shoppers (hashed MAC addresses and non-granular zone geolocation) did not constitute personal information. Furthermore, CFCL clarified that geolocation data was not linked to identifiable logged-in Wi-Fi users. Consequently, this aspect of the complaint was deemed "not well-founded." The Offices, however, recommended that CFCL obtain express consent if it were to activate geolocation tracking for identifiable Wi-Fi users in the future.

• Whether CFCL’s use of Anonymous Video Analytics (AVA) technology, via in-mall directories, resulted in the collection, use, and/or disclosure of personal information.
• Whether images of individual faces captured by AVA technology constitute personal information.
• Whether numerical representations of faces (biometric information) generated by AVA technology constitute personal information.
• Whether age range and gender assessments, combined with other data, constitute personal information.
• Whether CFCL obtained adequate and meaningful consent for the collection, use, and/or disclosure of personal information via AVA technology.
• Whether CFCL retained personal information collected via AVA technology longer than necessary.
• Whether CFCL’s use of mobile device geolocation technologies (Anonymous Shopper Journey) resulted in the collection, use, and/or disclosure of personal information.
• Whether hashed and randomized MAC addresses, combined with non-granular zone geolocation, constitute personal information in the context of anonymous shopper tracking.
• Whether CFCL’s use of mobile device geolocation technologies (Logged In Shopper Journey) resulted in the collection, use, and/or disclosure of personal information linked to identifiable individuals.
• Whether CFCL obtained adequate and meaningful consent for the collection, use, and/or disclosure of personal information via mobile device geolocation technologies (Logged In Shopper Journey).
• Whether CFCL's privacy policy and signage provided sufficient notice and obtained valid consent for its data collection practices.
• Whether the "serious possibility" threshold for identifying individuals was met for anonymous shopper journey data.

An applicant complained that Health Canada failed to identify all records responsive to an access request and improperly refused to provide an index of all responsive records. The investigation by the Office of the Information Commissioner (OIC) found that Health Canada had conducted a reasonable search for records and there was no evidence that any records were missing. The OIC also determined that Health Canada's refusal to create an index of records did not violate its duty to assist obligations under subsection 4(2.1) of the Access to Information Act. The Commissioner concluded that creating such an index for this specific request would have been unreasonable. Therefore, the complaint was deemed not well-founded.

• Whether Health Canada conducted a reasonable search for responsive records
• Whether Health Canada's refusal to provide an index of responsive records contravened its duty to assist under subsection 4(2.1) ATIA
• Whether creating an index of records for this request would have been unreasonable

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access request within the statutory time limits. The request sought minutes of the Joint Intelligence Committee from 1957 to 1958. PCO claimed an extension, partly for consultations with other government institutions. When these consultations were not completed by the deadline, PCO closed the file, citing a "no late file" policy and the absence of recommendations from consulted institutions. The Office of the Information Commissioner found that the Access to Information Act does not permit an institution to close a file or fail to respond due to outstanding consultations. Consequently, PCO was deemed to be in refusal under subsection 10(3) of the Act. The Commissioner recommended that PCO respond to the request and revise its policy to comply with the Act. PCO did not implement the recommendations.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether an institution can close an access request file due to outstanding consultations with other government institutions
• Whether the institution was in deemed refusal pursuant to subsection 10(3) of the Act

The Information Commissioner initiated a systemic investigation into the Royal Canadian Mounted Police's (RCMP) ability to provide timely responses to access to information requests between 2016-2017 and 2018-2019. The investigation was prompted by persistent complaints about the RCMP's failure to meet statutory timeframes and its lack of participation in delay complaint investigations. The Commissioner found that the RCMP's performance had significantly deteriorated, with a substantial increase in requests taking over 365 days to complete and a growing backlog. The RCMP attributed these issues to its geographical dispersion, the volume of requests, and the sensitive nature of its information holdings. The Commissioner made 15 recommendations across six areas, including tasking processes, procedures, training, electronic systems, resources, and a comprehensive strategy. However, the Minister of Public Safety's response largely ignored or inadequately addressed most of these recommendations, failing to commit to concrete plans or provide explanations for not addressing identified failings. Consequently, the Commissioner found the complaint to be well-founded, concluding that the Minister had accepted the status quo despite the dire situation.

• Whether the RCMP's tasking processes contributed to delays in responding to access requests
• Whether the RCMP's procedures for processing access requests were adequate and consistently applied
• Whether the RCMP provided sufficient training to staff involved in access to information
• Whether the RCMP's electronic systems were adequate for processing access requests efficiently
• Whether the RCMP had adequate human and financial resources for its access to information program
• Whether the RCMP had a comprehensive strategy to meet its access obligations and reduce its backlog
• Whether the Minister of Public Safety's response to the Commissioner's recommendations was satisfactory
• Whether the RCMP's failure to provide representations to the OIC during delay complaint investigations was appropriate

The complainant alleged that the Privy Council Office (PCO) failed to respond to an access to information request within the statutory time limits. The request, submitted in July 2016, sought records related to assistance for the 2016 Alberta fire disaster, involving approximately 9,100 pages. PCO initially claimed a 120-day extension but then put the request on indefinite hold for consultations, a practice not permitted by the Act. Despite the Information Commissioner's recommendation to provide a final response by June 1, 2020, PCO failed to meet this deadline, citing ongoing consultations and the impact of the COVID-19 pandemic. The Commissioner found the complaint to be well founded, noting that PCO was deemed to have refused access due to the delay. However, due to the complaint's filing date, the Commissioner lacked the authority to issue a binding order for disclosure.

• Whether the institution responded to the access request within the time limits set out in the Access to Information Act
• Whether the institution's indefinite 'hold' for consultations is permissible under the Act
• Whether the institution was deemed to have refused access under subsection 10(3) due to delay

The complainant alleged that the Department of Justice Canada (Justice) failed to respond to an access request within the statutory time limits. The OIC had previously investigated a complaint regarding the same request and recommended a response by December 15, 2019. Justice did not accept this recommendation but committed to disclosing the records by April 27, 2020. When Justice failed to meet this extended deadline, a new complaint was filed. The Commissioner found that Justice was deemed to have refused access under subsection 10(3) of the Act due to its failure to provide records within the prescribed timeframes. Consequently, the complaint was found to be well founded, and Justice was ordered to respond to the access request by September 30, 2020.

• Whether the institution failed to respond to an access request within the time limits set out in the Act
• Whether the institution was deemed to have refused access pursuant to subsection 10(3) of the Act

An individual complained that the Canadian Air Transport Security Authority (CATSA) contravened the Privacy Act by collecting and disclosing his personal information to police after finding legal medical cannabis during a security screening. The complainant argued that CATSA's mandate is aviation security, not general law enforcement, and that cannabis is not a prohibited item. CATSA maintained that its actions were incidental to its mandate and in the public interest, consistent with its regulator's direction. The OPC found that CATSA lacked the legal authority under section 4 of the Privacy Act to collect personal information for general law enforcement purposes related to cannabis, as cannabis is not on the Prohibited Items List and does not pose an aviation security threat. Similarly, the OPC concluded that the disclosure of this personal information to police was not consistent with section 8 of the Privacy Act. However, the OPC found CATSA's practice of destroying records related to such searches to be consistent with section 6 of the Act. The OPC recommended that CATSA cease unauthorized collection and disclosure of personal information related to cannabis and destroy any existing records, which CATSA agreed to implement.

• Whether the collection of personal information from travellers found to be in possession of cannabis is consistent with section 4 of the Privacy Act
• Whether the disclosure of the personal information of travellers found to be in possession of cannabis is consistent with section 8 of the Privacy Act
• Whether CATSA’s record retention practices in terms of the personal information collected from travellers found to be in possession of cannabis are consistent with section 6 of the Privacy Act